- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 38
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $175.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 from $500 |
| High |
|
$3,000 from $250 |
| Medium |
|
$750 from $300 |
| Low |
|
$225 from $175 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000
Scope
38 assets you may test, 15 excluded.
Web 27
- https://auth.thetradedesk.com
- https://careers.thetradedesk.com
- https://cstg-integ.uidapi.com
- https://desk.thetradedesk.com
- https://edgeacademy.thetradedesk.com
- https://esp-jssdk-integ.uidapi.com
- https://esp-srvonly-integ.uidapi.com
- https://example-jssdk-integ.uidapi.com
- https://example-srvonly-integ.uidapi.com
- https://myopenpass.com
- https://myopenpassdemo.com
- https://open.sincera.io
- https://ops-sso.adsrvr.org
- https://partner.myopenpass.com
- https://partner.thetradedesk.com
- https://portal.unifiedid.com
- https://secure-signals-client-side-integ.uidapi.com
- https://secure-signals-jssdk-integ.uidapi.com
- https://secure-signals-react-integ.uidapi.com
- https://secure-signals-srvonly-integ.uidapi.com
- https://transparentadvertising.com
- https://transparentadvertising.eu
- https://www.adsrvr.org
- https://www.opensincera.com
- https://www.thecurrent.com
- https://www.thetradedesk.com
- https://www.venturatvos.com
APIs 9
- https://api.thetradedesk.com
- https://atlantis-ext.myopenpass.com
- https://auth.myopenpass.com
- https://cdn.myopenpass.com
- https://core-prod.uidapi.com
- https://optout.prod.euid.eu
- https://optout-prod.uidapi.com
- https://prod.euid.eu
- https://prod.uidapi.com
Wildcard domains 2
- *.adsrvr.org
- *.thetradedesk.com
Out of scope (15)
- All client websites that have integrated with OpenPass
- Anything not explicitly listed as Tier 1, Tier 2, or Tier 3
- Applications that resolve to *.okta.com (ex: openpath-login.thetradedesk.com)
- Applications that resolve to *.quilvem.com (ex: update.adsrvr.org)
- Applications that resolve to *.skilljarapp.com
- Applications that resolve to *.smartling.com (ex: id.thetradedesk.com)
- argocd.*.uidapi.com
- https://ask.thetradedesk.com
- https://bynder.thetradedesk.com
- https://euid.eu
- https://investors.thetradedesk.com
- https://openpass.thetradedesk.com
- https://stationery.thetradedesk.com
- https://unifiedid.com
- https://www.thetradedeskedgeacademy.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from The Trade Desk (via Bugcrowd)'s policy.
While testing
-
Testing is only authorized on the targets listed as In-Scope.
-
Any domain/property of The Trade Desk not listed in the targets section is out of scope.
-
you must use your @bugcrowdninja.com email address when registering
-
Use only your own accounts for cross-account attacks; do not attempt to access other customers' accounts.
-
Researchers should approach targets from an unauthorized point-of-view.
-
Automated brute force attacks beyond the minimum required to demonstrate a lack of rate limiting controls
-
Significant data exfiltration from databases or other storage systems
-
Any actions that could lead to data loss or service disruption
-
DNS records should be queried on each domain to ensure it's under the direct control of The Trade Desk, prior to testing.
Not accepted
-
Information or functionality intentionally exposed to the public
-
Subdomain takeovers
-
Known issues from outdated software versions that do not pose a significant risk to The Trade Desk production systems
-
Known issues from outdated software versions that pose a significant risk to The Trade Desk but have been known for less than 30 days
-
TLS/SSL configuration improvements
-
Missing cookie flags on non-sensitive cookies
-
Missing HTTP security headers, unless accompanied by an impactful PoC
-
Minor issues with rate limiting that do not lead to significant abuse or exploitation
-
EXIF geolocation data not stripped from uploaded images, unless accompanied by an impactful PoC
-
Open redirects, unless accompanied by an impactful PoC
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 41 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Welcome to The Trade Desk's Bug Bounty Program! At The Trade Desk, we are committed to maintaining the highest standards of security for our global digital advertising platform. As a leader in ad tech, we empower brands to reach their audiences with precision and efficiency. To ensure our platform remains secure, we invite skilled security researchers like you to join us in identifying and addressing potential vulnerabilities. Your expertise plays a crucial role in safeguarding the integrity of our systems, protecting our clients, and ensuring a safer digital advertising ecosystem. We value your contributions and are eager to collaborate in making The Trade Desk's platform as secure as possible. Happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as In-Scope. Any domain/property of The Trade Desk not listed in the targets section is out of scope. This includes any/all subdomains not listed above. THE TRADE DESK EMPLOYEES ARE NOT ELIGIBLE FOR REWARDS. The following issues are In-Scope, but are typically not rewarded: Information or functionality intentionally exposed to the public Subdomain takeovers Known issues from outdated software versions that do not pose a significant risk to The Trade Desk production systems Known issues from outdated software versions that pose a significant risk to The Trade Desk but have been known for less than 30 days TLS/SSL configuration improvements Missing cookie flags on non-sensitive cookies Missing HTTP security headers, unless accompanied by an impactful PoC Minor issues with rate limiting that do not lead to significant abuse or exploitation EXIF geolocation data not stripped from uploaded images, unless accompanied by an impactful PoC Open redirects, unless accompanied by an impactful PoC Out of Scope Activities: Exploiting out-of-scope assets Social engineering Physical attacks on The Trade Desk premises or attempting to breach physical security controls Automated brute force attacks beyond the minimum required to demonstrate a lack of rate limiting controls Significant data exfiltration from databases or other storage systems Hacking third-party services that are not under the direct control of The Trade Desk Any activities that result in spam emails being sent to other customers Any actions that could lead to data loss or service disruption Access: All targets listed are public facing. Credentials: NO CREDENTIALS ARE PROVIDED FOR THIS PROGRAM Researchers should approach targets from an unauthorized point-of-view. Some In-Scope targets have self-registration features that can be utilized BUT you must use your @bugcrowdninja.com email address when registering. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.
Special Target (in scope)
OpenSincera is a media telemetry service offered free by The Trade Desk. It is currently in active Beta, and we are temporarily increasing the bounty for P1 and P2 submissions for this target. We are particularly interested in submissions regarding broken access control. Use only your own accounts for cross-account attacks; do not attempt to access other customers' accounts. You must self-register OpenSincera accounts with your @bugcrowdninja.com email address.
Tier 1 Targets (in scope)
This tier includes high-priority targets that are crucial for business operations or handle sensitive data. Target Information: Desk Platform desk.thetradedesk.com - Create, manage, optimize, and measure digital advertising campaigns. api.thetradedesk.com - RESTful JSON API. A highly flexible alternative to the UI where scale or automation scenarios can be enabled. auth.thetradedesk.com - A single sign-on solution (SSO) allowing access to multiple products and platforms offered by The Trade Desk. API Documentation (for reference only): https://partner.thetradedesk.com/v3/portal/api/overview OpenPass auth.myopenpass.com - OIDC API. A single sign-on solution (SSO) allowing consumers access to premium content on the open internet without a password. myopenpass.com - View and manage consumer OpenPass settings. partner.myopenpass.com - Publishers can integrate their applications with OpenPass. atlantis-ext.myopenpass.com - Webhooks endpoint to receive GitHub events. Services and API Documentation (for reference only): https://partner.thetradedesk.com/v3/portal/openpass/overview UID2 *.prod.uidapi.com - The UID2 Public Operator Service. It enables the management and storage of encryption keys and salts from the UID2 Core Service, hashing of users' personal data, encryption of raw UID2s, and decryption of UID2 tokens. core-prod.uidapi.com - The UID2 Core Service manages access to salts, encryption keys, and other relevant data in the UID2 ecosystem. optout-prod.uidapi.com - The UID2 Opt-Out Service manages and stores user opt-out requests and disseminates them to publishers, operator service instances, and DSPs. portal.unifiedid.com - The UID2 Portal allows users to set up and configure their UID2 account. transparentadvertising.com - The Transparency and Control Portal that allows consumers to opt out of UID2 at any time. Services and API Documentation (for reference only): https://unifiedid.com/docs/intro Source code repositories (for reference only, GitHub itself is not in scope): https://github.com/IABTechLab EUID prod.euid.eu - The EUID Public Operator Service. It enables the management and storage of encryption keys and salts from the EUID Core Service, hashing of users' personal data, encryption of raw EUIDs, and decryption of EUID tokens. optout.prod.euid.eu - The EUID Opt-Out Service manages and stores user opt-out requests and disseminates them to publishers, operator service instances, and DSPs. transparentadvertising.eu - The Transparency and Control Portal that allows consumers to opt out of EUID being used to show them personalized ads. Services and API Documentation (for reference only): https://euid.eu/docs/intro
Tier 2 Targets (in scope)
This tier covers company-controlled services that may handle some sensitive information but are not as critical. If a submission for any of these targets are proven to also cause significant harm to a Tier 1 target then we will reward appropriately at that tier. Target Information: UID2 *-integ.uidapi.com - Example sites for content publishers to test various UID2 integrations. Services and API Documentation (for reference only): https://unifiedid.com/docs/guides/summary-guides Source code repositories (for reference only, GitHub itself is not in scope): https://github.com/IABTechLab/uid2-web-integrations Wildcard Domains *.thetradedesk.com & *.adsrvr.org - These targets encompass all subdomains not listed in one of the other tiers or out-of-scope.
Tier 3 Targets (in scope)
This tier consists of services that do not manage sensitive data or interact with critical systems. If a submission for any of these targets are proven to also cause significant harm to a Tier 1 or Tier 2 target then we will reward appropriately at that tier. The target edgeacademy.thetradedesk.com is in-scope but www.thetradedeskedgeacademy.com is out-of-scope because it is owned by a third-party.
Out of Scope (out of scope)
These are all third-party services that must not be tested. This list may not be inclusive of all third-party services so DNS records should be queried on each domain to ensure it's under the direct control of The Trade Desk, prior to testing.