Block bug bounty programs
block.xyz Updated
Block and the companies it owns run 4 public programs on Bugcrowd; 4 pay cash, the most up to $18,000 (Square).
- Top reward
- $18,000
- Square, Bugcrowd
- Programs
- 4
- 4 pay cash
- Targets in scope
- 21
- 5 types, deduplicated
- Last change
- 1 Oct 2026
- 1 month ago
Where to report
4 programs Block runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Square
Bugcrowd · The company-wide program. Pays up to $18,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Square
Square · Bugcrowd · Bug bounty |
$18k (highest) | $5,000 (highest) | $1,000 (highest) | – | $18,000 | Full | – | – | Open |
Cash App
Cash App · Bugcrowd · Bug bounty |
$18k | $5,000 | $500 | $200 (highest) | $18,000 | Full | – | – | Open |
TIDAL
TIDAL · Bugcrowd · Bug bounty |
$5,000 | $1,500 | $500 | $200 | $5,000 | Full | – | – | Open |
Afterpay Bug Bounty Program
Afterpay · Bugcrowd · Bug bounty |
$5,000 | $1,500 | $500 | $200 | $5,000 | Full | – | – | Open |
-
- Critical
- $18k (highest)
- High
- $5,000 (highest)
- Medium
- $1,000 (highest)
- Low
- –
- Safe harbor
- Full
-
- Critical
- $18k
- High
- $5,000
- Medium
- $500
- Low
- $200 (highest)
- Safe harbor
- Full
-
- Critical
- $5,000
- High
- $1,500
- Medium
- $500
- Low
- $200
- Safe harbor
- Full
-
- Critical
- $5,000
- High
- $1,500
- Medium
- $500
- Low
- $200
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Block owns
4 companies with 4 programs of their own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
21 targets across all 4 programs, each listed once with the programs that cover it. 11 excluded.
-
████████████████████████████████████████████████████████████████████████
Products and areas
Covered by TIDAL
No target matches. Try part of a host name, such as the company name.
Out of scope 11
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
█████████
Square
-
███████████
Square
-
██████████████
Square
-
███████████████████
TIDAL Afterpay Bug Bounty Program
-
████████████████████
Square Afterpay Bug Bounty Program
-
███████████████████████
Afterpay Bug Bounty Program Square
-
█████████████████████████████████████████████████
Square
-
███████████████████████████████████████
Square
-
███████████████████████████████████
Square
-
███████████████
TIDAL
-
█████████████████████████████████████████████████████████
Square
Recent changes
Reward and scope changes across every Block program, newest first.
-
Paused Bugcrowd
Paused. Not accepting reports right now.
-
Paused Bugcrowd
Paused. Not accepting reports right now.
-
Paused Bugcrowd
Paused. Not accepting reports right now.
-
Paused Bugcrowd
Paused. Not accepting reports right now.
-
Back Bugcrowd
Open for reports again.
-
Back Bugcrowd
Open for reports again.
-
Back Bugcrowd
Open for reports again.
-
Back Bugcrowd
Open for reports again.
Recent CVEs
Published vulnerabilities in Block products, from the NVD.
-
CVE-2026-45799 High
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and m
-
CVE-2023-0833 Medium
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.
-
CVE-2023-3782 Medium
DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response
-
CVE-2023-3635 Medium
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
-
CVE-2022-29416 Medium
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.
-
CVE-2020-36645 Medium
A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
-
CVE-2021-23331 Medium
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaro
-
CVE-2018-20200 Medium
CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967
About this page
This page gathers every public program listed under block.xyz and the companies Block owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Block.
Something wrong or missing? Report a correction.