Linktree

Description

With 30 million global users, Linktree is helping brands, artists, publishers, agencies and influencers better control their presence online. The security of our platform is more important than ever, and we believe the global security community is a big part of that. The scope for Linktree's Bug Bounty program is inclusive of most of our assets. If you find something that would be impactful to our users, we want to hear about it. Your participation in our Bug Bounty Program is voluntary. By submitting a report or otherwise disclosing a vulnerability to us, you are indicating that you have read and agree to follow the rules set forth on this page. Ratings/Rewards: For this program Linktree is leveraging CVSS for gauging impact and paying out rewards.** However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. The translation between the CVSS Scores and bounties paid are outlined below: CVSS Scores │ VRT Equivalent 10.0 - 9.0 │ P1 / Critical 8.9 - 7.0 │ P2 / High 6.9 - 4.0 │ P3 / Medium 3.9 - 2.0 │ P4 / Low 1.9 - 0.0 │ P5 / Informational Additionally, the following modifications have been made: Access control bypass issues in link lock features pointing to public content are classified as Low severity. Deleted assets/items that are still accessible are classified as Low severity. Cross-Site Scripting (XSS) attacks are considered at maximum a Medium severity. Sub-domain takeovers are considered at maximum a Medium severity. Denial-of-Service (DoS) attacks via GraphQL (alias/directive overloading, batching, field duplication, circular/nested introspection, etc) are out of scope. Please reference the Out of Scope Section.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Linktree not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Linktree, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation. Program Information: Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. Do not access, impact, destroy or otherwise negatively impact Linktree customers, or customer data in anyway. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Respect our users’ privacy. No extortion, shake downs, or duress. Don’t leave any system in a more vulnerable state than you found it. Be respectful when interacting on reports with our team. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. Submitting multiple vulnerabilities across sub domains (dev/QA/staging/prod) is considered shared root cause and will be marked as duplicate. When a vulnerability consists of different parameters but having the same api endpoint please group this together in the same report. When a vulnerability is occurs to a third party integration (such as PayPal, etc) we will treat all reports as a single report When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced). Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. You are accountable for your testing traffic with reasonable and non disruptive testing to not cause production issues or exceed our rate limits of 10,000 requests per hour. If your scenario is at risk of breaching the above, contact Bugcrowd for advice before proceeding. Access and credentials: You can sign up for a free Linktree account with this link: https://linktr.ee/register . You can also sign up for a one month free trial of any plan (not including Premium) with your @bugcrowdninja.com email alias via this link: https://linktr.ee/register?couponId=BUGBOUNTY30FREE Free accounts give you access to limited features while you will have more privileges with a Start, or Pro account. A list of accessible features is provided here: https://linktr.ee/s/pricing/pricing-comparison/ Out-of-Scope When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope: 11 October 2026: "Code execution in the LinkApp build environment via creator-supplied build inputs (PostCSS/Tailwind/Rsbuild/LinkApp config files, dependencies, source) is a known issue. Submissions through this pipeline will be marked accordingly." Clickjacking on pages with no sensitive actions Tabnabbing on Android or iPhone app(s) on content not relating to sensitive actions or data Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with non-sensitive actions. Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Missing best practices in SSL/TLS configuration. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. Rate limiting or brute-force issues on non-authentication endpoints. Rate limiting or DoS attacks on GraphQL endpoints. Missing HttpOnly or Secure flags on cookies. Vulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version]). Software version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors). Public zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis. Tabnabbing Issues that require unlikely user interaction Issues related to identifying if someone is a free or pro user Act's of self sabotage (such as making a linktree inaccessible) as owner or admin of Linktree account are out of scope Bypassing requirements for an elevation of account tier. For example: Upgrading tier without need of payment via API requests, using a discovered coupon code to upgrade tier, extending the free trial period, etc. Bypassing account tier requirements on individual features is out-of-scope (a list of tiers can be found at: https://linktr.ee/s/pricing/). This includes features that are exclusive for Pro or Premium users, or require an upgrade of tier. To clarify, bypassing account tier requirements on multiple features with the same method is in-scope. Bypassing account tier requirements on individual features for plannthat.com is out-of-scope. For the Plann product (Plann iOS app, Plann Android app, *.plannthat.com), spamming content is out of scope. Response Targets Bugcrowd have an initial triage time of P1 < 2 business days and P2-P5 <7 business days. Issues which have not been assigned a priority will be treated as P5 until Bugcrowd triage assigns one. Once triaged by Bugcrowd, Linktree will make a best effort to meet the following SLAs for researchers participating in our program: Linktree Response │ SLO in business days First Response │ 3 days Time to Triage │ 5 days Time to Bounty │ 14 days Time to Resolution │ Depending on complexity and severity of issue We’ll keep you informed about our progress through each stage of response. Disclosure Policy Please do not discuss any vulnerabilities (even resolved ones) outside of the program without consent from the Linktree team unless they are made public. We intend to make all reports public unless there is a compelling reason not to. To qualify for disclosure the report has to be in Resolved state, and raised by you. Disclosed reports will be in limited state by default unless full disclosure is deemed necessary by Linktree We appreciate your help and promise to treat you as a friend and ally as long as you act in good faith. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.