- Top reward
- $8,000
- Top severity paid
- Critical
- Assets in scope
- 83
- Public CVEs
- 2
- Last change
At a glance
What to know before you start testing.
- Pays up to $8,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$8,000 from $200 |
| High |
|
$4,000 from $150 |
| Medium |
|
$2,000 from $100 |
| Low |
|
$500 from $50 |
- Safe harbor
-
Full
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
83 assets you may test, 28 excluded.
APIs 40
- accounts.twilio.com Critical
- api.authy.com Critical
- api.segmentapis.com Critical
- api.segment.io Critical
- api.sendgrid.com Critical
- api.stytch.com Critical
- api.twilio.com Critical
- assistants.twilio.com Critical
- bulkexports.twilio.com Critical
- content.twilio.com Critical
- conversations.twilio.com Critical
- events.twilio.com Critical
- flex-api.twilio.com Critical
- frontline-api.twilio.com Critical
- iam.twilio.com Critical
- insights.twilio.com Critical
- intelligence.twilio.com Critical
- knowledge.twilio.com Critical
- lookups.twilio.com Critical
- management.stytch.com Critical
- marketplace.twilio.com Critical
- memory.twilio.com Critical
- messaging.twilio.com Critical
- monitor.twilio.com Critical
- notify.twilio.com Critical
- numbers.twilio.com Critical
- oauth.twilio.com Critical
- platform.segmentapis.com Critical
- preview.twilio.com Critical
- pricing.twilio.com Critical
- profile.segment.com Critical
- proxy.twilio.com Critical
- routes.twilio.com Critical
- serverless.twilio.com Critical
- studio.twilio.com Critical
- sync.twilio.com Critical
- taskrouter.twilio.com Critical
- telemetry.stytch.com Critical
- test.stytch.com Critical
- trunking.twilio.com Critical
Source code 21
- github.com/segmentio Critical
- github.com/sendgrid Critical
- github.com/stytchauth/is-agent Critical
- github.com/stytchauth/stytch-android Critical
- github.com/stytchauth/stytch-browser Critical
- github.com/stytchauth/stytch-dotnet Critical
- github.com/stytchauth/stytch-go Critical
- github.com/stytchauth/stytch-ios Critical
- github.com/stytchauth/stytch-ios-dfp Critical
- github.com/stytchauth/stytch-java Critical
- github.com/stytchauth/stytch-management-go Critical
- github.com/stytchauth/stytch-management-python Critical
- github.com/stytchauth/stytch-mobile Critical
- github.com/stytchauth/stytch-node Critical
- github.com/stytchauth/stytch-php Critical
- github.com/stytchauth/stytch-python Critical
- github.com/stytchauth/stytch-ruby Critical
- github.com/stytchauth/stytch-rust Critical
- github.com/stytchauth/terraform-provider-stytch Critical
- github.com/twilio Critical
- github.com/twilio-labs Critical
Web 17
- 1console.twilio.com Critical
- app.segment.com Critical
- app.sendgrid.com Critical
- blog.twilio.com Critical
- client.dev Critical
- connectedapps.dev Critical
- console.twilio.com Critical
- help.twilio.com Critical
- https://stytch.com/blog Critical
- https://stytch.com/dashboard Critical
- isagent.dev Critical
- mc.sendgrid.com Critical
- sendgrid.com Critical
- signup.sendgrid.com Critical
- smtp.sendgrid.net Critical
- tsock.us1.twilio.com Critical
- twilio.com Critical
Wildcard domains 2
- *.sip.*.twilio.com Critical
- static*.twilio.com Critical
Android apps 1
- com.authy.authy Critical
iOS apps 1
- com.authy Critical
Products and areas 1
- Any host/web property verified to be owned by Twilio et al. Critical
Out of scope (28)
- All Twilio acquisitions unless explicitly listed as in-scope
- github.com/stytchauth/sqx
- apjevents.twilio.com
- cdpweek.com
- chatagotchi.app
- click.sendgrid.com
- jobs.twilio.com
- js.stytch.com
- lab.authy.com
- partners.segment.com
- portal.partnerships.twilio.com
- signal.twilio.com
- status.segment.com
- status.sendgrid.com
- status.stytch.com
- status.twilio.com
- store.twilio.com
- support.sendgrid.com
- support.twilio.com
- surveys.twilio.com
- talks.twilio.com
- transform.twilio.com
- twil.io
- twiliotraining.com
- webinars.segment.com
- webinars.twilio.com
- web.stytch.com
- zipwhip.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Twilio (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
DDoS/DoS attacks (Network Level, Application Volumetric) are prohibited.
-
All automated testing should be throttled to prevent lockout.
-
Interacting with real customers is forbidden. Only test against accounts you have created.
-
Do not exfiltrate customer or employee data under any circumstance.
-
Please do not open support tickets with Twilio.
-
Do not use personal emails for testing.
-
Please submit a HackerOne report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.
Not accepted
-
Denial of service or Rate limiting issues, including Resource Exhaustion attacks
-
Forgot password auto-login
-
Login or Forgot Password page brute force attacks and account lockout not enforced
-
Non-existent or weak captcha / captcha bypass
-
Subdomain takeovers of TLD's used for demo or test purposes
-
All Wordpress-related findings
-
OpenVBX related findings
-
Email validation not enforced. DMARC and SPF submissions unless on major domains
-
SSL/TLS Issues such as: BEAST, BREACH, SSL insecure cipher suites enabled
-
Vulnerabilities that are limited to older/unsupported browsers
-
Known vulnerabilities in libraries used by Twilio, usage of an outdated third party library (e.g. jQuery, Apache etc.) unless you can prove exploitability
-
CORS or crossdomain.xml issues on api.segment.io without proof-of-concept
-
Dependency confusion attacks on public repositories
-
Vulnerabilities in archived public repositories
-
Vulnerabilities in public repos that have not had a commit in the last 2 years
-
S3 bucket takeover from docs or public repos, applies to all products
-
Broken link hijacking on old (documentation not maintained for 2+ years) or archived documentation
-
Hijacked Social media handles in the Twilio Blog that do not belong to Twilio
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
github.com/stytchauth/samlshield
-
Scope removed
https://github.com/stytchauth
-
Scope removed
Ytica and its assets (out of scope)
-
Scope removed
Twilio Quest (out of scope)
-
Scope added
1console.twilio.com
-
Scope removed
Twilio Wireless (out of scope)
-
Scope removed
All Twilio acquisitions until explicitly noted under the in-scope targets (out of scope)
-
Scope removed
https://www.twilio.com/docs/libraries
-
Scope removed
https://www.authy.com/download/
-
Scope removed
Twilio APIs
-
Scope removed
http://events.cdpweek.com (out of scope)
-
Scope removed
community.segment.com (out of scope)
-
Scope removed
All Kurento domains (out of scope)
-
Scope removed
https://segment.com/docs/connections/sources/
-
Scope removed
Electric Imp and its assets (out of scope)
-
Scope removed
TwimlBins (out of scope)
-
Scope removed
Third-party services (out of scope)
-
Reward terms
The reward table or payout terms were edited
-
Scope added
api.authy.com
-
Scope added
accounts.twilio.com
-
Scope added
All Twilio acquisitions unless explicitly listed as in-scope (out of scope)
-
Scope added
web.stytch.com (out of scope)
-
Scope added
content.twilio.com
-
Scope added
console.twilio.com
-
Scope added
conversations.twilio.com
-
Scope added
events.twilio.com
-
Scope added
flex-api.twilio.com
-
Scope added
frontline-api.twilio.com
-
Scope added
github.com/segmentio
-
Scope added
github.com/sendgrid
-
Scope added
status.stytch.com (out of scope)
-
Scope added
click.sendgrid.com (out of scope)
-
Scope added
connectedapps.dev
-
Scope added
com.authy.authy
-
Scope added
portal.partnerships.twilio.com (out of scope)
-
Scope added
com.authy
-
Scope added
github.com/stytchauth/stytch-management-go
-
Scope added
client.dev
-
Scope added
partners.segment.com (out of scope)
-
Scope added
chatagotchi.app (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-39891 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were | Medium 5.3 | 2 Jul 2024 |
| CVE-2020-24655 | A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement). | Medium 5.1 | 10 Sep 2020 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Twilio Security Disclosure Program Overview
Ensuring the security and integrity of the Twilio platform is critical to the service we provide to our customers. We are committed to providing a secure product and appreciate help from the community in responsibly identifying ways for us to improve Twilio. We will make an effort to respond as fast as possible.
Any place we reference Twilio, also applies to M&As such as but not limited to Sendgrid, Segment, and Authy. We will specify further when we intend a specific Product Target group. Bounties are awarded differently per product (see Target Groups for more details on payouts).
-
Bug Bounty Program: Our Bug Bounty Program through HackerOne is for experienced security researchers to identify and report vulnerabilities in our applications and internet-facing assets to earn rewards. Eligible findings may qualify for monetary bounties based on severity and impact. By participating, you help us strengthen our security while receiving recognition and compensation for contributions.
-
Vulnerability Disclosure Program: We are committed to the security and integrity of the Twilio platform and appreciate help from our community to identify and report vulnerabilities. Our Vulnerability Disclosure Program is open to you—whether you're a customer, professional security researcher (who does not meet the Bug Bounty Program requirements), or someone who has discovered a potential issue. While this program doesn't offer monetary rewards, your contribution is invaluable to us. Submit a vulnerability disclosure.
-
SendGrid abuse: If you would like to report abuse of SendGrid's service, please see our spam/phish reporting page.
-
For all other security based docs, requests, and more, please visit Twilio and Segment Trust Centers.
Bug Bounty Rules of Engagement
- Twilio expects all security researchers to follow the HackerOne Code of Conduct
- Please follow all account/credential/asset naming requirements in the Access and Account Requirements section.
- If you think you have found a problem but cannot prove it without accessing Twilio's Internal Systems, please submit your finding and we'll be happy to work with you for validation.
Prohibited behavior:
- DDoS/DoS attacks (Network Level, Application Volumetric) are prohibited. If you find a request that takes too long to answer, report it to HackerOne.
- Spam or phishing attacks are considered abuse and out of scope.
- All automated testing should be throttled to prevent lockout.
- Interacting with real customers is forbidden. Only test against accounts you have created.
- Do not exfiltrate customer or employee data under any circumstance. Please contact us immediately if you think this is possible, or you have done so inadvertently. We will work with you to assess the full impact of the vulnerability and award appropriately.
- Please do not open support tickets with Twilio. If you have any technical issues or questions, work with us through HackerOne Support.
- Do not use personal emails for testing.
For the initial prioritization/rating of findings, this program will use the HackerOne Report Severity. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact.
NOTE: If a submission has a significant impact, bounty may be increased at Twilio’s discretion.
Access and Account Requirements
| Requirement | Description |
|---|---|
| Accounts | Register with your @wearehackerone.com email address |
| Assets including Segment workspaces | hackerone-- |
| POCs including npm packages | twilio-hackerone-poc- Note: They should be deleted once the submission is triaged. |
| Custom Request Header | X-Bug-Bounty: -twilio |
| Segment specific | Please see the Segment target section for more specific Segment related details. |
- We cannot provide any credits at this time and accounts will not be provisioned by Twilio. Any elevated features must be purchased by Security Researchers. This may be revisited for specific scenarios.
Excluded Submission Types for All Target Groups
Please do not submit contact forms, create support tickets, send emails, etc. that will generate work for a human outside of the Twilio security team.
Twilio et.al. uses a number of third-party providers and services. Our bug bounty program does not give you permission to perform security testing on their systems.
Please contact HackerOne support if you discover anything critical that falls in this area. We may consider reports on a case-by-case basis.
- Denial of service or Rate limiting issues, including Resource Exhaustion attacks
- Authentication weaknesses related to:
- "Session too long," password reset/change logout or other intended business functionality
- Forgot password auto-login
- Login or Forgot Password page brute force attacks and account lockout not enforced
- Non-existent or weak captcha / captcha bypass
- Subdomain takeovers related to:
- Subdomain takeovers of TLD's used for demo or test purposes
- Malicious links created as part of SendGrid's click and open tracking such as *.sendgrid.net, click.sendgrid.com, and email.sendgrid.com
- All Wordpress-related findings
- OpenVBX related findings
- Email validation not enforced. DMARC and SPF submissions unless on major domains
- SSL/TLS Issues such as: BEAST, BREACH, SSL insecure cipher suites enabled
- Vulnerabilities that are limited to older/unsupported browsers
- Known vulnerabilities in libraries used by Twilio, usage of an outdated third party library (e.g. jQuery, Apache etc.) unless you can prove exploitability
- CORS or crossdomain.xml issues on api.segment.io without proof-of-concept
- Public repository or documentation vulnerabilities that fall under:
- Note: These exclusions apply in addition to all of the above.
- Dependency confusion attacks on public repositories. They may be considered on maintained, heavily used libraries
- Vulnerabilities in archived public repositories
- Vulnerabilities in public repos that have not had a commit in the last 2 years
- S3 bucket takeover from docs or public repos, applies to all products
- Broken link hijacking on old (documentation not maintained for 2+ years) or archived documentation
- Hijacked Social media handles in the Twilio Blog that do not belong to Twilio will be treated as Informational findings
- Sandboxed Function Code Execution: Remote code execution or AWS credential exposure originating from within Twilio Functions or Segment Functions sandboxed runtimes is out of scope.
- These functions execute in isolated, short-lived Lambda environments with minimal IAM permissions. Obtaining a shell or exfiltrating the runtime AWS credentials does not constitute a meaningful security impact.
- How to identify sandbox environments:
- Segment Functions: AWS role ARN contains
funk-runner. - Twilio Functions: AWS role ARN containes
lambda-role-execution,ZB<Function_ID>or the username starts withsbx_user.
- Segment Functions: AWS role ARN contains
- If you believe you have escaped the sandbox (e.g. accessed resources beyond the function's intended scope, pivoted to another account or reached internal services), we will triage it as usual.
Submission Template
Please include the following information with your submission:
- Description: Provide a detailed description of the vulnerability
- Steps to Reproduce: Step-by-step information on how to reproduce
- Proof of Concept: Screenshots or video
- Impact: Business Impact - How does it affect Twilio?
- Exploitability: How likely is this to be discovered and exploited?
- Recommendations & References (Optional)
PII, Customer and Employee data
As mentioned under our Rules of Engagement: do not exfiltrate customer or employee data under any circumstance. Please contact us immediately if you think this is possible, or you have done so inadvertently. We will validate internally and work with you to assess the full impact of the vulnerability.
Leaked employee credentials and employee API keys will be rewarded appropriately.
Compliance
Please note that researchers must comply with our rules of engagement, including rate limit tests and DoS tests. Twilio may ban accounts for suspicious behavior in accordance with our policies and processes . Please do not open up a support ticket with Twilio, but instead create a ticket with HackerOne Support for assistance. Twilio may unban accounts but only at Twilio’s discretion.
Similar Bugs
Reports from a single researcher for similar bugs that involve one fix may be merged and receive a single reward. This will be done at the discretion of Twilio.
Twilio Acquisitions
Unless specifically listed In Scope, all Twilio acquisitions are out of scope. When in doubt, please create a ticket with HackerOne Support with any questions.
Public Disclosure
Twilio does not permit public disclosure at this point in time. Exceptions will be made when the Twilio Security team decides to publish a CVE for vulnerabilities identified in desktop apps, mobile apps and SDKs based on the severity of the identified issue. In case a CVE is published, we will reach out to the researcher for permission before mentioning them. The vulnerability will be mentioned here.
Third Party Disclosure
Twilio follows an internal process when a vulnerability is reported to us turns out to be an issue with a third party’s technology, devices, or process.
If we are aware that the third party has a security disclosure program, we will recommend the researcher submit their report directly to that Third Party. If not, at Twilio’s discretion, Twilio will use commercially reasonable efforts to report the discovered vulnerabilities to the affected third party directly.
Twilio Safe Harbor
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act. To the extent your activities are inconsistent with certain restrictions in our Acceptable Use Policy, we waive those restrictions for the limited purpose of permitting security research under this policy. We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope.
If legal action is initiated by a third party against you and you have complied with Twilio's bug bounty policy, Twilio will take steps to make it known that your actions were conducted in compliance with this policy. In the event that you engage in conduct that is inconsistent with or unaddressed by this policy, you must submit a HackerOne report prior to engaging in such conduct. Your submission will allow us to evaluate such conduct.
Please submit a HackerOne report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.