• $50 – $10,000 per vulnerability
  • Partial safe harbor
  • Managed by Bugcrowd

Program stats

1292 vulnerabilities rewarded

Validation within 3 days
75% of submissions are accepted or rejected within 3 days

$751.78 average payout (last 3 months)

Latest hall of famers

Recently joined this program

2620 total

Since 2004, Indeed has given job seekers free access to millions of jobs from thousands of company websites and job boards. As the leading pay-for-performance recruitment advertising network, Indeed drives millions of targeted applicants to jobs in every field and is the most cost-effective source of candidates for thousands of companies. We take our security very seriously and welcome any responsible disclosure of potential gaps in our systems. Please read through the following details to help you focus on the areas most important to us.

A Note on Similar Submissions:
We ask that researchers who are able to identify the same or similar types of issues in multiple locations across one of our applications combine those findings into a single submission that includes a description as well as the various locations where vulnerabilities have been identified. This greatly assists us in our triage process and allows us to process your submissions faster. The combined submissions will be evaluated holistically and will receive rewards corresponding to the collective findings. For example, if an application is discovered to have broken access control on a number of API endpoints, please submit a single submission that includes a list of those API endpoints. If separate submissions are made, they may be inadvertently closed as duplicates.

Some Helpful Tips for Your Testing

This bounty has a fairly explicit scope. It includes Indeed products from any of our mobile apps (Job search, employer apps, job spotter) on both iOS and Android, our core * web applications (see the focus areas below). There are case by case exceptions, such as previously untracked but Indeed created applications, but they will be rare.

For our mobile apps, a lack of obfuscation of code is not a vulnerability. Obscurity is not security; only a delaying tactic. For our purposes, we purposefully want to speed up the identification of real vulnerabilities. Many of our mobile app functions are just calls to the desktop site's HTTP endpoints, so running your test device through a web proxy will find most logic bugs.

All *, **, and indeed.[cctld] domains share the same code base (with very rare exceptions) and will therefore be rewarded only once. We are an international company with many different country TLDs running the same applications. For example:,,, etc. The only differences you should see would be language and different expected application flows.

For 3rd party applications, such as Wordpress, they will only be eligible for reward if there is action Indeed can take to mitigate issues identified, and if it's an action we weren't already going to make. A good example of something we wouldn't payout for is the output of WPScan showing recently out of date plugins, since regular patching is part of our WP management. An example of something we would payout for is a POC showing unintended behavior that isn't in a planned patch.

We do not typically accept vulnerabilities in third party applications that have Indeed branding (such as unless there is clear mitigation we can take without involving the 3rd party.

Indeed adheres to Bugcrowd's Vulnerability Rating Taxonomy for the prioritization of submissions but reserves the right to downgrade or upgrade ratings based on actual business impact. The payout scale is provided only to help set expectations, but is not binding. Reward is scaled by risk to Indeed, where risk is a combination of damage if abused, and ease of abuse.

Newly added in scope areas:


In scope areas:

  • (information on our APIs)

Out of Scope:

  • Security bugs in third-party websites that integrate with Indeed Apply
  • No attacks against Indeed’s existing user base (i.e. - job seekers, advertisers, and publishers). Instead, create your own job seeker, advertiser, and/or publisher account and perform research against those web applications.
  • Open redirects on
  • Any site or application not in scope.


When we are determining payout, the following descriptions are not meant to be absolute categorizations. Payout amount depends on potential damage to the business and clients, ease of abuse, and how much we can actually fix. Size of the user base, types of information the application holds, geographical operating environments are also considerations in the overall impact.

For those reasons, you will always want to provide:

  • An attack scenario: what is the most likely way an attacker actually abuses said vulnerability.
  • Clear reproduction steps: if we can't easily reproduce what you are describing, we may not consider the issue as serious.
  • Recommended fix: if you have any good ideas on ways to mitigate the risk without impacting normal users, your submission will have more value.
Priority Criticality Description Reward Amount
P1 CRITICAL Vulnerabilities that cause a privilege escalation on the platform from unprivileged to admin, allows remote code execution, etc. Examples: Remote Code Execution, Vertical Authentication bypass, XXE, User authentication bypass for backend systems. Up to $10000
P2 HIGH Vulnerabilities that affect the security of the platform including the processes it supports. Examples: Lateral authentication bypass, Stored XSS for another user, blind XSS into backend systems. Up to $4000
P3 MEDIUM Vulnerabilities that affect multiple users, and require little or no user interaction to trigger. Examples: Reflective XSS, Direct object reference, some CSRF depending on impact. Up to $1000
P4 LOW Issues that affect singular users and require interaction or significant prerequisites (MitM) to trigger. Examples: Common flaws, URL Redirect, Debug information, Mixed Content, most CSRF, Self-XSS, or vulnerabilities that require the victim to take multiple uncommon steps. Up to $200
P5 BIZ ACCEPTED RISK Non-exploitable weaknesses in functionality and “won’t fix” vulnerabilities. Examples: Best practices, mitigation, issues that are by design or deemed acceptable business risk to the customer such as use of Code Obfuscation, SSL Pinning, etc. $0

Program rules

This program follows Bugcrowd’s standard disclosure terms.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.

This bounty requires explicit permission to disclose the results of a submission.

  • Automated vulnerability scanning tools are strictly prohibited.
  • No attacks against Indeed’s existing user base (i.e. - job seekers, advertisers, and publishers).
  • Create your own job seeker, advertiser, and/or publisher account and perform research against those web applications.
  • Indeed regularly purges accounts that perform suspicious activities on our web properties. All accounts belonging to whitehat researchers should end in “+bugbounty” to prevent deletion. (e.g.

  • The following issues are not considered reward-able:
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt).
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms that are available to anonymous users (e.g. the contact form).
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Presence of application or web browser ‘autocomplete’ or ‘save password