Snapchat · Vulnerability Disclosure

Snapchat Vulnerability Disclosure

Vulnerability disclosure

Snap runs a public bug bounty on HackerOne and advertises it the correct way — an RFC 9116 security.txt served from snapchat.com whose Contact, Policy and Acknowledgements fields all resolve to the HackerOne program. The program is public-facing with a published hacktivity feed.

Snapchat runs a coordinated vulnerability disclosure program on Hackerone.

AdvertisingARAugmented RealityMarketingMessagingSocial-Media
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-13'
method: probed
source: https://snapchat.com/.well-known/security.txt
provider: Snapchat
providerId: snapchat
has_program: true
description: >-
  Snap runs a public bug bounty on HackerOne and advertises it the correct way — an RFC 9116
  security.txt served from snapchat.com whose Contact, Policy and Acknowledgements fields all
  resolve to the HackerOne program. The program is public-facing with a published hacktivity feed.
program:
  type: bug-bounty
  platform: HackerOne
  url: https://hackerone.com/snapchat
  policy: https://hackerone.com/snapchat
  hall_of_fame: https://hackerone.com/snapchat/hacktivity
  public: true
security_txt:
  url: https://snapchat.com/.well-known/security.txt
  http_status: 200
  file: ../well-known/snapchat-security.txt
  canonical: https://snapchat.com/.well-known/security.txt
  fields:
    Contact: https://hackerone.com/snapchat
    Acknowledgements: https://hackerone.com/snapchat/hacktivity
    Preferred-Languages: en
    Canonical: https://snapchat.com/.well-known/security.txt
    Policy: https://hackerone.com/snapchat
    Hiring: https://careers.snap.com
  rfc9116_gaps:
  - >-
    No Expires field. RFC 9116 makes Expires REQUIRED; without it a consumer cannot tell whether
    this file is still maintained.
  - No Encryption field (no PGP key advertised for confidential submissions).
  - >-
    Served only from snapchat.com. snap.com, developers.snap.com, adsapi.snapchat.com and
    accounts.snapchat.com all 404 on /.well-known/security.txt, so a researcher who lands on the
    corporate or developer domain is not routed to the program.
x-evidence:
  fetched: '2026-08-13'
  probes:
  - url: https://snapchat.com/.well-known/security.txt
    http_status: 200
  - url: https://snap.com/.well-known/security.txt
    http_status: 404
  - url: https://developers.snap.com/.well-known/security.txt
    http_status: 404
  - url: https://adsapi.snapchat.com/.well-known/security.txt
    http_status: 404
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com