Indeed bug bounty programs
indeed.com Updated
Indeed runs one public program: a Bugcrowd bug bounty paying up to $10,000. It also owns workopolis.com, which runs one more program.
- Top reward
- $10,000
- Bugcrowd
- Programs
- 2
- 1 pays cash
- Targets in scope
- 19
- 7 types, deduplicated
- Last change
- 12 Nov 2026
- 4 hours ago
Where to report
The one public program Indeed runs itself.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Indeed
Bugcrowd · Bug bounty |
$10k | $4,000 | $1,000 | $200 | $10,000 | Full | – | – | Open |
-
- Critical
- $10k
- High
- $4,000
- Medium
- $1,000
- Low
- $200
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Indeed owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
19 targets across all 2 programs, each listed once with the programs that cover it.
-
https://chromewebstore.google.com/detail/indeed-recruiter-extensio/kiodpphbmnmcmnfgpnmkkhmkllnlflef
Web
Covered by Bugcrowd
-
https://play.google.com/store/apps/details?id=com.indeed.android.jobsearch
Android
Covered by Bugcrowd
-
https://apps.apple.com/us/app/%E5%B1%A5%E6%AD%B4%E6%9B%B8%E4%BD%9C%E6%88%90-%E3%82%A4%E3%83%B3%E3%83%87%E3%82%A3%E3%83%BC%E3%83%89/id1484451230
iOS
Covered by Bugcrowd
-
Any host/web property/mobile app verified to be owned by Indeed
Products and areas
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Recent changes
Reward and scope changes across every Indeed program, newest first.
-
Scope + security.txt
Added to scope: hiringlab.org
Recent CVEs
Published vulnerabilities in Indeed products, from the NVD.
-
CVE-2020-36634 Low
A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The
About this page
This page gathers every public program listed under indeed.com and the companies Indeed owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Indeed.
Something wrong or missing? Report a correction.