Report a vulnerability

Wells Fargo's Bug Bounty Program is hosted on the HackerOne platform. Visit our Wells Fargo BBP page to review program guidelines and scope, and to submit your vulnerability report. Your report must meet all of HackerOne’s vulnerability disclosure guidelines.

When creating your report:

• Describe both the attack scenario/exploitability and the potential impact.
• Submit one vulnerability per report unless chaining is required to show impact.
• Provide clear, reproducible steps so we can validate the finding.
• Ensure your research complies with all applicable laws.

Note: Wells Fargo may update or discontinue this program at any time.

• Not being located in, or a resident of, any country subject to U.S. sanctions or restricted party designations.
• Allowing your information to be stored and transferred to the United States and acknowledge that you have read and accepted both the program guidelines and HackerOne’s vulnerability disclosure guidelines.
• Keeping all vulnerability details confidential and not sharing them without Wells Fargo’s prior written approval.
• Recognizing that any Wells Fargo information you encounter is the property of Wells Fargo or its customers, clients, or third-party providers, and that you hold no ownership rights to such information.
• Conducting research solely for testing and research purposes, accessing only accounts you own, and not attempting to access customer or confidential information.
• Understanding that submitting a report does not grant any license or rights to Wells Fargo or third-party intellectual property.