- Top reward
- $25,000
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 4
- Last change
At a glance
What to know before you start testing.
- Pays up to $25,000
- for critical bugs, from $200.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$25,000 from $10,000 |
| High |
|
$8,000 from $5,000 |
| Medium |
|
$3,000 from $1,000 |
| Low |
|
$500 from $200 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
- Hall of fame
-
Yes
they are still eligible for our Hall of Fame
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $25,000
Scope
13 assets you may test.
Android apps 3
- https://play.google.com/store/apps/details?id=com.pinterest&hl=en_US&gl=US
- https://play.google.com/store/apps/details?id=com.pinterest.shuffles
- https://play.google.com/store/apps/details?id=com.pinterest.twa&hl=en_US&gl=US
iOS apps 2
- https://apps.apple.com/us/app/pinterest/id429047995
- https://apps.apple.com/us/app/shuffles-by-pinterest/id1573869498
APIs 1
- https://api.pinterest.com
Web 1
- https://www.shffls.com
Wildcard domains 1
- *.pinterest.com web apps
Products and areas 5
- https://addons.mozilla.org/en-US/firefox/addon/pinterest/
- https://apps.apple.com/us/app/save-to-pinterest/id6473649042
- https://chrome.google.com/webstore/detail/pinterest-save-button/gpdjojdkbbmdfjfahjcgigfpmkopogic?hl=en
- https://github.com/pinterest/
- https://microsoftedge.microsoft.com/addons/detail/pinterest-save-button/bkgoflemacdadndiohhdnphcmdhacabg
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Pinterest (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Testing is only authorized on the targets listed as In-Scope.
-
Only test/interact with your own accounts or those that you have explicit permission from the account owner.
-
If you come across personal information of any accounts belonging to real users, cease any further testing and report the findings(including details of the exposed information).
-
Any personal information exposed through testing must not be kept or disclosed, and should be cleared immediately.
-
Please only submit one report per vulnerability(even if the issue appears on multiple endpoints or attack surfaces).
-
You may not publicly disclose the vulnerability without our explicit permission
-
Submitters must not access data except to the extent minimally required to identify a vulnerability; and that use of any data accessed must be limited to use for identifying and reporting the vulnerability
Not accepted
-
External authentication injection
-
Network/resource exhaustion attacks such as DDoS
-
Rate limiting bypass without clear security impact
-
Social engineering or spam
-
Use of a vulnerable library/service without demonstrable impact
-
Output from automated tools/scanners
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.pinterest.com Web Apps
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-28251 | Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of query executions. Currently the CORS setting allows all origins, which could result in cross-site websocket | Medium 5.6 | 14 Mar 2024 |
| CVE-2024-27103 | Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerabilit | Medium 6.1 | 28 Feb 2024 |
| CVE-2024-26148 | Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occ | Medium 6.1 | 21 Feb 2024 |
| CVE-2022-46151 | Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are ad | Medium 6.3 | 6 Dec 2022 |
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Pinterest is a place to discover ideas for all your projects and interests, hand-picked by people like you. We take our security very seriously and welcome any responsible disclosure of potential gaps in our systems. Our triage team will use a combination of impact and exploitability to assess reported vulnerabilities, and reward decisions are at the sole discretion of Pinterest's security team. This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization of findings. Please note: Rewards caps are strict and non-negotiable
Targets
Vulnerabilities reported on other Pinterest properties or applications not listed as 'In scope' are currently not eligible for monetary rewards (as they come into scope, they will be added to this section). However, they are still eligible for our Hall of Fame . Unauthorized access to Pinterest Corporate systems will be evaluated case by case and may be eligible for monetary rewards. Areas of Interest These vulnerability types and products are of particular interest and will be considered for top rewards: Vulnerability types Remote Code Execution Significant Authentication Bypass Critical Authorization Bugs Cross Site Request Forgery on Critical Actions Cross Site Scripting (excluding self-XSS) Exfiltration of Sensitive Data or Personal Identifiable Information (PII) Products & Features Private Profiles Pinterest Ads Out of Scope Out of scope findings include (but are not limited to): External authentication injection Network/resource exhaustion attacks such as DDoS Rate limiting bypass without clear security impact Social engineering or spam Use of a vulnerable library/service without demonstrable impact Output from automated tools/scanners Testing Guidelines Testing is only authorized on the targets listed as In-Scope. Any domain/property of Pinterest not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to the Pinterest org, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation. Only test/interact with your own accounts or those that you have explicit permission from the account owner. If you come across personal information of any accounts belonging to real users, cease any further testing and report the findings(including details of the exposed information). If we see continued testing from our side of vulnerabilities that expose real user personal information, we may disqualify the report. Any personal information exposed through testing must not be kept or disclosed, and should be cleared immediately. API Testing To test certain APIs (e.g Pinterest v5 API ), you'll need to create a business account and enroll as a developer. Once enrolled, you can create apps in the Developer platform. The process for this can be found at https://developers.pinterest.com/account-setup/ . Please use your *@bugcrowdninja.com email in order for us to verify your participation in program and approve your apps quickly. Submission Guidelines Reports should include: Context Clear reproduction steps Impact Screenshots/videos User ID/email of accounts used during testing Any reports not providing the critical submission information listed above may experience delayed response times and/or reduced rewards. Well-written and concise reports with clear demonstrable impact are likely to be triaged/validated faster, and may be rewarded with a larger payout. Please only submit one report per vulnerability(even if the issue appears on multiple endpoints or attack surfaces). Eligibility and Responsible Disclosure We are pleased to thank every researcher who submits valid reports that help us improve the security of Pinterest. However, only those that meet the following eligibility requirements may receive a reward: The vulnerability must be a qualifying vulnerability (see Scope) You must be first to submit the vulnerability The vulnerability's root cause is not already known We can’t be legally prohibited from rewarding you You may not publicly disclose the vulnerability without our explicit permission Not be employed by Pinterest or its subsidiaries or related entities Terms and Conditions Submitters must not access data except to the extent minimally required to identify a vulnerability; and that use of any data accessed must be limited to use for identifying and reporting the vulnerabilityYou must comply with all applicable laws in connection with your participation in this program. As a condition of participation in this program, you hereby grant Pinterest, its affiliates and customers a perpetual, irrevocable, worldwide, royalty-free, transferrable, sub-licensable (through multiple tiers) and non-exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, create a derivative work form, make, use, sell, offer for sale and import the Submission, as well as any materials submitted to Pinterest in connection therewith, for any purpose. As well, this program is not an offer of employment, nor of a contractual relationship between Pinterest and any other party. You are also responsible for any applicable taxes associated with any reward you receive. We may modify the terms of this program or terminate this program at any time. We will not apply changes to this program retroactively. This bounty requires explicit permission to disclose the results of a submission. The Pinterest team is open to coordinated disclosure requests for valid submissions that fall in the P1-P4 range. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our official channels before going any further.