Bug bounty program
UC
Urban Company
Most upvoted reports6
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Critical full compromise of jarvis-new.urbanclap.com via weak session signingAnalysed#1380121 | Authentication | 2022-01-30 | $1,500 | 123 |
| Broken Link on Urban Company's Vulnerability Submission FormAnalysed#1239334 | Misconfiguration and Insecure Design | 2021-06-21 | – | 79 |
| Host header injection that bypassed protection and allowed accessing multiple subdomainsAnalysed#1783015 | Server-Side Request Forgery | 2022-12-21 | $500 | 33 |
| Private ip leaking through response#622937 | Information Disclosure | 2021-06-16 | – | 14 |
| Insufficient Session Expiration#1241483 | Authentication | 2021-06-23 | – | 4 |
| Exposed data of credit card details to hacker or attacker.#1245094 | Information Disclosure | 2021-06-28 | – | 4 |
Subdomains146
2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.