Capital One Launches Public Bug Bounty Program with HackerOne

Capital One announced the launch of a public bug bounty program on HackerOne, expanding its prior private program to invite external researchers to test core external-facing applications (e.g., *.capitalone.com, *.capitaloneshopping.com, browser extensions, and related mobile apps). The announcement outlines in-scope assets, explicitly lists out-of-scope testing (physical testing, social engineering, phishing, DoS, and third-party assets), and describes the triage, validation, and remediation workflow handled in partnership with HackerOne.