iFood: Bug Bounty Program
By iFood Bug bounty on Bugcrowd ifood.com.br
- Top reward
- $3,750
- Top severity paid
- Critical
- Assets in scope
- 20
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $3,750
- for critical bugs, from $150.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,750 from $2,100 |
| High |
|
$1,875 from $1,000 |
| Medium |
|
$900 from $450 |
| Low |
|
$400 from $150 |
- Safe harbor
-
Full
we will not initiate or support legal action against you for accidental, good faith violations of this policy
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $3,750
Scope
20 assets you may test, 9 excluded.
Web 16
- https://contadigital.ifoodpago.com.br
- https://dash.zoop.com.br
- https://developer.ifood.com.br
- https://gestordepedidos.ifood.com.br
- https://marketplace.ifood.com.br
- https://*.movilepay.com
- https://*.movilepay.com.br
- https://play.google.com/store/apps/details?id=br.com.movilepay.banking.application&hl=pt_BR
- https://portal.ifoodpago.com.br
- https://shop.ifood.com.br
- https://static-images.ifood.com.br
- https://wsloja.ifood.com.br
- https://www.ifood.com.br
- https://www.minhaconta.zoop.com.br
- https://www.zoop.com.br
- https://www.zoop.ws
APIs 2
- https://api.fstr.rocks
- https://rc.fstr.rocks
Android apps 1
- https://play.google.com/store/apps/details?id=br.com.brainweb.ifood&hl=pt_BR
iOS apps 1
- https://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239
Out of scope (9)
- Gestor de Pedidos - Desktop Client
- blog-empresas.ifood.com.br
- blog-parceiros.ifood.com.br
- *.allin.movilepay.com
- *.ecomanda.app
- *.ecomanda.com.br
- *.openfinance.ifood.com.br
- *.openfinance.ifoodpago.com.br
- *.starsoft.movilepay.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from iFood: Bug Bounty Program (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not disclose vulnerabilities to the public or to any third party.
-
Do not perform any testing that causes degradation to iFood's services; e.g., denial of service, or heavily automated scanning.
-
Do not access or make changes to customer accounts.
-
Do not perform social engineering attacks, including phishing.
-
Do not spam.
-
Do not perform any physical attacks.
-
Any lateral movement and post-exploitation past the initial exploitation are forbidden.
-
please sign up for an account using your @bugcrowdninja.com email address
Not accepted
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Any activity that could lead to the disruption of our service (DoS).
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Rate limiting or brute force issues on non-authentication endpoints
-
Missing best practices in Content Security Policy.
-
Missing HttpOnly or Secure flags on cookies
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers
-
Open redirect - unless an additional security impact can be demonstrated
-
Issues that require unlikely user interaction
-
Data or credential leaks from sources that do not originate from a vulnerability in our in-scope products
-
Subdomain-takeovers (temporarily)
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 28 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://play.google.com/store/apps/details?id=br.com.movilepay.banking.application&hl=pt_BR
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Hey, you! Wanna be part of our cyber food program? So pay attention to how you can deliver vulnerabilities to us! Let the Hunger Games begin! Thanks for your interest in the iFood bug bounty program! We're happy you're here. Our goal is to set a benchmark for security and we see that ongoing process as a team effort. External security evaluations are an important part of the process and make iFood a better, safer environment. We need researchers who can think creatively and work outside the box to find security bugs. We are committed to working with you to verify, reproduce and respond to legitimate reported vulnerabilities covered by this page. If you have something that you feel is close to exploitation, or if you'd like some information regarding the internals of our systems, or generally have any questions regarding the app that would help in your efforts, please create a submission and ask for that information. iFood will also accept flaw-hypothesis submissions, without penalty, and will work with you to develop a reasonable hypothesis into a working exploit, should one be possible. This program is exclusively limited to app and web applications listed in this document. Please, take note of the current scope outlined below. Ratings/Rewards: There's no need to reinvent the wheel. The iFood program will use what's best on the market and we hope to improve it over time! For now, we are using the Bugcrowd Vulnerability Rating Taxonomy . However, it's important to note: Sometimes, our analysis team can modify a vulnerability priority due to its likelihood or impact. But fear not, you'll be notified and a detailed explanation will be provided - along with the opportunity to appeal and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of iFood not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to iFood, you can report it. However, be aware that it may be ineligible for rewards or points-based compensation. Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . You may register for accounts here: https://www.ifood.com.br/entrar Geografic Limitations We are a Brazilian company and we do some blocking for other countries. If you are not in our country, we suggest that you use a proxy with Brazilian geolocation so that your test is not limited and you have a better experience. Focus Areas: iFood is very interested in vulnerabilities or business logic flaws around user information leakage. iFood is interested in potential vulnerabilities or business logic flaws around their checkout endpoints. iFood is interested in vulnerabilities with financial damage or frauds. What not to do Do not disclose vulnerabilities to the public or to any third party. Do not perform any testing that causes degradation to iFood's services; e.g., denial of service, or heavily automated scanning. Do not access or make changes to customer accounts. Do not perform social engineering attacks, including phishing. Do not spam. Do not perform any physical attacks. Any lateral movement and post-exploitation past the initial exploitation are forbidden. Out-of-Scope Clickjacking on pages with no sensitive actions Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Missing best practices in SSL/TLS configuration. Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Rate limiting or brute force issues on non-authentication endpoints Missing best practices in Content Security Policy. Missing HttpOnly or Secure flags on cookies Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version] Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors). Open redirect - unless an additional security impact can be demonstrated Issues that require unlikely user interaction 3rd party services such as analytics and logs are out of the scope (i.e., all hostnames not listed on the program scope list) Data or credential leaks from sources that do not originate from a vulnerability in our in-scope products, e.g. scrapped credentials Subdomain-takeovers (temporarily) Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.
iFood - Core Assets (in scope)
Target Information: iFood is a leading food delivery platform in Latin America, offering a seamless experience for users to order meals from a wide range of restaurants via its app or website. Beyond food delivery, iFood has expanded into financial services with iFood Pago, providing solutions for partner restaurants and couriers. The targets for the engagement covers the breadth of the https://ifood.com.br web applications. Some domains are excluded and listed as out of scope due to them being developer environments or managed by third party services. Instructions: When entering https://www.ifood.com.br , iFood Customer iOS Application, iFood Customer Android Application. Enter " Travessa Bujari (Bujari - State of Acre, Brazil) " as your current address with any number. You should be able to see 2 restaurants: Orders on these restaurants won't be charged or concluded but it's a good way to test our flow. The front end of the web applications are primarily JavaScript based, with either Node.js or React. The backend of the applications are primarily written in Java, with some Spring framework included as well as some Golang. The Android applications are completely written in Kotlin and the iOS are written in Swift. iFood consumer app for Android: https://play.google.com/store/apps/details?id=br.com.brainweb.ifood&hl=pt_BR iFood consumer app for iOS: https://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239