Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Tripadvisor

Bug bounty on Bugcrowd tripadvisor.com

Accepting reports Full safe harbor
Go to program
Top reward
$5,000
Top severity paid
Critical
Assets in scope
27
Public CVEs
2
Last change

At a glance

What to know before you start testing.

Pays up to $5,000
for critical bugs, from $50.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $5,000 from $1,500
High $1,250 from $450
Medium $900 from $150
Low $250 from $50
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000

Scope

27 assets you may test, 26 excluded.

APIs 12

  • https://api.production.cde.tamg.cloud
  • https://api.tripadvisor.com
  • https://gwapi1.tripadvisor.com
  • https://gwapi2.tripadvisor.com
  • https://gwapi.tripadvisor.com
  • https://partnerapi1.tapayments.com
  • https://partnerapi2.tapayments.com
  • https://partnerapi.tapayments.com
  • https://service.platform.tripadvisor.com
  • https://walletproxy1.tapayments.com
  • https://walletproxy2.tapayments.com
  • https://walletproxy.tapayments.com

Web 12

  • Any publicly accessible Tripadvisor web asset or host (domains, ip space, etc) - except for assets listed as Out-of-Scope below.
  • http://marlo.ext.tripadvisor.com
  • https://*.bokundemo.com
  • https://*.bokuntest.com
  • https://*.flipkey.com
  • https://*.holidaylettings.com
  • https://*.housetrip.com
  • https://*.niumba.com
  • https://rentals.tripadvisor.com
  • https://*.vacationhomerentals.com
  • https://www.tripadvisor.com
  • Localized versions of www.tripadvisor.com available from the site's header or footer

iOS apps 2

  • https://apps.apple.com/us/app/tripadvisor-plan-book-trips/id284876795
  • https://itunes.apple.com/us/app/vacation-rentals-owner-app-by-tripadvisor/id1045663228?mt=8

Android apps 1

  • https://play.google.com/store/apps/details?id=com.tripadvisor.tripadvisor&hl=en
Out of scope (26)
  • careers.tripadvisor.com
  • ir.tripadvisor.com
  • spotlight-dev.tripadvisor.com
  • spotlight.tripadvisor.*
  • taplus.*
  • travelermail.com
  • tripadvisor-plus.*
  • tripadvisorplus.*
  • *.bokun.app
  • *.bokun.com
  • *.bokun.eu
  • *.bokun.io
  • *.bokun.is
  • *.bokunmobile.website
  • *.bokun.team
  • *.bokun.tools
  • *.bokun.website
  • *.experiences.zone
  • *.tripadviser.at
  • *.tripadvisoradexpress.*
  • *.tripadvisor.cn
  • *.tripadvisor.*/engineering
  • *.tripadvisor.*/mobile*
  • *.tripadvisor.*/trips
  • *.tripadvisor.*/widgetembed-*
  • *.tripadvisorwifi.*

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Tripadvisor (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Interacting with legitimate live properties is strictly forbidden.
  • Interacting with legitimate customers is strictly forbidden.
  • Do not post inappropriate content and images, even on test properties.
  • Include the string "bugcrowd" in your User-Agent
  • Always use accounts containing the word "bugcrowd" when adding any content (i.e. John Bugcrowd or [email protected])
  • Add "bugcrowd" to one of the fields of any form post not requiring account information
  • Creating properties in popular tourist areas is strictly forbidden.
  • Use test properties whenever possible . Only if the functionality you are trying to test does not exist in test properties, you may create your own property for testing.
  • You must be using “vulnscan” prefix in your vendor/supplier name when registering for an account for both types of scans (manual and/or automatic).
  • It is strictly forbidden to run automated or manual vulnerability testing on production systems (listed in "Out of scope" section below).

Not accepted

  • Information-stealer logs / exposed credentials that has no access to the internal resources.
  • HTTP Header security related findings such as missing headers.
  • IDOR in property owner features
  • Mass content submission, account creation or spamming.
  • Denial of service attacks or any testing that causes disruption of service.
  • Social engineering attacks, including open redirects.
  • Attacks requiring physical access to Tripadvisor locations or property.
  • Attacks against our artificial intelligence systems.
  • Exploits that require physical access to the device or that require warranty voiding actions (e.g., rooting victim device).
  • Exploits against the site from webviews within mobile applications NOT published by Tripadvisor.
  • Domains that do not send email are not eligible for rewards relating to email misconfiguration (e.g. DMARC misconfiguration).
  • Mobile application vulnerabilities that require having a malicious application installed
  • Tripadvisor Plus functionality
  • Reputation Pro features in Tripadvisor main app

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 15 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    *.tripadvisor.*/WidgetEmbed-* (out of scope)

  2. Scope added

    Any publicly accessible Tripadvisor web asset or host (domains, ip space, etc) - except for assets listed as Out-of-Scope below.

  3. Scope added

    Localized versions of www.tripadvisor.com available from the site's header or footer

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2017-17226 Medium 5.3 9 Mar 2018
CVE-2012-4917 Medium 5.0 26 Jan 2013

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Tripadvisor, the world's largest travel guidance platform, helps hundreds of millions of people each month become better travelers, from planning to booking to taking a trip. Travelers across the globe use the Tripadvisor site and app to discover where to stay, what to do and where to eat based on guidance from those who have been there before. Thank you in advance for your contributions to our program! We look forward to working with you to keep Tripadvisor secure. Good luck and happy hunting! General Program Rules Violating program rules may result in your bounty being omitted. Interacting with legitimate live properties is strictly forbidden. Even minor actions such as marking a review as helpful are forbidden. Interacting with legitimate customers is strictly forbidden. Always use your own accounts to create all entities needed for your testing (e.g. hotel, hotel owner and traveler). Even minor actions such as inviting the customer to a trip are forbidden. Do not post inappropriate content and images, even on test properties. Content you submit must be suitable for work and schools environment. Identify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools: Include the string "bugcrowd" in your User-Agent Always use accounts containing the word "bugcrowd" when adding any content (i.e. John Bugcrowd or [email protected]) Add "bugcrowd" to one of the fields of any form post not requiring account information In the unlikely event of legitimate customer sending you a message, request or similar, please explain that you are using a test account and your property is not real. If creating your own property, make sure to follow the rules below. Creating properties in popular tourist areas is strictly forbidden. Field │ Value First name │ Must contain Bugcrowd Last name │ Test Property Name │ Must contain Bugcrowd City │ Atafu (location id 446951) Bank Country │ United Kingdom Account Number │ 12345678 Sort Code │ 70 99 99 Use test properties whenever possible . Only if the functionality you are trying to test does not exist in test properties, you may create your own property for testing. See the list of test properties below. Test Hotel 1 Test Hotel 2 Test Vacation Rental 1 Test Vacation Rental 2 Test Restaurant 1 Test Restaurant 2 Test Tour Test Tour 2 Test Attraction Test Attraction 2 You must abide guidelines specific to each scope tier which are listed in sections below. Tripadvisor Triage and Reporting This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the initial prioritization/rating of findings. This bounty follows Bugcrowd’s standard disclosure terms . Kudos points awarded will vary based on the priority of your submission. How We Measure Crowd Performance . Reports should contain demonstrated practical impact and attack scenario. Reports should include full HTTP requests and responses. Final decisions on vulnerability priority and bounty amount are made by Tripadvisor security team for each report individually.

Targets

Out of Scope Information-stealer logs / exposed credentials that has no access to the internal resources. Please note that, info-stealer logs may be accepted if the detected credential can be used for accessing internal resources. HTTP Header security related findings such as missing headers. IDOR in property owner features is temporarily out of scope Content fraud such as inflating or deflating a property's rating, insertion of bogus properties within the listings or raising the helpful vote count of a review. Mass content submission, account creation or spamming. Denial of service attacks or any testing that causes disruption of service. Social engineering attacks, including open redirects. Open redirects bugs may be accepted if there is more impact than social engineering attacks. Attacks requiring physical access to Tripadvisor locations or property. Attacks against our artificial intelligence systems. Exploits that require physical access to the device or that require warranty voiding actions (e.g., rooting victim device). Exploits against the site from webviews within mobile applications NOT published by Tripadvisor. Domains that do not send email are not eligible for rewards relating to email misconfiguration (e.g. DMARC misconfiguration). Mobile application vulnerabilities that require having a malicious application installed will have drastically reduced priority class because of prerequisite. Tripadvisor Plus functionality Reputation Pro features in Tripadvisor main app Brands owned by Tripadvisor Media Group but operate independently: CruiseCritic (main website https://www.cruisecritic.com/) TheFork / LaFourchette (main website https://www.thefork.com/) JetSetter (main website https://www.jetsetter.com/) SeatGuru (main website https://www.seatguru.com/) Viator (main website https://www.viator.com/) HelloReco (main website https://www.helloreco.com/) Domains owned by companies for which TAMG only has a minority investment in. Including, but not limited to, traxo.com. If in doubt as to whether a target applies here, please create a submission asking if the particular app/target is in or out of scope. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

Tier 1 Targets (in scope)

Our main web application www.tripadvisor.com communicates with tier1 APIs for payment functionalities. There is no public documentation for the CDE API, but all endpoints can be discovered by interacting with payment functionalities on www.tripadvisor.com.

Tier 2 Targets (in scope)

You may use the following API key: adf6d1b8-0aca-4b0c-a492-50530aadd7aa You can see overview of our APIs at https://developer-tripadvisor.com/home/ Partner API documentation can be found at http://api.tripadvisor.com/api/partner/2.0/doc?key=adf6d1b8-0aca-4b0c-a492-50530aadd7aa

Tier 3 Targets (in scope)

Note that tamg.cloud subdomains that end with -sbx are sandbox (testing) projects. Normally, only test data flows through them therefore disclosing "sensitive" data on those is mostly not an issue in reality.

Tripadvisor Mobile (in scope)

The apps can be downloaded via Google Play for Android or the App Store for iOS.

Vacation Rentals (in scope)

Note that submissions for vacation rentals section are rewarded with points only, they are not eligible for bounties. IMPORTANT: Vacation Rentals has been sundowned. However, there might still be some leftovers. We encourage you to look for any vulnerability related to our systems!

Bokun (in scope)

Access and Guidelines Note that submissions for Bokun section are rewarded with points only, they are not eligible for bounties. Accounts You must be using “vulnscan” prefix in your vendor/supplier name when registering for an account for both types of scans (manual and/or automatic). Do not create an excessive number of accounts. Two accounts should be enough for testing the marketplace whereas a single account should be enough for any other intent or purpose. Types of scans Please focus on manual testing rather than using automated tools as the latter are already employed. Nevertheless, if you choose to ignore this advice and use automated tools, you must ensure the request rate to our systems does not exceed a 1 request per second. On top of that, we would also kindly ask you to use a HTTP Agent header which identifies such requests. Email us in advance ([email protected]) if you will be using an automated tool. Our working hours are mostly those in the UTC time zone. It is strictly forbidden to run automated or manual vulnerability testing on production systems (listed in "Out of scope" section below). Information on systems in scope Alias to this environment is “test”. Both external domains are just synonyms to the same service. There should be no difference between using either of them. Our test environment, hosted at extranet.bokuntest.com has virtually identical setup as prod component-wise. We use this environment to experiment with near-prod-ready code branches which are otherwise hard to simulate on local environments as well as for general test reasons. Note that this environment is also used by some of our customers which are businesses experimenting with API integrations and/or trying out our system in some other ways. Making changes to certain system elements might be visible for those customers (e.g. via Marketplace) and therefore we insist on following rules: Do not create an infinite amount of certain entities, e.g. vendor accounts. If you managed to find a gap where such entities are allowed to be created without reasonable limit, you must stop early and let us know Some of these entities are displayed for our customers in certain contexts. Refrain from profanity or other offensive language If you want to test illegal data access between different multi-tenant accounts (IDOR etc) please create accounts on your own without harnessing existing accounts Our system exposes the ability to have embeddable widgets. Widgets are publicly accessible resources and are made accessible via widget.bokuntest.com. Similar to this, we provide a public RESTful API via api.bokuntest.com. We’re happy to work with you in providing more details for how to create relevant entities and access these both endpoints. Alternatively, consult our helpdesk page as creating widgets / using API should hopefully not be too complicated.