TikTok
External Program
Submit bugs directly to this organization
TikTok
#TikTok Bug Bounty Program Policy TikTok's mission is to inspire creativity and bring joy to our vibrant community. We recognize and value external feedback from the global security research community on potential vulnerabilities which helps strengthen our overall platform security posture. Before submitting a vulnerability report, please review our program policy and terms. We appreciate your contribution and thank you for helping make TikTok a safer place for our community!
#General Program Terms By participating in the program, you agree that you are bound by and subject to this policy. By submitting a vulnerability or other report to us, you grant to us, our subsidiaries and its affiliates, a perpetual, irrevocable, royalty free license to all intellectual property rights licensable by you in or related to the use of this material. You agree that no third party rights are involved in your report and you have all rights to submit such a report. We may modify the terms of this policy or terminate the policy at any time.
By submitting a report, you agree that materials will be shared with TikTok USDS Joint Venture LLC for independent triage, audit, verification, and patching based on impact to systems in the United States.
If you do not comply with this policy or if we determine that your participation in the program is not in good faith or could adversely impact us, our affiliates, or our business partners (or any of our or their users, employees, or contractors), we, in our sole discretion, may remove you from the program and disqualify you from receiving any reward under the program.
Example: Do not generate millions of fraudulent "likes" for your own videos#SSRF Testing Rules
Please see below for the usage of SSRF Sheriff:
Test SSRF only with the following payload
Check if your SSRF was successful with the SSRF Flag with the following URL
PS: The "Flag" used here is a 32 character-long hex string in lowercase, which works as a unique identifier for our sheriff to validate SSRF request
** Please note that this SSRF Sheriff should only be used for SSRF vulnerability testing and PoC development purposes. Any kind of attack / exploitation on this SSRF Sheriff service is strictly prohibited.**
#Testing Notes
#Asset Priorities Vulnerabilities will be evaluated based on impact to TikTok systems and certain assets may be of higher impact.
We currently consider the following assets to be of greater interest:
TikTok supports public recognition and disclosure of contributions and findings for in-scope reports closed as resolved. We will seek to allow participants to be publicly recognized whenever possible.
If requesting beyond a HackerOne disclosure (e.g. in a blog or at a conference):
| Vulnerability | Severity |
|---|---|
| Remote Code Execution, Command injection, shell upload | Critical |
| SQL Injection, XML External Entity Injection (XXE), Command injection, unsafe deserialization, exploitable memory corruption | High - Critical |
| Leaked Credential, Cryptographic flaw | Medium - High |
| Cross-Site Scripting (XSS) | Medium - High |
| Server-Side Request Forgery | Medium - High |
| Directory Traversal | Medium - High |
| Authentication/Authorization Bypass (Broken Access Control) | Medium - High |
| File Inclusion | Medium - Critical |
| Insecure Direct Object Reference | Medium - Critical |
| Misconfiguration/ Open Redirect | Low - Medium |
| CRLF Injection | Low - Medium |
| Cross Site Request Forgery | Low - High |
| Information Disclosure | Low - Medium |
| Subdomain takeover | Medium - High |
| XSS on harmless subdomains, attacks requiring unlikely user interaction | Low - Medium |
| All blind SSRF vulnerabilities that include a valid sheriff flag and a stable, reproducible proof of concept (PoC) | Low |
High-quality reports may be awarded an extra bonus. A high-quality report is a thoroughly written vulnerability report that includes (when applicable) a working proof-of-concept, root cause analysis, a suggested fix, and any other relevant information. We also ask that researchers be responsive and collaborative which helps us efficiently implement and deliver fixes in a timely manner.
The criteria used to determine reward amount, bonuses, and eligibility are solely at our discretion.
#Program Exclusions When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) potential security impact of the bug. The following issues are considered out of scope:
Please note that these known issues will not be accepted:
We are working on a fix for the above issues and seek your kind patience.
To encourage good faith research and responsible disclosure of security vulnerabilities, we will not threaten or bring legal action against what we determine to be accidental or good faith violation of this policy. This includes claims under the DMCA for circumventing technological measures to protect the services and applications eligible under this policy.
To the extent your security research activities are inconsistent with certain restrictions in our relevant site policies but are consistent with the terms of our bug bounty program, we may waive those restrictions for the sole and limited purpose of permitting good faith security research under this bug bounty program.
If your security research involves the networks, systems, information, applications, products, or services of a third party, including any TikTok users, we cannot bind that third party, and they may pursue legal action or law enforcement notice. We cannot, and do not, authorize security research in the name of other entities or individuals, and cannot in any way offer to defend, indemnify, or otherwise protect you from any third party action based on your actions.
You must, as always, comply with all laws applicable to you, and not disrupt or compromise any data beyond what our bug bounty program permits.
Be proactive in contacting us before engaging in any action that may violate or is unaddressed by this policy or good faith. We reserve the sole right to determine whether a violation of this policy is accidental or in good faith.