Program Removed
This program is no longer available on HackerOne. The scope data shown below is historical and may not reflect the final state of the program.
mpesa
12
In Scope
6
Out of Scope
In-Scope Assets (12)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| 1442121355 | IOS | Yes | - | |
| 1502222766 | IOS | Yes | - | |
| com.vodafone.mpesa.drc | ANDROID | Yes | ||
| com.vodafone.mpesa.ls | ANDROID | Yes | ||
| com.vodafone.mpesa.mozambique | ANDROID | Yes | ||
| m-pesa.africa | URL | Yes | ||
| m-pesa.com | WILDCARD | Yes | ||
| mpa.ekyc.backoffice.m-pesa.com | URL | Yes | ||
| mpa.ekyc.selfregister.m-pesa.com | URL | Yes | ||
| mpa.qr.web.m-pesa.com | URL | Yes | ||
| openapi.m-pesa.com | URL | Yes | ||
| openapiportal.m-pesa.com | URL | Yes |
Out-of-Scope Assets (6)
| Asset | Category | Bounty | |
|---|---|---|---|
| business.m-pesa.com | URL | No | |
| com.vodacom.mpesa.ls.business | ANDROID | No | |
| mz.m-pesa.com | URL | No | |
| ra.ls.m-pesa.com | URL | No | |
| sso.m-pesa.vm.co.mz | URL | No | |
| sso.pr.m-pesa.vm.co.mz | URL | No |
Scope Changes (49)
Jul 17, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Program Removed | — | — | — | 16:41 |
Feb 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | mpa.ekyc.backoffice.m-pesa.com | URL | In Scope | 19:16 |
| Added | openapiportal.m-pesa.com | URL | In Scope | 19:16 |
| Added | com.vodafone.mpesa.ls | ANDROID | In Scope | 19:16 |
| Added | com.vodafone.mpesa.mozambique | ANDROID | In Scope | 19:16 |
| Added | 1442121355 | IOS | In Scope | 19:16 |
| Added | com.vodacom.mpesa.ls.business | ANDROID | Out of Scope | 19:16 |
| Added | mz.m-pesa.com | URL | Out of Scope | 19:16 |
| Added | mpa.qr.web.m-pesa.com | URL | In Scope | 19:16 |
| Added | *.m-pesa.com | WILDCARD | In Scope | 19:16 |
| Added | openapi.m-pesa.com | URL | In Scope | 19:16 |
| Added | com.vodafone.mpesa.drc | ANDROID | In Scope | 19:16 |
| Added | sso.m-pesa.vm.co.mz | URL | Out of Scope | 19:16 |
| Added | sso.pr.m-pesa.vm.co.mz | URL | Out of Scope | 19:16 |
| Added | business.m-pesa.com | URL | Out of Scope | 19:16 |
| Added | mpa.ekyc.selfregister.m-pesa.com | URL | In Scope | 19:16 |
| Added | 1502222766 | IOS | In Scope | 19:16 |
| Added | m-pesa.africa | URL | In Scope | 19:16 |
| Added | ra.ls.m-pesa.com | URL | Out of Scope | 19:16 |
Feb 22, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | mpa.ekyc.selfregister.m-pesa.com | URL | In Scope | 00:45 |
| Added | com.vodafone.mpesa.mozambique | ANDROID | In Scope | 00:45 |
| Added | 1502222766 | IOS | In Scope | 00:45 |
| Added | *.m-pesa.com | WILDCARD | In Scope | 00:45 |
| Added | sso.pr.m-pesa.vm.co.mz | URL | Out of Scope | 00:45 |
| Added | business.m-pesa.com | URL | Out of Scope | 00:45 |
| Added | mz.m-pesa.com | URL | Out of Scope | 00:45 |
| Added | mpa.qr.web.m-pesa.com | URL | In Scope | 00:45 |
| Added | sso.m-pesa.vm.co.mz | URL | Out of Scope | 00:45 |
| Added | com.vodacom.mpesa.ls.business | ANDROID | Out of Scope | 00:45 |
| Added | mpa.ekyc.backoffice.m-pesa.com | URL | In Scope | 00:45 |
| Added | openapiportal.m-pesa.com | URL | In Scope | 00:45 |
| Added | openapi.m-pesa.com | URL | In Scope | 00:45 |
| Added | com.vodafone.mpesa.ls | ANDROID | In Scope | 00:45 |
| Added | com.vodafone.mpesa.drc | ANDROID | In Scope | 00:45 |
| Added | 1442121355 | IOS | In Scope | 00:45 |
| Added | m-pesa.africa | URL | In Scope | 00:45 |
| Added | ra.ls.m-pesa.com | URL | Out of Scope | 00:45 |
Feb 21, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Removed | mpa.qr.web.m-pesa.com | OTHER | In Scope | 21:38 |
| Removed | mpa.ekyc.backoffice.m-pesa.com | URL | In Scope | 21:38 |
| Removed | mpa.ekyc.selfregister.m-pesa.com | URL | In Scope | 21:38 |
| Removed | openapiportal.m-pesa.com | URL | In Scope | 21:38 |
| Removed | openapi.m-pesa.com | URL | In Scope | 21:38 |
| Removed | com.vodafone.mpesa.ls | ANDROID | In Scope | 21:38 |
| Removed | com.vodafone.mpesa.mozambique | ANDROID | In Scope | 21:38 |
| Removed | com.vodafone.mpesa.drc | ANDROID | In Scope | 21:38 |
| Removed | 1442121355 | IOS | In Scope | 21:38 |
| Removed | 1502222766 | IOS | In Scope | 21:38 |
| Removed | *.m-pesa.com | WILDCARD | In Scope | 21:38 |
| Removed | m-pesa.africa | URL | In Scope | 21:38 |