Bug bounty program
IN
inDrive
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Change phone number OTP flaw leads to any phone number takeoverAnalysed#2588329 | Input Validation and Logic | 2024-10-09 | $2,000 | 241 |
| Blind SQL injection on id.indrive.comAnalysed#2051931 | SQL Injection | 2023-11-24 | $4,134 | 199 |
| inDriver Job - Admin Approval BypassAnalysed#1861487 | Access Control | 2023-07-05 | $1,000 | 157 |
| #1 XSS on watchdocs.indriverapp.comAnalysed#2014955 | Cross-site Scripting | 2024-04-11 | – | 147 |
| SSRF in https://couriers.indrive.com/api/file-storageAnalysed#2300358 | Server-Side Request Forgery | 2024-01-16 | – | 141 |
| Full access to InDrive jira panel via exposed API tokenAnalysed#1785145 | Information Disclosure | 2023-06-28 | – | 125 |
| Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Analysed#2125049 | Input Validation and Logic | 2024-07-02 | – | 110 |
| #2 XSS on watchdocs.indriverapp.comAnalysed#2015074 | Cross-site Scripting | 2024-04-11 | – | 101 |
| Reflected XSS of media.indrive.com#2503113 | Cross-site Scripting | 2024-07-02 | – | 80 |
| # Drivers can access the customers phone number, current location without getting their offer accepted!#1785079 | Information Disclosure | 2024-02-19 | – | 79 |
Subdomains2,406
| Name | Scope | First seen |
|---|---|---|
| demo.indrive.comtest | In scope | 2026-11-14 |
| qa.delivery.indrive.comtest | In scope | 2026-11-14 |
| sandbox.delivery.indrive.comtest | In scope | 2026-11-14 |
| internal.qa.delivery.indrive.cominternal, test | In scope | 2026-11-14 |
| wildcard.qa.delivery.indrive.comtest | In scope | 2026-11-14 |
| internal.sandbox.delivery.indrive.cominternal, test | In scope | 2026-11-14 |
| wildcard.sandbox.delivery.indrive.comtest | In scope | 2026-11-14 |
| wildcard.internal.qa.delivery.indrive.cominternal, test | In scope | 2026-11-14 |
| wildcard.internal.sandbox.delivery.indrive.cominternal, test | In scope | 2026-11-14 |
| podval-test.aws.indriverapp.comtest | In scope | 2026-11-14 |
| cert-test.eu-east-1.indriverapp.comtest | In scope | 2026-11-14 |
| infra-test.euce1.aws.indriverapp.comtest | In scope | 2026-11-14 |
| vpn-test.fr1.baremetal.indriverapp.comtest, vpn | In scope | 2026-11-14 |
| qa.indriverjob.comtest | Not in the scope | 2026-11-14 |
| demo.indriverjob.comtest | Not in the scope | 2026-11-14 |
| 1c-test.volans.techtest | Not in the scope | 2026-11-14 |
| mow-test.volans.techtest | Not in the scope | 2026-11-14 |
| ykt-test.volans.techtest | Not in the scope | 2026-11-14 |
| test-scim.volans.techtest | Not in the scope | 2026-11-14 |
| vpn-test-1.volans.techtest, vpn | Not in the scope | 2026-11-14 |
| vpn-test-2.volans.techtest, vpn | Not in the scope | 2026-11-14 |
| ws-testing.volans.techtest | Not in the scope | 2026-11-14 |
| testing-vpn.volans.techtest, vpn | Not in the scope | 2026-11-14 |
| webdav-test.volans.techtest | Not in the scope | 2026-11-14 |
| www.webdav-test.volans.techtest | Not in the scope | 2026-11-14 |
2,225 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.