Snapchat · Vulnerability Disclosure

Snapchat Vulnerability Disclosure

Vulnerability disclosure

Snap runs a public bug bounty on HackerOne and advertises it the correct way — an RFC 9116 security.txt served from snapchat.com whose Contact, Policy and Acknowledgements fields all resolve to the HackerOne program. The program is public-facing with a published hacktivity feed.

Snapchat runs a coordinated vulnerability disclosure program on Hackerone.

AdvertisingARAugmented RealityMarketingMessagingSocial-Media
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-13'
method: probed
source: https://snapchat.com/.well-known/security.txt
provider: Snapchat
providerId: snapchat
has_program: true
description: >-
  Snap runs a public bug bounty on HackerOne and advertises it the correct way — an RFC 9116
  security.txt served from snapchat.com whose Contact, Policy and Acknowledgements fields all
  resolve to the HackerOne program. The program is public-facing with a published hacktivity feed.
program:
  type: bug-bounty
  platform: HackerOne
  url: https://hackerone.com/snapchat
  policy: https://hackerone.com/snapchat
  hall_of_fame: https://hackerone.com/snapchat/hacktivity
  public: true
security_txt:
  url: https://snapchat.com/.well-known/security.txt
  http_status: 200
  file: ../well-known/snapchat-security.txt
  canonical: https://snapchat.com/.well-known/security.txt
  fields:
    Contact: https://hackerone.com/snapchat
    Acknowledgements: https://hackerone.com/snapchat/hacktivity
    Preferred-Languages: en
    Canonical: https://snapchat.com/.well-known/security.txt
    Policy: https://hackerone.com/snapchat
    Hiring: https://careers.snap.com
  rfc9116_gaps:
  - >-
    No Expires field. RFC 9116 makes Expires REQUIRED; without it a consumer cannot tell whether
    this file is still maintained.
  - No Encryption field (no PGP key advertised for confidential submissions).
  - >-
    Served only from snapchat.com. snap.com, developers.snap.com, adsapi.snapchat.com and
    accounts.snapchat.com all 404 on /.well-known/security.txt, so a researcher who lands on the
    corporate or developer domain is not routed to the program.
x-evidence:
  fetched: '2026-08-13'
  probes:
  - url: https://snapchat.com/.well-known/security.txt
    http_status: 200
  - url: https://snap.com/.well-known/security.txt
    http_status: 404
  - url: https://developers.snap.com/.well-known/security.txt
    http_status: 404
  - url: https://adsapi.snapchat.com/.well-known/security.txt
    http_status: 404
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/snapchat-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.