Introduction

With 30 million global users, Linktree is helping brands, artists, publishers, agencies and influencers better control their presence online. The security of our platform is more important than ever, and we believe the global security community is a big part of that.

The scope for Linktree's Bug Bounty program is inclusive of most of our assets. If you find something that would be impactful to our users, we want to hear about it.

Your participation in our Bug Bounty Program is voluntary. By submitting a report or otherwise disclosing a vulnerability to us (making a “Submission”), you are indicating that you have read and agree to follow the rules set forth on this page (“Program Terms”).

---

Program Status

We have placed the program temporarily on hold to allow us time to manage all the reports submitted over the holiday period. We thank you for your patience at this time, and we look forward to future submissions.

---

Response Targets

Linktree will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll keep you informed about our progress through each stage of response.

---

Disclosure Policy

• Please do not discuss any vulnerabilities (even resolved ones) outside of the program without consent from the Linktree team unless they are made public. We intend to make all reports public unless there is a compelling reason not to.
• Follow HackerOne's disclosure guidelines and we will do the same.
• To qualify for disclosure the report has to be in Resolved state, and raised by you
• Disclosed reports will be in limited state by default unless full disclosure is deemed necessary by Linktree
• We appreciate your help and promise to treat you as a friend and ally as long as you act in good faith.

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Do not access, impact, destroy or otherwise negatively impact Linktree customers, or customer data in anyway.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Respect our users’ privacy.

• No extortion, shake downs, or duress.

• Don’t leave any system in a more vulnerable state than you found it.

• Be respectful when interacting on reports with our team.

• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

• When a vulnerability consists of different parameters but having the same api endpoint please group this together in the same report.

• When a vulnerability is occurs to a third party integration (such as PayPal, etc) we will treat all reports as a single report

• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

• Social engineering of in-product support is allowed. Social engineer through other channels is not allowed.

• Access control bypass issues in link lock features pointing to public content are classified as Low severity.

• Deleted assets/items that are still accessible are classified as Low severity.

• Cross-Site Scripting (XSS) attacks are considered at maximum a Medium severity.

• Obtaining access to individual paid features for Free accounts are classified as Low severity

• Sub-domain takeovers are considered at maximum a Medium severity.

---

Test Plan

• You can sign up for a free Linktree account with this link: https://linktr.ee/register.
• You can also sign up for a one month free trial of any plan (not including Premium) with your @wearehackerone.com email alias via this link: https://linktr.ee/register?couponId=BUGBOUNTY30FREE
• Free accounts give you access to limited features while you will have more privileges with a Start, or Pro account. A list of accessible features is provided here: https://linktr.ee/s/pricing/pricing-comparison/

---

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions
• Tabnabbing on Android or iPhone app(s) on content not relating to sensitive actions or data
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with non-sensitive actions.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or brute-force issues on non-authentication endpoints.
• Missing HttpOnly or Secure flags on cookies.
• Vulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version]).
• Software version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application or server errors).
• Public zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
• Tabnabbing
• Issues that require unlikely user interaction
• Issues related to identifying if someone is a free or pro user
• Act's of self sabotage (such as making a linktree inaccessible) as owner or admin of Linktree account are out of scope

---

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Linktree and our users safe!