WeTransfer bug bounty programs
wetransfer.com Updated
WeTransfer runs one public program: a self-hosted bug bounty.
- Top reward
- Not published
- Programs
- 1
- 1 pays cash
- Targets in scope
- 5
- 3 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program WeTransfer runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
WeTransfer
Self-hosted · Bug bounty |
Not published | Full | – | 5 days promised | Open |
-
- Safe harbor
- Full
- First response
- 5 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
5 targets. 16 excluded.
-
wetransfer.com
Domains
-
The Portals web application
Web
-
The wetransfer.com web application
Web
-
WePresent
Web
-
The iOS and Android WeTransfer applications
iOS
No target matches. Try part of a host name, such as the company name.
Out of scope 16
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Ability to upload or download malicious files via wetransfer.com
-
Authentication (or lack thereof) on free transfers
-
Collect , both the web and mobile applications
-
Distributed Denial of Service attacks (DDoS)
-
Integrations and extensions created by third-party developers using our public API
-
Missing security headers or 'best practices' (except if you are able to demonstrate a vulnerability that makes use of their absence)
-
Non-production environments across our product line
-
Paper
-
Paste , both the web and mobile applications
-
Policies as opposed to implementations - email verification, password length, or reuse, etc.
-
Social engineering attacks
-
Spam (unless a specific vulnerability leads to easily sending spam)
-
Third party applications we make use of, but do not control. (e.g., a blog hosted on an external service - unless we've configured the blog in such a way as to make our in-scope areas vulnerable)
-
Users hosting malware on our service (contact support for this)
-
Vulnerabilities in our open source software (unless you have a proof of concept of how the specific vulnerability can be used on wetransfer.com or related apps).
-
Vulnerabilities that require access to an already compromised account (unless access to an account exposes other accounts)
Recent changes
Reward and scope changes across every WeTransfer program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under wetransfer.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.