Come and #hackallthethings at Grab

Summary

Grab has officially launched a public bug bounty program in partnership with HackerOne to strengthen the security of its platform. This rollout follows a private bounty initiative operated over the previous year, during which the organization worked with over 350 security researchers and resolved nearly 200 awarded bug reports. The new public program invites external researchers to scrutinize Grab's code for critical flaws, including remote code execution, SQL injections, and exportable cross-site scripting vulnerabilities. To support ethical and responsible disclosure, Grab offers payouts reaching up to $10,000 per valid vulnerability report based on severity and impact.

Context

Grab seeks to ensure that the data of millions of driving partners and consumers remains secure and to protect users through transparent, ethical security practices.

Approach / What changed

Grab launched an official public bug bounty program in partnership with HackerOne, offering monetary rewards for identified and responsibly disclosed vulnerabilities.

Takeaways

• Grab ran a private bug bounty program for one year, working with more than 350 researchers and awarding nearly 200 bug reports.
• The public bug bounty program invites researchers to identify high-impact issues including remote code execution, SQL injections, and exportable XSS vulnerabilities.
• Valid bug reports submitted through HackerOne are eligible for rewards of up to $10,000 depending on impact and severity.

Related reading

• Grab · Dec 16, 2020

  Reflecting on the Five Years of Bug Bounty at Grab

  Grab launched a private bug bounty programme on HackerOne before opening it publicly in 2017 to complement internal product security efforts. Prior to going public, the team conducted security sweeps, established policies, and expanded the testing scope to prepare for an influx of reports. Operationally, the team opted to pay full bounties immediately upon report triage rather than waiting for vulnerability resolution to incentivize security researchers. Noise reduction was handled using HackerOne Triage, Human-Augmented Signal, and by blocking automated scanning networks targeting Grab's infrastructure. In addition, rotating security engineers weekly and integrating HackerOne APIs with PagerDuty ensured fast initial response times.

  Ajay Srivastava

• Grab · Dec 19, 2023

  Championing CyberSecurity: Grab's bug bounty programme in 2023

  Grab reviewed the performance and milestones of its security bug bounty programme for 2023, marking eight years of running the initiative. Operating quarterly campaigns through HackerOne alongside dedicated internal teams, the company processed approximately 1,000 vulnerability submissions over the year, including 400 reports during Q1 alone. Cumulative payouts to external security researchers surpassed $700,000 since the programme's 2015 launch. To adapt to an expanding service portfolio, Grab broadened its scope to encompass joint ventures and acquisitions while introducing diversified financial and recognition-based rewards.

  Nathaniel Callens

• Grab · Dec 1, 2025

  A Decade of Defense: Celebrating Grab's 10th Year Bug Bounty Program

  Grab's bug bounty program has operated for a decade in partnership with HackerOne, expanding from an initial cohort of 23 researchers to over 850 active participants across global regions. The program's scope broadened between 2023 and 2024 to encompass artificial intelligence systems, Indonesian financial services, and a dedicated bounty table for mobile-specific security issues. Grab extended external testing coverage through live hacking appearances at ThreatCon 2023 and DEFCON 32, as well as invite-only anniversary campaigns with regional clubs in Germany, Morocco, and India. Internal cybersecurity teams manage vulnerability reports by emphasizing rapid triage times, direct communication, and payouts upon triage. Over the decade, reported vulnerabilities transitioned from foundational flaws toward more sophisticated and emerging threat categories.

  Pei Shan Yap

• Grab · Aug 1, 2026

  How AI is transforming analytics at Grab

  Grab is restructuring its analytics operations using a five-level AI autonomy ladder, transitioning analysts from manual artifact creation to problem framing and decision governance. The architecture leverages domain-specific systems like Spartan to process natural language queries through certified metric indexes and Scarlet to triage and repair failing data pipelines. To prevent agent hallucinations, ContextIQ manages context lifecycles by automatically updating metric definitions, SQL references, and golden-dataset test cases when instrumentation changes or failures occur. Furthermore, data teams use an internal portal called BriX to configure custom analytics surfaces and automated root-cause analysis commentaries using reusable Model Context Protocol connections. Autonomy scales mechanical query and validation tasks while keeping human oversight focused on canonical metric definitions and strategic sign-offs.

  Maanas Prabhakar