Silver Gold Bull is an online retailer for precious metals — real money, real orders, real customer data — and it runs a direct bug bounty paying $50 to $3,500 via PayPal. E-commerce programs are underrated: checkout flows are state machines full of logic seams, and few hunters bother with retailers that aren’t on the big platforms.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $50 – $3,500 |
| Payment method | PayPal |
| Policy | silvergoldbull.com/bug-bounty |
| Submission | Email: bugbounty@silvergoldbull.com |
| Type | Direct company program |
The policy page covers scope and rules. E-commerce sites typically run a stack of third-party services (payments, analytics, support chat) — the policy tells you which of those are in scope, and the answer is usually “fewer than you’d hope.”
Attack Surface: Where a Retail Site Breaks
An online store for high-value goods is essentially a catalog, a cart, a checkout, and an account system. Each one has known, testable failure modes:
- Pricing and order logic. The classic e-commerce bug class: price manipulation via parameter tampering, quantity edge cases (negative, zero, float), currency rounding, and coupon stacking. Report these as logic demonstrations — never actually place a manipulated real order. Most policies want proof-of-concept via request interception, not a shipped product.
- Checkout and payment flow. Look for state confusion between cart, payment, and confirmation steps: can an order be confirmed while payment is pending-failed? Can order totals be altered between steps? Test with the sandbox or minimal test orders the policy permits.
- Account system. Registration, login, password reset, and address book handling. Password reset token weakness and pre-auth account enumeration are reliable mid-tier finds on retail sites.
- Order data access control. Can account A view account B’s order history or shipping address by changing an order ID? IDOR on order objects is the single most common high-severity bug in retail web apps.
- Search, filters, and catalog. Reflected XSS in search parameters and injection-adjacent bugs in product filtering. Lower severity, but these pay the $50–$200 rungs and teach you the site’s architecture.
Beginner Mistakes to Avoid
1. Actually completing a manipulated purchase. This is the cardinal sin of e-commerce testing. Demonstrate that the price tampering works at the request level, then stop. Placing the order — even intending to refund — makes you a fraudster with a writeup.
2. Testing the payment processor. Declined-card testing, probing Stripe/PayPal endpoints, or anything touching the payment gateway itself is out of scope on virtually every retail program. The merchant’s integration is in scope; the processor is not.
3. Hammering a live store with scanners. Retail sites run fraud detection tuned for bot traffic. Automated scanning will get you blocked before it finds anything, and blocks tend to be permanent. Manual, targeted requests only.
4. Ignoring that payouts are via PayPal. Rewards here flow through PayPal rather than a platform wallet. Make sure you can receive payments through the method described in the policy before you report — and note the policy may impose tax/region conditions.
5. Reporting third-party cookie banners and marketing pixels. Out-of-scope third-party assets generate the most universally despised class of first report. Check the scope list against every asset before you test it.
Why Retail Direct Programs Are Worth a Weekend
$3,500 ceiling, PayPal payouts, and a customer base of bug bounty writeups instead of fellow hunters. Retail sites receive constant fraud attempts but almost no coordinated vulnerability research, so authorization bugs sit unfound for years. If your testing playbook includes IDOR, business logic, and checkout analysis, this target class converts those skills into payouts with minimal competition.
Next Step
Silver Gold Bull is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, contacts, and policy links in CSV/JSON. Sort by payout, pick your lane, start hunting.