Bug bounty program

Moneybird

Platform: HackerOne
Bounties: Pays
Assets in scope: 4
Disclosed reports: 27
Subdomains: 32

Most upvoted reports27

Most upvoted reports of Moneybird
Report	Weakness	Disclosed	Bounty	Votes
Bypass password reset rate limit protection at moneybird.com/passwordsAnalysed#723974	Denial of Service	2019-12-22	–	164
Enable 2FA without verifying the emailAnalysed#649533	Denial of Service	2019-10-25	–	149
Open Redirect through POST Request in OAuth#1129761	Open Redirect	2021-09-21	–	34
No rate Limit#1145293	No weakness recorded	2021-05-03	–	32
Access control issue on invoice documents downloading feature.#1137218	Access Control	2021-04-01	–	29
Open Redirection while saving User account Settings#288219	Open Redirect	2017-11-15	–	28
IDOR in https://moneybird.com/user/accountant_company/edit(change company name)#726163	Insecure Direct Object Reference	2021-09-21	–	22
Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure#269318	Authentication	2021-05-06	–	19
Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action#135989	Authentication	2016-06-13	–	15
Pending MFA logins aren't immediatly expired after a password change#743518	Authentication	2020-07-10	–	15

Subdomains32

Root

Scope

Name suggests:Development

First seen

Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.