Pinterest bug bounty programs
pinterest.com Updated
Pinterest runs one public program: a Bugcrowd bug bounty paying up to $25,000.
- Top reward
- $25,000
- Bugcrowd
- Programs
- 1
- 1 pays cash
- Targets in scope
- 13
- 6 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Pinterest runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Pinterest
Bugcrowd · Bug bounty |
$25k | $8,000 | $3,000 | $500 | $25,000 | Full | – | – | Open |
-
- Critical
- $25k
- High
- $8,000
- Medium
- $3,000
- Low
- $500
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
13 targets.
-
*.pinterest.com web apps
Wildcards
-
https://www.shffls.com
Web
-
https://api.pinterest.com
APIs
-
https://play.google.com/store/apps/details?id=com.pinterest&hl=en_US&gl=US
Android
-
https://play.google.com/store/apps/details?id=com.pinterest.shuffles
Android
-
https://play.google.com/store/apps/details?id=com.pinterest.twa&hl=en_US&gl=US
Android
-
https://apps.apple.com/us/app/pinterest/id429047995
iOS
-
https://apps.apple.com/us/app/shuffles-by-pinterest/id1573869498
iOS
-
https://addons.mozilla.org/en-US/firefox/addon/pinterest/
Products and areas
-
https://apps.apple.com/us/app/save-to-pinterest/id6473649042
Products and areas
-
https://chrome.google.com/webstore/detail/pinterest-save-button/gpdjojdkbbmdfjfahjcgigfpmkopogic?hl=en
Products and areas
-
https://github.com/pinterest/
Products and areas
-
https://microsoftedge.microsoft.com/addons/detail/pinterest-save-button/bkgoflemacdadndiohhdnphcmdhacabg
Products and areas
No target matches. Try part of a host name, such as the company name.
Recent changes
Reward and scope changes across every Pinterest program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Pinterest products, from the NVD.
-
CVE-2024-28251 Medium
Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of query executions. Currently the CORS setting allows all origins, which could result in cross-site websocket
-
CVE-2024-27103 Medium
Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerabilit
-
CVE-2024-26148 Medium
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occ
-
CVE-2022-46151 Medium
Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are ad
About this page
This page gathers every public program listed under pinterest.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.