Work at Nubank Brasil Managed Bug Bounty Program? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.
We are one of the world’s largest digital banking platforms, serving more than 100 million customers across Brazil, Mexico, and Colombia. Nubank Brasil leverages proprietary technologies and innovative business practices to create new financial solutions and experiences for individuals and SMEs that are simple, intuitive, convenient, low-cost, empowering, and human. No technology is perfect, and Nubank Brasil believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our targets. You can feel free to start testing Nubank and reporting your bugs both using our apps, and our wildcards. Good luck, and happy hunting! Response Targets Nubank's Security Team will make the best effort to meet the following SLAs for hackers participating in our program: First Response: 2 days Time to Triage: 2 days Time to Resolution: depends on severity and complexity We’ll try to keep you informed about our progress throughout the process.
Scope
13 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.nu.com.co | other | ✓ bounty | not set |
| *.nu.com.mx | other | ✓ bounty | not set |
| *.nubank.com.br | other | ✓ bounty | not set |
| *.nuinvest.com.br | website | ✓ bounty | not set |
| Nubank Android: Play Store | android | ✓ bounty | not set |
Show all 13 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Nubank iOS App | ios | ✓ bounty | not set |
| prod-*.nu.com.co | api | ✓ bounty | not set |
| prod-*.nu.com.mx | api | ✓ bounty | not set |
| prod-*.nubank.com.br | api | ✓ bounty | not set |
| *.nat-a.nubank.com.br | other | out | not set |
| *.nuinternational.com | website | out | not set |
| international.nubank.com.br | website | out | not set |
| NuCommunity endpoints (BR, MX, CO) | website | out | not set |