Public bug bountyLaunched Jan 2026 · Updated 2 months ago

Orbit Payments

Payments infrastructure & merchant dashboard · orbit.io

  • Accepting reports
  • Public
  • Managed triage
  • Safe harbour
Your access
Open to every researcher

Sign in with a researcher account to file a report.

Submit a report Read the rules of engagement first
Max bounty
$15,000
Avg. response
1.2 days
Reports resolved
204
Bounties paid
$483k
Researchers
63

Overview

Orbit Payments moves money for thousands of merchants, so anything touching authentication, authorization or settlement is treated as high impact. The public API and the merchant dashboard are both in scope.

Program terms

Type
Public
Rewards
Bounty · USD
Triage
Managed
Disclosure
Coordinated
Safe harbour
Offered
Status
Active

Response targets

First response
2 days
Triage decision
4 days
Resolution
30 days
Avg. first response
1.2 days

Scope

4 in · 4 out

In scope

In-scope assets
AssetTypeEnvironment
api.orbit.ioAPIProduction
dashboard.orbit.ioWebProduction
Webhook delivery serviceAPIProduction
Merchant onboarding flowWebProduction

Out of scope

Out-of-scope assets and activities
Asset or activityReason
docs.orbit.io—
Sandbox test cards & fixtures—
Denial-of-service / volumetric—
Rate-limit enumeration without impact—

Not rewarded

  • Denial of service / volumetric attacks
  • Self-XSS requiring victim-side paste
  • Missing security headers without demonstrated impact
  • Rate-limit or user enumeration without demonstrated impact
  • SPF / DKIM / DMARC configuration
  • Social engineering of staff or users
  • Best-practice reports with no security consequence

Rewards

USD · per valid finding
Rewards by severity
SeverityBounty
CriticalRCE, auth bypass, mass data exposure$15,000from $6,000
HighSSRF, stored XSS, privilege escalation$5,600from $2,200
MediumIDOR, CSRF on sensitive actions$1,400from $560
LowReflected XSS, minor info disclosure$290from $120
Final severity is set by Zerohunt triage.Ranges are per valid, in-scope finding.

Rules of engagement

5 rules

  1. Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.

  2. Use your own test accounts. Stop immediately if you encounter another user's data and report it.

  3. No denial-of-service, automated scanning at scale, or social engineering of staff or users.

  4. Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.

  5. Keep findings confidential until Orbit confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Orbit Payments agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Orbit Payments will not pursue legal action against good-faith research within these rules.

Safe harbour statement
Orbit will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 4
  • HighSSRF via webhook URL validatorResolved · $3,000
  • MediumIDOR on /invoices/:id/exportAccepted
  • CriticalSettlement amount tampering on refund APIResolved · $15,000
  • LowMerchant ID disclosed in error responseResolved · $280
Ready to report

Found something on Orbit Payments?

Submit a structured report with steps and evidence. Managed triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs