- Top reward
- $6,000
- Top severity paid
- Critical
- Assets in scope
- 50
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,000 from $500 |
| High |
|
$4,000 from $100 |
| Medium |
|
$600 from $50 |
| Low |
|
$200 from $10 |
Scope
50 assets you may test, 5 excluded.
Web 39
- api.geneva-staging.com Critical
- app.geneva-staging.chat Critical
- app.geneva-staging.com Critical
- badoocdn.com Critical
- badoo.com Critical
- bma.badoo.com Critical
- bma.bumble.com Critical
- ccardseu1.badoo.com Critical
- ccardsus1.badoo.com Critical
- chatdate.app Critical
- corp.badoo.com Critical
- deeplinks.geneva-staging.chat Critical
- deeplinks.geneva-staging.com Critical
- eu1.badoo.com Critical
- gateway.geneva-staging.chat Critical
- gateway.geneva-staging.com Critical
- geneva-staging.chat Critical
- go.geneva-staging.com Critical
- hotornot.com Critical
- links.geneva-staging.chat Critical
- links.geneva-staging.com Critical
- m.badoo.com Critical
- meu1.badoo.com Critical
- mus1.badoo.com Critical
- payments.geneva-staging.chat Critical
- payments.geneva-staging.com Critical
- presence.geneva-staging.chat Critical
- presence.geneva-staging.com Critical
- router.geneva-staging.com Critical
- social.geneva-staging.chat Critical
- social.geneva-staging.com Critical
- sockets.geneva-staging.chat Critical
- sockets.geneva-staging.com Critical
- translate.badoo.com Critical
- us1.badoo.com Critical
- web.geneva-staging.com Critical
- www.bumble.com Critical
- www.geneva-staging.chat Critical
- www.geneva-staging.com Critical
Android apps 6
- com.badoo.mobile Critical
- com.badoo.twa Critical
- com.bumble.app Critical
- com.bumblebff.app Critical
- com.genevachat.staging Critical
- com.hotornot.app Critical
iOS apps 5
- 351331194 Critical
- 403684733 Critical
- 6444040977 Critical
- 930441707 Critical
- https://testflight.apple.com/join/Y4cHu289 Critical
Out of scope (5)
- blog.bumble.com
- brand.bumble.com
- honey.bumble.com
- shop.bumble.com
- thebeehive.bumble.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Bumble (via HackerOne)'s policy.
While testing
-
Limit access to personal data strictly to what is necessary; All applicable data protection laws must be followed.
-
Use personal data only for investigation purposes
-
Securely delete any personal data after testing
-
Confirm deletion when submitting your report
-
Avoid duplicate submissions, copy-pasted reports, or reports without a working PoC.
Not accepted
-
Reports that do not demonstrate scalable access to information not otherwise obtainable via normal app use are typically closed as Informative or Not Applicable
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Bumble & Badoo Vulnerability Disclosure Program
We reward security researchers for reporting impactful vulnerabilities affecting Bumble, Badoo, BFF (including Geneva), and related products.
Vulnerabilities are ranked based on real-world impact. Final severity and rewards are determined by the Bumble security team. We do not rely on rigid scoring systems—the more damage a vulnerability can realistically cause, the higher its severity.
We value high-quality, well-researched reports with clear proof of impact. Avoid duplicate submissions, copy-pasted reports, or reports without a working PoC. Respecting each other’s time helps us respond faster and reward impactful findings.
High-interest assets
- Bumble mobile application (iOS & Android)
- Bumble For Friends (BFF) mobile application (iOS & Android)
- bumble.com (including mobile web)
- www.bumble.com
- bma.bumble.com
For the full scope, please refer to the assets list.
Note: Geneva Web is a limited interface. Most impactful findings are in the mobile applications. If you cant access the staging applications listed in the programme due capacity being reached, please submit an informational ticket to the program asking for access to the latest APK.
Geneva staging credentials (OTP 000000 for both):
- Member:
+1 880 999 0001 - Owner:
+1 880 999 0009
Out-of-scope / non-qualifying reports
Information disclosure & inference issues When reporting inferred information (e.g. “Has this specific user liked me?”), consider:
- Scalability
- Can the technique be automated at scale?
- Does it rely on predictable identifiers?
- If it only works in isolated or manual cases, it is unlikely to qualify
- Equivalent in-app behaviour
- Could the same information be obtained through intended app functionality (e.g. swiping and matching)?
- If yes, the report likely duplicates expected behaviour rather than exposing sensitive data
Reports that do not demonstrate scalable access to information not otherwise obtainable via normal app use are typically closed as Informative or Not Applicable
How severity is assessed (examples)
These examples hopefully clarify some of the thinking when assigning risk.
| Severity | Example impact |
|---|---|
| Low | HTML injection or XSS that only affects page output with no meaningful user impact |
| Low | Cosmetic UI manipulation without data access or state change |
| Medium | SQL injection or logic flaw that alters application behaviour but does not expose user data |
| Medium | Limited unauthorised actions affecting a single account without escalation |
| High | Unauthorised access to sensitive user data |
| High | Modification of sensitive profile or account data |
| Critical | Account takeover |
| Critical | Scalable abuse impacting multiple users or systems |
Personal data handling
Limit access to personal data strictly to what is necessary; All applicable data protection laws must be followed.
- Use personal data only for investigation purposes
- Securely delete any personal data after testing
- Confirm deletion when submitting your report
Public disclosure
Public disclosure is generally not permitted; Exceptions may be granted on a case-by-case basis—please ask before publishing