Policy and restrictions
Only expressly listed properties qualify. Protect production stability and use owned accounts and transactions; interaction with real members is prohibited. No high-volume scanning, disruption, social engineering or data enumeration. Low-impact and scanner-only findings are excluded. Disclosure requires permission; safe harbor is conditional.
Eligibility and submission status
Public participation without invitation began September 30, 2026. Researcher-identified accounts, original human analysis and reproducible impact are required. Confirmed deletion of acquired member data is a reward condition. Platform first-valid-report rules apply; monetary compensation requires age 18 or the applicable age of majority.
The official brief explicitly displays In progress and an ongoing period, with a submission link. Individual eligibility remains subject to live terms.
Advertised rewards
Primary-category guidelines advertise $75–$4,000; secondary-category guidelines $100–$800. Business impact can change priority or payout, with an appeal route. These are advertised schedules, not awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
www.vinted.comPublished location: https://www.vinted.com | website | Primary Target Group |
www.vinted.netPublished location: https://www.vinted.net | website | Primary Target Group |
www.vintedgo.comPublished location: https://www.vintedgo.com | website | Primary Target Group |
Vinted iOS applicationPublished location: https://apps.apple.com/us/app/vinted-pre-loved-marketplace/id632064380 | ios | Primary Target Group |
Vinted Android applicationPublished location: https://play.google.com/store/apps/details?id=fr.vinted | android | Primary Target Group |
Vinted Go SandboxPublished location: https://sandbox.vintedgo.com | website | Secondary Target Group |
Vinted SandboxPublished location: https://sandbox.vinted.com | website | Secondary Target Group |
Vinted Go Escalations testPublished location: https://test-escalations.vintedgo.com | website | Secondary Target Group |
Encryption ServicePublished location: https://badger.it.vinted.com | website | Secondary Target Group |
Vinted CareersPublished location: https://careers.vinted.com | website | Secondary Target Group |
Company VintedPublished location: https://company.vinted.com | website | Secondary Target Group |
News VintedPublished location: https://news.vinted.com | website | Secondary Target Group |
| Asset | Type | Group / eligibility |
|---|---|---|
| No rows captured. This does not establish that the program has no assets or restrictions. | ||
Review limitations
- Brief and change index show September 30, 2026 as the latest revision. The sole announcement was opened and confirms public participation.
- Change-index entries were reviewed, not individual version diffs. The brief welcomes newly disclosed issues case by case but normally excludes bounties within 14 days of a public patch.
- USD normalization uses platform accounting documentation; the brief itself uses dollar signs. No individual award or payment is established.
- Public policy pages only; authenticated submission and incorporated legal documents were not exhaustively reviewed. Asset inventories and testing instructions are omitted. Live terms prevail; this summary grants no authorization.
Sources and provenance
- Vinted Bug Bounty public brief Vinted / Bugcrowd · reviewed 2026-10-03
- Vinted Bug Bounty announcements Vinted / Bugcrowd · reviewed 2026-10-03
- Vinted Bug Bounty change index Vinted / Bugcrowd · reviewed 2026-10-03
- Bugcrowd Organization Accounting Bugcrowd · reviewed 2026-10-03
- Bugcrowd Standard Disclosure Terms Bugcrowd · reviewed 2026-10-03
- Published Bugcrowd scope groups Vinted · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.