TradingView Bug Bounty Program

If you want to let us know about a vulnerability, please submit a report via HackerOne.

The scope of the program

We offer rewards for reports that cover security vulnerabilities in our services, infrastructure, web and mobile applications such as:

TradingView.com as well as subdomains

Native iOS app

Native Android app

Charting Library and Trading Terminal

Rewards

Your reward will depend on the vulnerability discovered as well as its security impact. See details below.

up to^$1500

For a vulnerability that affects our entire platform

Remote code execution (RCE)
Gaining administrator access
Injections with a significant impact
Unrestricted access to local files or databases
Server-side request forgery (SSRF)
Critical information disclosure

up to^$700

For a vulnerability that doesn’t require user interaction and affects many users

Stored Cross-Site Scripting (XSS) with a significant impact
An authentication bypass that allows change of user data or access to private data
Insecure Direct Object References (IDOR)

up to^$300

For a vulnerability that requires user interaction or affects individual users

Cross-Site Scripting (XSS), except self-XSS
Cross-Site Request Forgery (CSRF)
URL redirection
User reputation manipulation

Note that reward amounts can be different. An actual reward may vary depending on the severity, genuineness and exploitation possibilities of bugs as well as the environment and other factors that affect security.

Vulnerabilities of auxiliary services such as Wiki, Blog etc. and vulnerabilities of non-production environments such as 'beta', 'staging', 'demo' etc. are rewarded only when they affect our service as a whole or may cause sensitive user data leakage.

You will need a PayPal ID as we use PayPal to issue rewards.

You will NOT receive a reward for the discovery of the following vulnerabilities:

You are not the first one to report this vulnerability;
Vulnerabilities in user's software or vulnerabilities that require full access to user’s software, account/s, email, phone etc.;
Vulnerabilities or leaks in third-party services;
Vulnerabilities or old versions of third party software/protocols, missed protection as well as a deviation from best practices that doesn’t create a security threat;
Vulnerabilities with no substantial security impact or exploitation possibility;
Vulnerabilities that require the user to perform unusual actions;
Disclosure of public or non-sensitive information;
Homograph attacks;
Vulnerabilities that require rooted, jailbroken or modified devices and applications.

Rules

Please be patient as reports are reviewed within two weeks and we sometimes require more time to fix the issue.
A bug report should include a detailed description of the discovered vulnerability and steps that need to be taken in order to reproduce it or a working proof-of-concept. If you do not describe vulnerability details then it could take a long time to review the report and/or could result in a rejection of your report.
You should not use automated tools and scanners to find vulnerabilities as such reports will be ignored.
You should not perform any attack that could damage our services or data including client data. DDoS, spam, brute force attacks are not permitted.
You should not involve other users without their explicit consent.
You should not perform or try to perform non-technical attacks such as social engineering, phishing or physical attacks against our employees, users or infrastructure in general.