Ten things you need to know about Linktree’s public bug bounty

Ever wondered what it might be like to be an ethical security hacker for hire? Linktree’s bug bounty is your chance to find out.

In the perfect world, no internet service would have security bugs. In reality, there’s always more to discover and room for everyone to improve. We’ve launched our bug bounty program publicly to make sure that the incentive for actively reporting any vulnerabilities directly to our security team is stronger and more appealing than ever.

What’s a bug bounty, in a nutshell?

It’s a contemporary compliment to the traditional security testing we already have in place. This always-on crowdsourcing mechanism allows vulnerabilities to be reported to us, any time, by anyone (including you!). With a public bounty in place, we incentivize the public to pressure-test the security of our product with the unique expertise that only fresh eyes can bring. When they find us a new problem to fix, or risk to mitigate proactively, we recognize the work with payment!

What’s in it for Linktree?

With the help of our security partners HackerOne and BugCrowd, we’ve been running incredibly successful private and public bug bounty programs for over 2 years, fixing over a hundred security vulnerabilities before they could be identified or exploited. But, we believe in the power of all multi-talented creators (not just the few who have an invite). Whether you’re a musician or a full-time hacker, a small business owner or a security professional: you have the potential to help us make Linktree better every day. By opening the opportunity to everyone in the security community, we can give back to those who have embraced Linktree from day dot – and double down on the success we’ve had so far.

What are the rules?

You can read the bug bounty program rules in full on our BugCrowd page. Here’s a snapshot:

• Make sure that you provide detailed reports with reproducible steps. If your report isn’t detailed enough to reproduce the issue, it won’t be eligible for a bug bounty.
• Don’t access, impact, destroy or otherwise negatively impact Linktree customers, or customer data in any way.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own, or with the explicit permission of the account holder.
• Respect the privacy of our users at all times.
• No extortion, shake downs, or duress.
• Don’t leave any system in a more vulnerable state than you found it.
• Be respectful when interacting with our team.
• When duplicates occur, we only award the first report that was received (if it can be fully reproduced).

Find rules about reporting multiple, chain or grouped vulnerabilities, third party integrations, social engineering and more on BugCrowd.

How big are the rewards?

To date, we’ve paid security researchers and ethical hackers well over $150,000USD in total.

If we find your report to be valid, and you’re the first to report it, we’ll reward you for your time and effort in proportion to the severity of the issue you discover.

Severity/Reward
Critical: $7,500
High: $2,500
Medium: $600
Low: $200

How do you rate severity?

We use the Common Vulnerability Scoring System (CVSS) to rate severity. If there’s even a small chance that a feature can be abused to access confidential data, that’s critical. An example of a low severity issue might be an access control bypass issue in our link lock features pointing to public content.

Is it safe and confidential?

Bug bounties are quickly becoming the industry norm when it comes to investing in a responsible combination of measures to keep users safe. Crowdsourcing to the global community has proven benefits, which is why Google, Microsoft, Shopify, TikTok and Apple (to name a few) have similar bug bounty programs to ours in place.

To keep confidentiality airtight when you report a bug, follow BugCrowd’s code of conduct, disclosure terms and guidelines. We appreciate your help, and have set up this program to allow all parties to act in mutual good faith – as friends and allies – to keep our creators safe.

What’s in scope?

A number of places, including our website, web app, mobile app to our App Store and Google Play Store. Find the full list of what’s in scope, including exact domains and routes, on BugCrowd.

What’s not in scope?

When reporting vulnerabilities, you should consider the scenario, exploitability, and the security impact of the bug. Issues we deem to be out of scope for Linktree’s bug bounty program include, but are not limited to:

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with non-sensitive actions.
• Attacks requiring MITM or physical access to a user’s device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or brute-force issues on non-authentication endpoints.
• Missing HttpOnly or Secure flags on cookies.
• Vulnerabilities only affecting users of outdated or unpatched browsers (less than two stable versions behind the latest released stable version).
• Software version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing.
• Issues that require unlikely user interaction.
• Issues related to the validation of free/pro plan users.

Public zero-day vulnerabilities that have had an official patch for less than a month will be awarded on a case-by-case basis only.

This list is not exhaustive, so we encourage you to find and review the most detailed and up-to-date list on our bug bounty program page.

Will you credit me for my report?

Absolutely – you deserve recognition for helping us out. Once your issue is accepted, triaged and resolved or rewarded, your profile will appear on Linktree’s public hall of fame page alongside successful bug bounty reporters in our community.

How do I get involved?

All you need to do is share any issues you discover (plus, any techniques that may be used to exploit them) with us. Sign up for a free Linktree account, get familiar with what qualifies for the bounty in our rules and guidelines on BugCrowd, and start testing!