Hootsuite Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://www.hootsuite.com/security
probe: true
http_status: 200
program:
  published: true
  name: Hootsuite Information Security Bug Bounty program
  type: self-run
  platform: null
  platform_note: >-
    Hootsuite runs the program itself by email. It is NOT hosted on HackerOne, Bugcrowd or
    Intigriti. Intigriti appears on the page only as an outbound link to the Intigriti Hackademy
    report-writing guide, and a naive keyword probe reads that as platform adoption - it is not.
  contact: hootsec@hootsuite.com
  submission_channel: email
  policy_url: https://www.hootsuite.com/security
  security_txt: false
  security_txt_note: >-
    No /.well-known/security.txt is served on hootsuite.com, www.hootsuite.com,
    platform.hootsuite.com or developer.hootsuite.com - all four return 404. The program exists but
    is not machine-discoverable, so an automated scanner finds nothing.
  triage_sla: up to 5 business days to triage and assign severity
  safe_harbour_stated: false
rewards:
  currency: CAD
  form: Amazon eGift Card (researcher chooses the storefront domain)
  tiers:
  - severity: critical
    amount: 100
  - severity: high
    amount: 75
  - severity: medium
    amount: 50
  - severity: low
    amount: 0
    note: No reward offered for low-severity issues.
  recognition: >-
    Hall of Fame listing offered for medium, high and critical findings.
  duplicates: No reward if Hootsuite is already aware of the issue.
requirements:
- Findings must be reproducible and not self-exploitation.
- Submissions must include title, description, location (product module/page) and steps.
- Researchers are asked not to share or publish an unresolved vulnerability with third parties.
out_of_scope:
- Header misconfigurations or missing security headers without evidence of the ability to target a
  remote victim
- Unclaimed social media accounts, or links/domains that merely look similar to Hootsuite
- DMARC/SPF issues
- Issues related to TLS/SSL versions
- Information or credentials obtained from pre-existing data breaches or publicly leaked sources
- Single-account incidents (routed to Hootsuite Help instead)
report_template:
  published: true
  note: >-
    The page ships a worked report template (an XSS example with title format, CVSS v4.0 severity,
    description, proof of concept), which is unusually developer-friendly for a self-run program.
evidence:
- source: https://www.hootsuite.com/security
  http_status: 200
  kind: disclosure page
  quotes:
  - >-
    "We take security very seriously at Hootsuite, and have an Information Security Bug Bounty
    program geared towards the identification and remediation of security issues."
  - '"If you are interested in submitting your findings for review, please email hootsec@hootsuite.com."'
- source: https://www.hootsuite.com/.well-known/security.txt
  http_status: 404
- source: https://platform.hootsuite.com/.well-known/security.txt
  http_status: 404