Block (Square)
Financial services and digital payments company offering POS systems, Cash App, and Bitcoin services through Block Inc.
https://squareup.comMax Reward
$15,000
Total Paid
$1,700,000
Resolved
198
Avg Response
3 days
In-Scope Assets
squareup.com
Merchant dashboard and POS management
Square API
Payments, catalog, and inventory APIs
Cash App
P2P payments and Bitcoin trading
Square Mobile
POS and payment apps
Out of Scope
- ✕ Physical POS hardware
- ✕ TIDAL streaming
- ✕ Third-party app integrations
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (1)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| SQ-001 | Cash App payment interception via deep link hijacking | Critical | Open | $10,000–$15,000 | 0 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.