Credit Karma

Dear Hackers,

We are excited to announce that our bug bounty programs in the US, Canada, and the UK are merging under one public program. We are grateful for the contributions and commitment from our researchers to help us potentially identify and address security vulnerabilities in our systems.

Our goal in merging these programs is to create a unified platform that will enable us to tap into a larger pool of talent and to provide a more efficient and streamlined process for our researchers. With the merger of these programs, we believe we can strengthen our security posture and better protect our customers.
The new program will provide more opportunities for researchers to test our systems and applications, as well as offer a more comprehensive scope that covers a wide range of vulnerabilities. We will continue to offer competitive payouts and recognition for researchers who submit valid bugs and vulnerabilities.
As part of this transition, we will be providing updated guidelines and procedures for our researchers, including a new scope document. We encourage all researchers to review the scope document carefully, as it outlines the systems and applications that are in scope for this program. This will ensure that researchers are testing the right systems and applications, and that their efforts are not wasted on out-of-scope targets.

We strongly advise that all researchers review and follow the guidelines and procedures outlined in the new program. They are intended to ensure the safety of our systems and applications and to help us respond more quickly to reported vulnerabilities.
We are committed to maintaining open and transparent communication with our researchers throughout this process. If you have any questions or concerns about the new program or scope document, please do not hesitate to contact us.

Thank you for your contributions to our previous programs, and we look forward to continuing our partnership with you in this new, unified program.

Best regards,

Credit Karma Team