X (Twitter)
Global social media platform for real-time conversations, news, and public discourse with 500M+ monthly active users.
https://x.comMax Reward
$20,000
Total Paid
$3,100,000
Resolved
423
Avg Response
4 days
In-Scope Assets
x.com
Web platform, timeline, and DMs
X API
REST API v2 and streaming endpoints
X Mobile
iOS and Android applications
X Spaces
Live audio conversations
Out of Scope
- ✕ Advertiser content
- ✕ Third-party clients
- ✕ Community Notes content
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| X-001 | DM content leakage via API pagination vulnerability | High | Open | $5,000–$15,000 | 0 |
| X-002 | Account suspension bypass via API parameter manipulation | Medium | In Review | $1,000–$5,000 | 1 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.