- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $100.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,000 |
| Medium |
|
$500 |
| Low |
|
$100 |
- Top reward
-
$5,000
Critical up to $5,000
- Lowest reward
-
$100
Low up to $100
- Safe harbor
-
Partial
Please make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 4 excluded.
Android apps 1
- Mobile apps
APIs 1
- tools, widgets, or APIs
Domains 1
- tradingview.com
Wildcard domains 1
- tradingview.com and its subdomains
Products and areas 2
- desktop app
- iOS and Android platforms
Out of scope (4)
- old versions of third party software/protocols
- rooted, jailbroken or modified devices and applications
- third-party services
- users' software
Rules
What the policy asks of you, and the bug types it won't reward, quoted from TradingView's policy. "We" in these lines means the program, not this site.
While testing
-
A bug report should include a detailed description of the discovered vulnerability and steps that need to be taken in order to reproduce it, or a working proof-of-concept.
-
Please only submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Only the first person to report an unknown vulnerability will be rewarded.
-
You should not use automated tools and scanners to find vulnerabilities.
-
You should not perform any attack that could damage our services or data including client data.
-
You should not involve other users without their explicit consent.
-
You should not perform or try to perform non-technical attacks such as social engineering (e.g. phishing, vishing, smishing) or physical attacks against our employees, users or infrastructure in general.
-
Please make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Not accepted
-
EXIF geolocation data not stripped
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions, logout CSRF
-
Weak ciphers or TLS configuration without a working Proof of Concept
-
Content spoofing or injection issues without showing an attack vector
-
Rate limiting or brute force issues on non-authentication endpoints
-
Missing HttpOnly or Secure flags on cookies
-
Software version disclosure. Banner identification issues. Descriptive error messages or headers (e.g. stack traces, application or server errors)
-
Tabnabbing
-
User existence. User, email or phone number enumeration
-
Lack of password complexity restrictions
-
Homograph attacks
-
Disclosure of public or non-sensitive information
-
Vulnerabilities that require the user to perform unusual actions
-
Vulnerabilities with no substantial security impact or exploitation possibility
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.