Ibotta Vulnerability Disclosure

generated: '2026-08-12'
method: searched
source: https://hackerone.com/ibotta + https://bugcrowd.com/ibotta
summary: >-
  Ibotta runs coordinated vulnerability disclosure on two platforms — a HackerOne program and a
  Bugcrowd bug bounty — but does NOT advertise either at /.well-known/security.txt on any
  Ibotta host, so a scanner following RFC 9116 finds nothing.
programs:
- platform: HackerOne
  url: https://hackerone.com/ibotta
  kind: vulnerability-disclosure
  http_status: 200
  verified: >-
    Program handle resolves (HTTP 200); a control request to
    https://hackerone.com/zzz-not-a-real-program-xyz returns 404, so the 200 is a real program
    page and not a catch-all. Page body is JS-rendered, so policy text was not machine-captured.
- platform: Bugcrowd
  url: https://bugcrowd.com/ibotta
  kind: bug-bounty
  http_status: 200
  page_title: 'Bug Bounty: Ibotta - Bugcrowd'
  disclosure_allowed: false
  verified: >-
    Program page resolves (HTTP 200) with an Ibotta-specific <title>; a control request to
    https://bugcrowd.com/zzz-not-a-real-program-xyz returns 404 ("Resource not found -
    Crowdcontrol"). Program does not permit public disclosure of findings; P5/informational
    submissions are not rewarded.
security_txt:
  served: false
  probes:
  - url: https://ibotta.com/.well-known/security.txt
    status: 200
    note: SPA catch-all HTML shell, not a security.txt document.
  - url: https://home.ibotta.com/.well-known/security.txt
    status: 404
  - url: https://ipn.ibotta.com/.well-known/security.txt
    status: 404
  - url: https://api.ibotta.com/.well-known/security.txt
    status: 404
  - url: https://auth.dashboard.ibotta.com/.well-known/security.txt
    status: 404
recommendation: >-
  Publish an RFC 9116 /.well-known/security.txt on ibotta.com and api.ibotta.com with
  Policy: https://hackerone.com/ibotta and a Contact: mailto: address. The program already
  exists; only the discovery document is missing.