Bug Bounty Weekly Digest - June 2026, Week 23
Five active, well-funded bug bounty programs across major platforms including Shopify, GitLab, PayPal, Spotify, and Snapchat. Programs offer rewards ranging from hundreds to hundreds of thousands of dollars for valid vulnerability reports.
Shopify
Platform: HackerOne
Scope: Shopify's core e-commerce platform, admin panel, checkout systems, Shop app, and related infrastructure. Excludes third-party apps in the Shopify App Store and social engineering attacks.
Payout Range: $500 - $50,000+ depending on severity and impact. Critical vulnerabilities in payment processing or merchant data access command top-tier rewards.
Program Link: https://hackerone.com/shopify
GitLab
Platform: HackerOne
Scope: GitLab.com (SaaS platform), self-managed GitLab instances, CI/CD pipeline security, repository management, and authentication systems. Focus on RCE, authentication bypass, and data exposure vulnerabilities.
Payout Range: $100 - $20,000+ with bonuses for exceptional reports. Critical findings in core version control or CI/CD systems are prioritized.
Program Link: https://hackerone.com/gitlab
PayPal
Platform: HackerOne
Scope: PayPal.com, Venmo, Braintree payment gateway, Honey shopping platform, and associated APIs. Emphasis on payment bypass, account takeover, and financial fraud vulnerabilities.
Payout Range: $50 - $30,000+ for critical vulnerabilities. Payment manipulation and authentication bypass receive highest rewards.
Program Link: https://hackerone.com/paypal
Spotify
Platform: HackerOne
Scope: Spotify web player, mobile applications (iOS/Android), desktop clients, APIs, and backend infrastructure. Excludes social engineering and physical security.
Payout Range: $250 - $15,000+ based on severity. Account takeover, payment bypass, and access to user data at scale earn premium bounties.
Program Link: https://hackerone.com/spotify
Snapchat
Platform: HackerOne
Scope: Snapchat mobile apps, web platform, Snap Kit SDK, advertising platform, and Bitmoji integration. Focus on privacy vulnerabilities, unauthorized access to snaps/stories, and location data exposure.
Payout Range: $250 - $25,000+ for critical issues. Privacy-impacting vulnerabilities affecting user content or location data receive elevated rewards.
Program Link: https://hackerone.com/snapchat