{"id":"85eb95a6-33cf-45d3-83d1-dbceeb46c423","engagementId":"00dbda04-aa2c-49a8-80dc-c78e23a6b470","data":{"brief":{"id":"1a8a6aea-b88a-40b2-a989-fc6b67879bae","name":"Block Open Source","tagline":"Block OSS projects from Square, Cash App, and Afterpay Github organizations","description":"\u003ch2\u003eBlock, Inc.\u003c/h2\u003e\n\n\u003cp\u003eThis program is part of Block, Inc. You can participate in our other bug bounty programs below:\u003c/p\u003e\n\n\u003cp\u003e\u003ca href=\"https://bugcrowd.com/square?preview=3b034fbb39b8f94910e4ae07720b1d7f\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSquare\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/cashapp?preview=741329c7a958c6d3ce61ac7970eb2ab7\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCash\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/tidal-bugbounty?preview=f39b37c04ea03ee111302f7ae385f67c\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTidal\u003c/a\u003e\u003cbr\u003e\n\u003ca href=\"https://bugcrowd.com/afterpay\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAfterpay\u003c/a\u003e\u003c/p\u003e\n\n\u003ch2\u003eRewarding security bugs in our open source projects\u003c/h2\u003e\n\n\u003cp\u003eBlock recognizes the important contributions the security research community can make. Part of keeping Block's customers safe is making sure that we find and fix any security issues in our open source projects. If you find any vulnerabilities in any of our participating open source projects, please submit a report. Even better, send us a fix!\u003c/p\u003e\n\n\u003cp\u003eThis program is to report issues in our open source projects. If you believe you have discovered a security vulnerability in one of Block's other product lines (squareup.com, square.com, cash.app, tidal.com, afterpay.com) or mobile applications (Square Point of Sale, Cash App, Tidal), please report them to the other bug bounty programs listed above.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAttributes of a good report\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eA well written, detailed explanation and proof-of-concept for the bug that’s easy to follow along.\u003c/li\u003e\n\u003cli\u003eInclude specific source code references for the issue from our GitHub organizations.\u003c/li\u003e\n\u003cli\u003eInclude repository, release version, branch and other information.\u003c/li\u003e\n\u003cli\u003eDescribe the real-world impact/exploitability of the bug.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eIneligible reports\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eIssues related to software that’s not within our control (such as external dependencies), not exploitable, and does not pose a significant risk to Block would not be eligible for a reward. \u003c/li\u003e\n\u003cli\u003eIssues relating to outdated or insecure library versions we include.\u003c/li\u003e\n\u003cli\u003eMost of our open source development is publicly visible. Reports related to an issue already being addressed in a branch or being tracked in a public way will therefore not be eligible for a bounty.\u003c/li\u003e\n\u003cli\u003eReports without a proof-of-concept or clear path to exploitation. \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRules of Engagement\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eBe sure to review the project’s README.md file for contributing guidelines before testing.\u003c/li\u003e\n\u003cli\u003eIf you are able to access or modify personal data of Block customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work.\u003c/li\u003e\n\u003cli\u003eDo not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples.\u003c/li\u003e\n\u003cli\u003eDo not attempt a denial-of-service attack.\u003c/li\u003e\n\u003cli\u003eDo not use ChatGPT, Claude, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms.\u003c/li\u003e\n\u003cli\u003ePlease contact support@bugcrowd.com for any escalations. Do not contact Block or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eHow to send a fix\u003c/h2\u003e\n\n\u003cp\u003ePlease do not open a pull request or GitHub ticket to fix an issue you're reporting. This would unnecessarily reveal any potential vulnerabilities. Instead, if you'd like to send us a fix, please submit a vulnerability report within the repository’s Security tab.\u003c/p\u003e\n\n\u003ch2\u003eRewards\u003c/h2\u003e\n\n\u003cp\u003eRewards range from $100 to $5,000 depending on the type of issue and impact. We prioritize and reward issues based on the real-world impact to our software and systems as operated by Block.\u003c/p\u003e","industryTagId":"6bf30795-7930-4c2b-bb79-d2c4f15f7740","targetsOverview":"\u003chr\u003e\n\n\u003ch2\u003eTarget information\u003c/h2\u003e\n\n\u003cp\u003eBlock maintains a set of Open Source Github Repositories that we consider to be in-scope for our Bug Bounty Program. In scope projects contain . a BUG-BOUNTY.md file in the root directory to specify they are in scope.\u003c/p\u003e\n\n\u003cp\u003eNote that we only reward issues found in the latest \u003ccode\u003emain\u003c/code\u003e branch or release of a project. Outdated releases, development branches, pull requests, or similar are excluded from the bounty.\u003c/p\u003e\n\n\u003cp\u003eCurrently, the projects in scope are:\u003c/p\u003e\n\n\u003ch3\u003eAfterpay\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/afterpay/sdk-ios\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esdk-ios\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/afterpay/sdk-android\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esdk-android\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCash App\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cashapp/cash-app-pay-ios-sdk\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecash-app-pay-ios-sdk\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cashapp/cash-app-pay-android-sdk\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecash-app-pay-android-sdk\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cashapp/hermit\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHermit\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cashapp/misk\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emisk\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eSquare\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/square/wire\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWire\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eDisclosure Procedures\u003c/h2\u003e\n\n\u003cp\u003eBlock recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eShare with us the full details of any problem found\u003c/li\u003e\n\u003cli\u003eDo not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us\u003c/li\u003e\n\u003cli\u003eDo not intentionally harm the experience or usefulness of the service to others\u003c/li\u003e\n\u003cli\u003eNever attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others\u003c/li\u003e\n\u003cli\u003eDo not attempt a denial-of-service attack\u003c/li\u003e\n\u003cli\u003eDo not perform any research or testing in violation of the law\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"a859ab02-a63f-4125-b3af-9fae8a654749","name":"████████","targets":[{"id":"ae4c8507-8b23-4d9b-84b4-eb81efb7b629","uri":null,"name":"███████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b5533fe6-5eef-4783-b1d0-812e2154588a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"660d4e0a-a00e-49cd-9332-d1730e0fdedc","uri":null,"name":"███████████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"145f478d-fc37-4d00-a11d-3534f3bfed50","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"48099c39-8f48-455c-9529-b725fd962f69","uri":null,"name":"███████████████████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9f84db2d-df56-4912-964c-2c839f4db75d","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null},{"id":"5b7df8af-aa70-4d73-9ca1-fb0e10e931f4","uri":null,"name":"███████████████████████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c0da8193-ab8f-4164-b8b0-1380b870f60d","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"f936225e-e83c-4a21-beb7-db9e0ba41f14","uri":null,"name":"█████████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0cf1bf63-a801-4059-8322-b585289967fa","sortOrder":4},"sortOrder":4,"tags":null,"recentChangeFlags":null},{"id":"b2e88fb0-594c-4b2f-9809-b30c413561da","uri":null,"name":"███████████████████████████████","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f98cb260-8007-40ad-8ed0-9ce1ac8e5b5e","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"03cef7f6-ca20-41a5-b47a-9b1ec0511e78","uri":null,"name":"██████████████████████████████","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d0ecd823-6eaf-4cc4-8c4e-57f6f501ef39","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"2f898824-f754-48e5-8582-32866a889537","p1MaxCents":500000,"p1MinCents":250000,"p2MaxCents":150000,"p2MinCents":100000,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"██████████████████████████████████████████████████████████████","rewardRangeData":{"1":{"min":2500,"max":5000},"2":{"min":1000,"max":1500},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"00dbda04-aa2c-49a8-80dc-c78e23a6b470","code":"blockopensource","state":"in_progress_paused","endsAt":null,"bountyId":"da25f60e-161b-4371-8b2a-37c3dac6eefe","startsAt":"2018-04-11T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Finance","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/30b7/fab9/adf339aa/a360c1a6f47998dc99a7b4d893c0fb31_block-jewel_white-on-black.jpg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":"This engagement is paused until further notice and will not reopen.","lastTransitionAt":"2026-10-01T05:59:39.578Z","cancellationReason":null,"statusLabel":"In progress paused","routesPaths":{"brief":"/engagements/blockopensource","changelogs":"/engagements/blockopensource/changelog","submissions":null,"announcements":"/engagements/blockopensource/announcements","hallOfFame":"/engagements/blockopensource/hall_of_fames","crowdstream":null},"announcementsCount":6,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":null,"methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=blockopensource\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/blockopensource/engagement_subscribers","engagementChangelogsUrl":"/engagements/blockopensource/changelog","publishedAt":"2026-10-01T05:59:39.609Z","engagementChangelogUrl":"/engagements/blockopensource/changelog/85eb95a6-33cf-45d3-83d1-dbceeb46c423","createUserFeedbacksUrl":"/engagements/blockopensource/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}