Tinder
Tinder · HackerOne · added Sep 28, 2015
Tinder Bug Bounty Program Terms ==== Security is a top priority at Tinder. If you believe you've found a security bug in our in-scope applications or infrastruc…
Metrics
Beginner fit
54/100
Estimated: this program accepts low-severity findings worth reporting.
Activity metrics for this program aren't exposed by the platform API, so the scores above are conservative estimates. Always verify on the program page before submitting.
Engage
Open on HackerOneAlways read the full policy on the platform before submitting. Scope below is a summary only.
In-scope assets
- *.tinder.com
- *.gotinder.com
- 547702041
- com.tinder
- *.tinderops.net
- *.tstaging.com
- *.tstaging.tools
- *.tinderwebstaging.com
Fetched live from the HackerOne API.
Wanted categories
Who should hunt here
Beginners
A stretch- 1 asset in scope gives you room to explore without fighting a crowd for the same endpoints.
- Fast feedback — triage lands in ~3 days, so you learn what this team pays for quickly.
Intermediate
Workable- APIs are in scope — where medium hunters get paid: broken object-level authorization, mass assignment, and rate-limit gaps.
Pros
Efficient filler- Modest for a pro — but low crowding makes it a reliable filler between bigger programs.
Think twice if
- Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
- No bounty range is published by the HackerOne API — confirm actual payouts on the program page before investing time.
- HackerOne doesn't publish report volume — the competition and fit scores here are conservative estimates, not measurements.
- Narrow scope (1 asset) — limited room if you're looking for breadth.
Where these numbers come from
Live from HackerOne
- Program status, policy text & start date — live HackerOne API
- Full in-scope asset list — fetched live from the structured-scopes endpoint
Modeled estimates
- Bounty range — the HackerOne API doesn't publish it (shown as —)
- Report volume & hunter count — not exposed; competition is scored from neutral defaults
- Triage speed — modeled from the program's triage-activity flag
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
hackerone.com