Bug bounty program
IN
inDrive
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Change phone number OTP flaw leads to any phone number takeoverAnalysed#2588329 | Input Validation and Logic | 2024-10-09 | $2,000 | 241 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | SQL Injection | 2023-11-24 | $4,134 | 199 |
| inDriver Job - Admin Approval BypassAnalysed#1861487 | Access Control | 2023-07-05 | $1,000 | 157 |
| #1 XSS on watchdocs.indriverapp.comAnalysed#2014955 | Cross-site Scripting | 2024-04-11 | – | 147 |
| SSRF in https://couriers.indrive.com/api/file-storageAnalysed#2300358 | Server-Side Request Forgery | 2024-01-16 | – | 141 |
| Full access to InDrive jira panel via exposed API tokenAnalysed#1785145 | Information Disclosure | 2023-06-28 | – | 125 |
| Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Analysed#2125049 | Input Validation and Logic | 2024-07-02 | – | 110 |
| #2 XSS on watchdocs.indriverapp.comAnalysed#2015074 | Cross-site Scripting | 2024-04-11 | – | 101 |
| Reflected XSS of media.indrive.com#2503113 | Cross-site Scripting | 2024-07-02 | – | 80 |
| # Drivers can access the customers phone number, current location without getting their offer accepted!#1785079 | Information Disclosure | 2024-02-19 | – | 79 |
Subdomains2,406
| Name | Scope | First seen |
|---|---|---|
| dev.delivery.indrive.comdev | In scope | 2026-11-14 |
| internal.dev.delivery.indrive.comdev, internal | In scope | 2026-11-14 |
| wildcard.dev.delivery.indrive.comdev | In scope | 2026-11-14 |
| wildcard.internal.dev.delivery.indrive.comdev, internal | In scope | 2026-11-14 |
2,225 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.