Programs Scope lookupScope New

/to search

☰menu

// sync across devices

Watchlist
Compare

Platform

Asset type

Min reward

Program

Sort

The bug bounty market, live-indexed. Every public program across five platforms, filterable in one view.

☕buy me a coffee

Product

Programs
Compare
Watchlist
Scope lookup
New programs
RSS feed

Platforms

HackerOne
Bugcrowd
Intigriti
YesWeHack
federacyFederacy

Resources

How it works
Data source
Hacktivity
Writeups
disclose.io

© 2026 bounty.index·not affiliated with any platform·built byVarun·X·GitHub

data · arkadiyt/bounty-targets-data·MIT licensed·updated daily

Spotify Bug Bounty Program on Hackerone

programs/HackerOne/spotify

Spotify

HackerOne·45 in-scope · 8 out·updated 2d ago

bountymanagedopen

In scope

045

wildcards10

+*.atspotify.com· low
+*.avecspotify.com· low
+*.byspotify.com· low

History

1 event

2026-08-06
first indexed
2d ago · 45 in-scope assets

// only one snapshot on record — changes appear from the next ingest onward

+*.enspotify.com· low

+*.forspotify.com· low

+*.fromspotify.com· low

+*.spotify.com· critical

+*.spotify.net· critical

+*.tospotify.com· low

+*.withspotify.com· low

urls04

+api.spotify.com· critical
+assets.spotify.com· critical
+backstage.io· medium
+https://www.whosampled.com/· critical

apis01

+api-partner.spotify.com· critical

ios04

+com.anchorfminc.Anchor· critical
+com.spotify.client· critical
+com.spotify.kids· critical
+com.spotify.s4a· critical

source code06

+Android SDK· critical
+Core Backstage source code· critical
+Spotify SDKs· critical
+Web Playback SDK· critical
+https://github.com/backstage/backstage· medium
+iOS SDK· critical

other20

+Anchor· critical
+Core Assets· critical
+DRM (Digital Rights Management) System· critical
+GHE· critical
+Jira· critical
+Megaphone· critical
+Non-Core Assets· critical
+Okta· critical
+Other Spotify websites· critical
+Podsights· critical
+Save to Spotify CLI· critical
+Sonantic· critical
+Spotify desktop application (Windows and Mac)· critical
+VPN· critical
+Wrapped· critical
+com.spotify.kids· critical
+com.spotify.music· critical
+com.spotify.s4a· critical
+com.spotify.tv.android· critical
+fm.anchor.android· critical

Out of scope

008

urls02

−everynoise.com
−example.com

ios01

−com.soundtrap.studioapp

other05

−Findaway
−Preact
−Soundtrap
−The Ringer
−com.soundtrap.studioapp