Viator

Viator · Bugcrowd · launch date not exposed by platform

High competitionWeb

Live public bug bounty program on Bugcrowd with partial safe harbor. Max payout $4,500.

Metrics

Bounty range$0 – $4.5k

Paid this month$0

Reports0/mo

Hunters0

Beginner fit

74/100

Estimated: this program accepts low-severity findings worth reporting.

Time to triage3d

Time to first bounty21d

Activity metrics for this program aren't exposed by the platform API, so the scores above are conservative estimates. Always verify on the program page before submitting.

Engage

Open on Bugcrowd

Always read the full policy on the platform before submitting. Scope below is a summary only.

Scope assets11

Bounty floor$0

In-scope assets

https://apps.apple.com/us/app/viator-tours-activities/id434832826
https://play.google.com/store/apps/details?id=com.viator.mobile.android&hl=en_US&gl=US
https://supplier.viator.com/
https://partners.viator.com
https://travelagents.viator.com
https://help.supplier.viator.com/en
https://kiwi.partner.viator.com
https://*.viatorinc.com
https://selector.viator.com
https://partnerhelp.viator.com/
https://*.viator.com

Wanted categories

General

Tech stack

Android

Detected from the program's own description and scope assets — always confirm on the program page before relying on it.

Who should hunt here

Beginners

Workable

11 assets in scope gives you room to explore without fighting a crowd for the same endpoints.
Wide attack surface — 11 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
Fast feedback — triage lands in ~3 days, so you learn what this team pays for quickly.

Intermediate

Good target

Real ceilings — payouts reach $4.5k, so chaining two medium findings into one report actually pays.

Pros

High value

11 assets scale well with automation — attack-surface monitoring and diffing pay off at this size.

Think twice if

Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
Bugcrowd doesn't publish report volume — the competition and fit scores here are conservative estimates, not measurements.
Program age is unknown — Bugcrowd doesn't expose start dates, so "freshness" can't be verified.