Bumble
External Program
Submit bugs directly to this organization
Bumble
We reward security researchers for reporting impactful vulnerabilities affecting Bumble, Badoo, BFF (including Geneva), and related products.
Vulnerabilities are ranked based on real-world impact. Final severity and rewards are determined by the Bumble security team. We do not rely on rigid scoring systems—the more damage a vulnerability can realistically cause, the higher its severity.
We value high-quality, well-researched reports with clear proof of impact. Avoid duplicate submissions, copy-pasted reports, or reports without a working PoC. Respecting each other’s time helps us respond faster and reward impactful findings.
High-interest assets
For the full scope, please refer to the assets list.
Note: Geneva Web is a limited interface. Most impactful findings are in the mobile applications. If you cant access the staging applications listed in the programme due capacity being reached, please submit an informational ticket to the program asking for access to the latest APK.
Geneva staging credentials (OTP 000000 for both):
+1 880 999 0001+1 880 999 0009Information disclosure & inference issues When reporting inferred information (e.g. “Has this specific user liked me?”), consider:
Reports that do not demonstrate scalable access to information not otherwise obtainable via normal app use are typically closed as Informative or Not Applicable
These examples hopefully clarify some of the thinking when assigning risk.
| Severity | Example impact |
|---|---|
| Low | HTML injection or XSS that only affects page output with no meaningful user impact |
| Low | Cosmetic UI manipulation without data access or state change |
| Medium | SQL injection or logic flaw that alters application behaviour but does not expose user data |
| Medium | Limited unauthorised actions affecting a single account without escalation |
| High | Unauthorised access to sensitive user data |
| High | Modification of sensitive profile or account data |
| Critical | Account takeover |
| Critical | Scalable abuse impacting multiple users or systems |
Limit access to personal data strictly to what is necessary; All applicable data protection laws must be followed.
Public disclosure is generally not permitted; Exceptions may be granted on a case-by-case basis—please ask before publishing