- Top reward
- $20,000
- Top severity paid
- Critical
- Assets in scope
- 10
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $20,000
- for critical bugs.
- Report through their form
- hackerone.com/instacart
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$20,000 from $3,000 |
| High |
|
$3,000 from $1,000 |
| Medium |
|
$1,000 from $150 |
| Low |
|
$150 from $50 |
Scope
10 assets you may test, 11 excluded.
Web 5
- admin.instacart.com Critical
- api.instacart.com Critical
- shoppers.instacart.com Critical
- template.uat.foodstorm.com Critical
- www.instacart.com Critical
Wildcard domains 2
- *.instacart.com Critical
- *.instacart.tools Critical
Android apps 1
- com.instacart.client Critical
iOS apps 1
- 545599256 Critical
Products and areas 1
- Android & iOS App for Instacart Shoppers Critical
Out of scope (11)
- affiliate.instacart.com
- brand.instacart.com
- careers.instacart.com
- carrotstore.instacart.com
- company.instacart.com
- company.instacart.dev
- enterprise-status.instacart.com
- heyitsinstacart.com
- instacart.careers
- *.email.instacart.com
- *.unatalabs.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Instacart (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
You must only interact with accounts you own or those for which you have the explicit permission to access.
-
Testing for DoS issues, or any kind of issue which could affect the experience of other users
-
Using automated tools which generate excessive traffic volume
-
Accessing another user’s data without permission
-
Attempting to social engineer or spam Instacart employees, shoppers or other users
-
Submitting reports from automated tools without any verification
-
If you found an issue that could be escalated, do not attempt to pivot or escalate access.
-
If you found an issue that requires interacting with customer representatives to demonstrate impact, please refrain from doing so.
-
You may not publicly disclose the vulnerability prior to our resolution or approval
-
when you create accounts you include your HackerOne username in the email address field
Not accepted
-
Security best practices and other non-exploitable issues
-
Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
-
Social engineering
-
Content spoofing
-
Password and account recovery policies, such as reset link expiration or password complexity
-
Reflected file download (RFD)
-
CSV injection without additional impact
-
Email/username enumeration
-
Disclosure of file paths listed in robots.txt
-
Attacks requiring physical access to a user's device
-
Embedded client-side API keys which are intended to be used by our applications
-
Old versions of mobile applications no longer available through Google Play Store or iOS App Store
-
DNS poisoning
-
Client side secrets that are meant to be public
-
Known vulnerable third party dependencies
-
Login & logout CSRF, and missing CSRF protection in general
-
Clickjacking
-
Missing security headers
-
SPF/DKIM configuration issues
-
SSL/TLS configuration issues
-
S3 ACL issues without proof that the bucket is owned by Instacart
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
-
Raised
Top reward $15,000 to $20,000.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
The program rules were edited
-
Rules updated
Added: “Generally, a submission is eligible for a reward, regardless of vulnerability type, if it has clear security or business impact.”
-
Rules updated
Added: “To be considered for a reward, the following rules of engagement must be followed. The golden rule of thumb is that you must not disrupt, compromise, destroy da...”
-
Rules updated
Removed: “Table of Contents”
-
Rules updated
Added: “In order for us to attribute any test traffic or data back to you, we ask that when you create accounts you include your HackerOne username in the email address...”
-
Rules updated
Added: “Unclear or AI generated reports will be rejected as invalid findings.”
-
Rules updated
Added: “…ng a larger reward, or if the submission had less impact than originally thought.”
-
Rules updated
Added: “When determining the reward amount, the following are example factors that are taken into consideration, and can either raise or lower the amount:”
-
Rules updated
Added: “Failure to adhere to these rules may cause your report to be closed as N/A and a temporary or permanent ban from Instacart's bug bounty program.”
-
Rules updated
Removed: “How realistic is the exploitation possibilty?”
-
Reward raised
Maximum $15,000 → $20,000
-
Reward terms
The reward table or payout terms were edited
-
Reward terms
Low $250 → $150, High $5,000 → $3,000
-
Rules updated
The program rules were edited
-
Rules updated
Added: “Generally, a submission is eligible for a reward, regardless of vulnerability type, if it has **clear security or business impact**.”
-
Rules updated
Added: “Catastrophic impact - typically can be demonstrated from a critical severity vulnerability such Remote Code Execution, disclosure of PII data at scale, etc”
-
Rules updated
Added: “Instacart's bug bounty payout amount is determined by the security/business impact sizing. The security/business impact must be demonstrated/explained in the re...”
-
Scope added
company.instacart.dev (out of scope)
-
Scope added
company.instacart.com (out of scope)
-
Rules updated
Added: “Please checkout https://hackerone.com/instacart/policy_scopes for bounty eligible assets.”
-
Rules updated
Added: “Unclear or AI generated reports will be rejected as invalid finding.”
-
Rules updated
Added: “Please checkout https://hackerone.com/instacart/policy_scopes for bounty eligible assets.”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Rules
To be considered for a reward, the following rules of engagement must be followed. The golden rule of thumb is that you must not disrupt, compromise, destroy data, or interrupt or degrade our services. You must only interact with accounts you own or those for which you have the explicit permission to access.
Additionally, while hunting for bugs, please refrain from the following activities:
- Testing for DoS issues, or any kind of issue which could affect the experience of other users
- Using automated tools which generate excessive traffic volume
- Accessing another user’s data without permission
- Attempting to social engineer or spam Instacart employees, shoppers or other users (including reporting false information about an order to shoppers or customer representatives)
- Submitting reports from automated tools without any verification
If you found an issue that could be escalated, do not attempt to pivot or escalate access. Instacart will perform analysis to determine the maximum possible impact a submission has, you do not need to do this for us.
If you found an issue that requires interacting with customer representatives to demonstrate impact, please refrain from doing so. Submit the issue to us and we will determine the impact of the vulnerability.
Failure to adhere to these rules may cause your report to be closed as N/A and a temporary or permanent ban from Instacart's bug bounty program.
Vulnerability Types
Out-of-Scope
Generally, a submission is eligible for a reward, regardless of vulnerability type, if it has clear security or business impact.
However, the following types are not eligible for a reward in most cases:
- General
- Security best practices and other non-exploitable issues
- Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
- Social engineering
- Web Applications
- Content spoofing
- Password and account recovery policies, such as reset link expiration or password complexity
- Reflected file download (RFD)
- CSV injection without additional impact
- Email/username enumeration
- Disclosure of file paths listed in robots.txt
- Mobile
- Attacks requiring physical access to a user's device
- Embedded client-side API keys which are intended to be used by our applications
- Old versions of mobile applications no longer available through Google Play Store or iOS App Store
- Infrastructure
- DNS poisoning *Secrets
- Client side secrets that are meant to be public
Additionally, the following vulnerabilities won’t be eligible without further proof of security impact:
- General
- Known vulnerable third party dependencies
- Web Applications
- Login & logout CSRF, and missing CSRF protection in general
- Clickjacking
- Missing security headers
- Infra
- SPF/DKIM configuration issues
- SSL/TLS configuration issues
- S3 ACL issues without proof that the bucket is owned by Instacart
Known Issues
Going forward, this section will be used to list any long-standing issues that we’re already aware of.
Assets
Please checkout https://hackerone.com/instacart/policy_scopes for bounty eligible assets.
Given that DNS records change frequently, and EC2 IP addresses may be recycled, you should attempt to verify that the service is still maintained by Instacart.
Unfortunately, we will not be able to provide test credentials or provision any test accounts for researchers at the moment.
Out-of-Scope
Please checkout https://hackerone.com/instacart/policy_scopes for ineligible assets.
Systems or services which are not owned or maintained by Instacart, such as third-party blogs, apps or micro-sites, are not eligible for a reward, as we can’t give you permission to test against them.
If you believe you found an issue which affects Instacart but is not listed as in-scope, you can report it to us for consideration. However, we do not recommend you look for these issues as they are likely to be ineligible.
Third-Party Bugs If issues reported to our bug bounty program affect a third-party library, external project, or another vendor, Instacart reserves the right to forward details of the issue to that third party without further discussion with the researcher. We will do our best to coordinate and communicate with researchers throughout this process.
Rewards
Eligibility
We appreciate and thank everyone who submits valid reports that help us improve the security of Instacart!
However, only those that meet the following eligibility requirements may receive a monetary reward:
- You must be the first reporter of a vulnerability
- The vulnerability must be associated with an asset in scope
- The vulnerability should be exploitable, i.e. can be used to affect the confidentiality, integrity, authenticity, and safety of our data, applications, systems, applications or users
- The vulnerability should have demonstrable business/security impact
- You must disclose the vulnerability report directly and exclusively to us
- You may not publicly disclose the vulnerability prior to our resolution or approval
- We can be legally prohibited from rewarding you (for example, you can’t be a resident of or located within Cuba, Sudan, North Korea, Iran or Syria a national of other certain countries, or on a denied parties or sanctions list)
Instacart reserves the right to determine the reward amount and whether the vulnerability was previously reported. Instacart also reserves the right to change or discontinue its bug bounty program at any time without notice in its sole discretion.
Payout Amounts
Instacart's bug bounty payout amount is determined by the potential impact of the finding. The impact must be demonstrated or explained in the report. Even if the vulnerability class falls into a certain severity category, the payout range won't necessarily map 1:1 to the range. For example, an RCE vulnerability on a non-production server may only have a moderate impact.
- Catastrophic impact: code execution on production infrastructure or user devices; access to production databases or other sensitive data
- Serious impact: authentication bypass with user interaction; targeted access to sensitive data (PII, credentials)
- Moderate impact: access issues with limited impact (e.g. IDOR or most XSS vectors)
- Minor impact : non-sensitive information leaks, blind SSRFs, business logic flaws without explicit damage
We also recognize that payout amounts can be different than what you’re expecting, Therefore we will try to give a justification when issuing the payout - for example, if we found additional impact and are giving a larger reward, or if the submission had less impact than originally thought.
The final decision is at Instacart’s sole analysis of the impact posed by the submission. However, we will be transparent on how we got to the decision.
Payout Schedule Asset Tiering
Tier 1 - 100% of the regular payout range amount will be applied / paid out
- Instacart Marketplace (www.instacart.com) web/mobile application, production infrastructure
Tier 2 - 50% of the regular payout range amount will be applied / paid out
- *.instacart.tools assets (typically these are non-prod test sites) - for non-prod environment, the security impact is typically low. Please try to focus on the Tier 1 assets (i.e. production environment)
- Instacart's affiliate/acquisition brands (Foodstorm, Caper, Eversight, Instaleap, Arpalus) - even though these brands are not our main business, we extend our bug bounty scope to cover these brands but in a limited manner.
- Legacy domains
- IT assets
Demonstrating Impact
To demonstrate impact for various types of vulnerabilities, you can use one of the following techniques. This will help you avoid causing a privacy violation or creating other unnecessary risks:
- For SQL injection,
select version()orcurrent_userand include the output. Do not attempt to load data from other rows or tables - For command injection, you can run
touch /tmp/{your_username}and send us the file path. Do not attempt to access other files such as/etc/passwd - For XSS, you should run
alert(document.domain)to prove that the code is running under our origin and not a third-party or sandboxed domain - For authentication/authorization issues, you should attempt to load data from one of your other test accounts
If at any stage you’re unable to demonstrate impact without potentially accessing production data, you should let us know so that we can do the investigation for you.
Submissions
We want to get your submissions resolved and rewarded as soon as possible, but in order to achieve this goal, we need a few things from you first.
Report Quality
Please follow the template format which will help you demonstrate the full impact of the finding.
We understand that English may not be the first language of many researchers, so including screenshots or a short video demonstrating the issue can help expedite the triage process.
Unclear or AI generated reports will be rejected as invalid findings.
Attribution
In order for us to attribute any test traffic or data back to you, we ask that when you create accounts you include your HackerOne username in the email address field.
Additionally, in order to test authentication/authorization issues, you should create multiple test accounts.
Automated Tools
We recognize that using various automated tools is an important part of the recon and testing phases of bug bounty. As such, rather than prohibiting their use, we ask that you configure your tools to use reasonable limits.
Feedback
Without researchers our program wouldn’t exist, so we welcome any and all feedback as to how we can improve! If you have any thoughts, please feel free to reach out to our team at [email protected].