Policy and restrictions
Use owned test accounts; do not access other users’ private data. No disruption, social engineering, physical intrusion or brute force. Scanner-only reports, unlisted properties and planned-deprecation products are excluded. Public disclosure requires written permission after report closure.
Eligibility and submission status
An Intigriti account, first reporting, demonstrable impact and privacy compliance are required. Duplicate root causes generally receive one reward; alpha/beta findings may pay less. Sanctions apply. Platform terms require adulthood or age 16 with guardian permission, company validation and identity checks.
The public page describes account-based submission but has no explicit current open/paused label. Availability is not inferred from recent activity.
Advertised rewards
Displayed tiers span $100–$15,000, $100–$10,000 and $100–$7,500. Dollar denomination is unverified; normalized amounts remain null. A discretionary $25 delayed-validation bonus is advertised. Business-only issues may receive a low-severity reward if fixed. These are guidelines, not awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
Dropbox.comPublished location: http://Dropbox.com | URL | Tier 1 |
sign.dropbox.comPublished location: http://sign.dropbox.com | URL | Tier 1 |
HelloSign.comPublished location: http://HelloSign.com | URL | Tier 1 |
dash.aiPublished location: http://dash.ai | URL | Tier 1 |
dash.dropbox.com | Other | Tier 1 |
api.dropbox.comPublished location: http://api.dropbox.com | URL | Tier 1 |
Dropbox Desktop Application | Other | Tier 2 |
327630330Published location: https://apps.apple.com/app/327630330 | iOS | Tier 2 |
6450553960Published location: https://apps.apple.com/app/6450553960 | iOS | Tier 2 |
1080074001Published location: https://apps.apple.com/app/1080074001 | iOS | Tier 2 |
com.dropbox.dashPublished location: https://play.google.com/store/apps/details?id=com.dropbox.dash | Android | Tier 2 |
com.dropbox.androidPublished location: https://play.google.com/store/apps/details?id=com.dropbox.android | Android | Tier 2 |
HelloFax.comPublished location: http://HelloFax.com | URL | Tier 2 |
docsend.comPublished location: http://docsend.com | URL | Tier 2 |
app.Reclaim.aiPublished location: http://app.Reclaim.ai | URL | Tier 2 |
dropbox.com/paperPublished location: http://dropbox.com/paper | URL | Tier 2 |
*.dropbox.com | Wildcard | Tier 3 |
*.dropboxer.net | Wildcard | Tier 3 |
*.dropboxforum.com | Wildcard | Tier 3 |
*.dropboxpartners.com | Wildcard | Tier 3 |
*.hellofax.com | Wildcard | Tier 3 |
*.docsend.com | Wildcard | Tier 3 |
*.reclaim.ai | Wildcard | Tier 3 |
*.helloworks.com | Wildcard | Tier 3 |
*.hellosign.com | Wildcard | Tier 3 |
*.dash.ai | Wildcard | Tier 3 |
| Asset | Type | Group / eligibility |
|---|---|---|
community.dropbox.comPublished location: http://community.dropbox.com | URL | |
replay.dropbox.comPublished location: http://replay.dropbox.com | URL | |
Boxcryptor | Other | |
Formswift | Other | |
Dropbox Passwords | Other | |
Dropbox Capture Windows Desktop App | Other | |
Dropbox Capture macOS Desktop App | Other | |
com.dropbox.paperPublished location: https://play.google.com/store/apps/details?id=com.dropbox.paper | Android | |
1126623662Published location: https://apps.apple.com/app/1126623662 | iOS |
Review limitations
- The updates page includes a November 24, 2025 scope-policy clarification. It is an announcements/changes index, not an exhaustive version history or full-policy revision date.
- Platform terms default payments to euros unless otherwise agreed; that does not establish the denomination of the displayed dollar amounts.
- The page labels safe harbor as applied, but expanded program-specific terms and authenticated eligibility were not inspected.
- Public policy review only. Asset inventories and operational instructions are omitted. Live terms prevail; this summary grants no authorization.
Sources and provenance
- Dropbox Bug Bounty public policy Dropbox / Intigriti · reviewed 2026-10-03
- Dropbox Bug Bounty official updates Dropbox / Intigriti · reviewed 2026-10-03
- Intigriti Researcher Terms & Conditions Intigriti · reviewed 2026-10-03
- Published Intigriti asset table Dropbox · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.