Bug bounty program · HackerOne
Most upvoted reports13
- #510152ValidAnalysedBypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$20,0002,687votes
- #739737ValidAnalysedToken leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · Authentication · 2020 · needs: no account · Information disclosure, Authentication bypass$15,3001,409votes
- #925585ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryPayPal · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain$30,000946votes
- #622122ValidAnalysedDoS on PayPal via web cache poisoningPayPal · Denial of Service · 2019 · needs: no account · Cache poisoning, Denial of service, Request smuggling$9,700851votes
- #415081ValidAnalysedIDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · Insecure Direct Object Reference · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check$10,500797votes
- #488147ValidAnalysedStored XSS on https://paypal.com/signin via cache poisoningPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$18,900685votes
- #424443Valid[PayPal Android] Remote theft of user session using push_notification_webview deeplinkPayPal · Open Redirect · 2019–188votes
- #401940Valid[Venmo Android] Remote theft of user sessionPayPal · Open Redirect · 2019–151votes
- #753835ValidReflected XSS at https://www.paypal.com/ppcreditapply/da/usPayPal · Cross-site Scripting · 2020–137votes
- #425200ValidXSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)PayPal · Cross-site Scripting · 2018–100votes
Subdomains17,146
17,014 covered by the program's own scope · 0 first seen this week
Roots:paypal.com 8,208 · 8,208 in scopevenmo.com 5,152 · 5,152 in scopebraintree-api.com 1,282 · 1,282 in scopexoom.com 968 · 968 in scopebraintreepayments.com 713 · 713 in scopepaydiant.com 435 · 435 in scopebraintree.tools 155 · 155 in scopebraintreegateway.com 89 · 89 in scopeswiftfinancial.com 59 · 8 in scopeswiftcapital.com 29 · 1 in scopeloanbuilder.com 23 · 3 in scopepaypalobjects.com 22paypal.me 8py.pl 3paypal.here 0xoom.app 0
17,146 names
| Name | Scope | First seen |
|---|---|---|
| 10.72.104.128payments.braintree-api.com | In scope | 2026-11-14 |
| actions.braintree-api.com | In scope | 2026-11-14 |
| api.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-east-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-northeast-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-northeast-2.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-south-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-southeast-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-ap-southeast-2.braintree-api.comapi | In scope | 2026-11-14 |
| api-ca-central-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-eu-central-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-eu-north-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-eu-west-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-eu-west-2.braintree-api.comapi | In scope | 2026-11-14 |
| api-eu-west-3.braintree-api.comapi | In scope | 2026-11-14 |
| api-ga.braintree-api.comapi | In scope | 2026-11-14 |
| api-sa-east-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-us-east-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-us-east-2.braintree-api.comapi | In scope | 2026-11-14 |
| api-us-west-1.braintree-api.comapi | In scope | 2026-11-14 |
| api-us-west-2.braintree-api.comapi | In scope | 2026-11-14 |
| apply-ec-ap-south-1.braintree-api.com | In scope | 2026-11-14 |
| apply-ec-ap-southeast-2.braintree-api.com | In scope | 2026-11-14 |
| apply-ec-eu-central-1.braintree-api.com | In scope | 2026-11-14 |
| apply-ec-us-east-1.braintree-api.com | In scope | 2026-11-14 |
| apply-ec-us-east-2.braintree-api.com | In scope | 2026-11-14 |
| apply-ec-us-west-2.braintree-api.com | In scope | 2026-11-14 |
| arbiter.braintree-api.com | In scope | 2026-11-14 |
| packages-artifactory-ap-south-1.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| packages-artifactory-ap-southeast-2.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| packages-artifactory-eu-central-1.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| packages-artifactory-us-east-1.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| packages-artifactory-us-east-2.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| packages-artifactory-us-west-2.artifactory.braintree-api.comtools | In scope | 2026-11-14 |
| poc.auth.braintree-api.comauth | In scope | 2026-11-14 |
| foo.bar.baz.braintree-api.com | In scope | 2026-11-14 |
| blue-front-door.braintree-api.com | In scope | 2026-11-14 |
| blue-pizion.braintree-api.com | In scope | 2026-11-14 |
| consul.braintree-api.comtools | In scope | 2026-11-14 |
| merchire.cooduction.braintree-api.com | In scope | 2026-11-14 |
| airflow.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| airui-dataprod-ap-southeast-2.data-production.braintree-api.com | In scope | 2026-11-14 |
| airui-dataprod-eu-central-1.data-production.braintree-api.com | In scope | 2026-11-14 |
| airui-dataprod-us-east-1.data-production.braintree-api.com | In scope | 2026-11-14 |
| airui-dataprod-us-east-2.data-production.braintree-api.com | In scope | 2026-11-14 |
| airui-dataprod-us-west-1.data-production.braintree-api.com | In scope | 2026-11-14 |
| airui-dataprod-us-west-2.data-production.braintree-api.com | In scope | 2026-11-14 |
| data-airflow-flower-dataprod.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ap-northeast-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ap-northeast-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ap-south-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ap-southeast-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ap-southeast-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-ca-central-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-eu-central-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-eu-west-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-eu-west-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-sa-east-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-us-east-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-us-east-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-us-west-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-flower-dataprod-us-west-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ap-northeast-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ap-northeast-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ap-south-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ap-southeast-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ap-southeast-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-ca-central-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-eu-central-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-eu-west-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-eu-west-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-sa-east-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-us-east-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-us-east-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-us-west-1.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| data-airflow-webserver-dataprod-us-west-2.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| k8s-dashboard.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-ap-south-1.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-ap-southeast-2.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-eu-central-1.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-us-east-1.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-us-east-2.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-us-west-1.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-dashboard-dataprod-us-west-2.data-production.braintree-api.comadmin, tools | In scope | 2026-11-14 |
| k8s-oidc.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| k8s-oidc-dataprod-ap-southeast-2.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| k8s-oidc-dataprod-eu-central-1.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| k8s-oidc-dataprod-us-east-1.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| k8s-oidc-dataprod-us-east-2.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| k8s-oidc-dataprod-us-west-2.data-production.braintree-api.comauth, tools | In scope | 2026-11-14 |
| origin-data-airflow-flower-dataprod.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| origin-data-airflow-webserver-dataprod.data-production.braintree-api.comtools | In scope | 2026-11-14 |
| sentinel-dataprod.data-production.braintree-api.com | In scope | 2026-11-14 |
| sentinel-dataprod-us-east-2.data-production.braintree-api.com | In scope | 2026-11-14 |
| sentinel-dataprod-us-west-2.data-production.braintree-api.com | In scope | 2026-11-14 |
| airflow.data-staging.braintree-api.comstaging, tools | In scope | 2026-11-14 |
| data-airflow-webserver-datastag.data-staging.braintree-api.comstaging, tools | In scope | 2026-11-14 |
| data-airflow-webserver-datastag-ap-southeast-2.data-staging.braintree-api.comstaging, tools | In scope | 2026-11-14 |
| data-airflow-webserver-datastag-eu-central-1.data-staging.braintree-api.comstaging, tools | In scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.