Welcome to the Monzo public bug bounty program! 🚀 At Monzo we aim to create a banking service that makes our customers financial lives better and easier. Our mantra is “make money work for everyone” and we mean it! 👍 We have created several apps to provide intuitive, helpful, and enjoyable experiences across our range of products 💖. We won’t sacrifice security though! So if you find a security bug in one of our apps or services, this is the place to report it! Happy hunting!
🧑🏫 Discussing and disclosing vulnerabilities
We know that some researchers who find really interesting bugs would like to discuss them or share them with others, like:
We kindly ask that you don't discuss or disclose the details of bugs you have reported to us though without our consent. We need time to fix the bugs! 🧑🔧
Once the bug is fixed and confirmed to no longer be vulnerable, we're happy to collaborate on safely presenting discoveries to the wider security community 🤝.
Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.
| Vulnerability Severity | Time to validate |
|---|---|
| Exceptional | 15 Working days |
| Critical | 15 Working days |
| High | 17 Working days |
| Medium | 20 Working days |
| Low | 20 Working days |
This remains at the discretion of Monzo Bank to award.
Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Monzo Bank to award.
The crux of Monzo where the APIs live as well as Monzo Business and the main web site
Houses the services for the pay me / request payment feature
Where our internet-facing services are accessed
This program follows Intigriti's contextual CVSS standard
No credentials will be provided in this public program. Please use your own credentials but note that no refunds will be issued for transactions during testing of the Monzo assets
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
