BugHunters — Bug Bounty Platform
    Back to Programs
    Spotify

    Spotify

    Streaming

    The world's most popular audio streaming service with 600M+ users, offering music, podcasts, and audiobooks.

    https://spotify.com

    Max Reward

    $15,000

    Total Paid

    $2,300,000

    Resolved

    287

    Avg Response

    3 days

    In-Scope Assets

    spotify.com

    Web player and account management

    Spotify API

    Web API, SDKs, and OAuth

    Spotify Desktop

    Desktop application and local files

    Spotify Mobile

    iOS and Android applications

    Out of Scope

    • ✕ Podcast content
    • ✕ Third-party integrations
    • ✕ Spotify for Artists analytics

    Severity Levels & Rewards

    Critical

    RCE, authentication bypass, privilege escalation, fund extraction

    High

    Stored XSS, CSRF with impact, API abuse, data manipulation

    Medium

    Reflected XSS, data leakage, logic flaws, information disclosure

    Low

    Verbose errors, minor config issues, low-impact info disclosure

    Active Bounties (1)

    IDTitleSeverityStatusRewardSubmissions
    SPOT-001Premium feature bypass via modified API client headers
    High
    Open
    		$3,000–$10,0000

    Rules of Engagement

    • Do not access, modify, or delete data belonging to other users.

    • Do not perform denial-of-service attacks or automated scanning at high volume.

    • Report vulnerabilities promptly and provide sufficient detail to reproduce.

    • Allow reasonable time for fix before public disclosure (90 days).

    • Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.