TikTok Bug Bounty Program Policy

TikTok's mission is to inspire creativity and bring joy to our vibrant community. We recognize and value external feedback from the global security research community on potential vulnerabilities which helps strengthen our overall platform security posture. Before submitting a vulnerability report, please review our program policy and terms. We appreciate your contribution and thank you for helping make TikTok a safer place for our community!

General Program Terms

By participating in the program, you agree that you are bound by and subject to this policy. By submitting a vulnerability or other report to us, you grant to us, our subsidiaries and its affiliates, a perpetual, irrevocable, royalty free license to all intellectual property rights licensable by you in or related to the use of this material. You agree that no third party rights are involved in your report and you have all rights to submit such a report. We may modify the terms of this policy or terminate the policy at any time.

If you do not comply with this policy or if we determine that your participation in the program is not in good faith or could adversely impact us, our affiliates, or our business partners (or any of our or their users, employees, or contractors), we, in our sole discretion, may remove you from the program and disqualify you from receiving any reward under the program.

Program Rules and Guidelines

• Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.

• If more than one person reports the same security vulnerability, the reward will generally be given to the first person to successfully submit the report. Exceptions may be made on a case by case basis.

• Multiple vulnerabilities caused by one underlying issue may be awarded one bounty.

• Social engineering of any kind (including without limitation phishing, vishing, smishing) is prohibited.

• Do not commit privacy violations, destruction of data, or interruption or degradation of our service.

• Create test accounts or test content to avoid affecting real users.

• Do not test/exploit vulnerabilities on user accounts that you do not own or have rights to access or control.

• Example: Do not generate millions of fraudulent "likes" for your own videos

• If you encounter TikTok user information during research, stop there and report the issue immediately via HackerOne.

• Always read and adhere to community guidelines, terms of service, or privacy policies.

• If you have any questions about a particular report, please reach out via the corresponding HackerOne ticket for tracking purposes.

Testing Notes

• Where possible, register accounts using your <username>+x@wearehackerone.com addresses.

• Provide your IP address/test domain in the bug report. We will keep this data private and only use it to review logs related to your testing activity.

• For valid Proof of Concept please include your HackerOne username in the file name and file content as a comment in the markup.

Asset Priorities

Vulnerabilities will be evaluated based on impact to TikTok systems and certain assets may be of higher impact.

We currently consider the following assets to be of greater interest:

• Android app: Com.zhiliaoapp.musically

• Android app: Com.ss.android.ugc.trill

• iOS app: 835599320

• iOS app: 1235601864

• Tiktok.com

• *.tiktokv.com

Disclosure and Confidentiality Policy

We support public recognition and disclosure of contributions and findings for those participants who desire. We will seek to allow participants to be publicly recognized whenever possible. Public disclosure of a vulnerability (either full or partial) is allowed after being coordinated with TikTok and disclosed on HackerOne. If 180 days have elapsed with the TikTok Team not providing a vulnerability disclosure timeline, the contents of the report may be publicly disclosed by the reporter. Retention, copying, or disclosure of TikTok information gained as a result of participation is not permitted.

If requesting beyond limited HackerOne disclosure (e.g. in a blog or at a conference), please share your blog post or presentation with us prior to the publication.

Rewards

| Vulnerability | Severity

|--------------------------- |----------------------- |

| Remote Code Execution, Command injection, shell upload, unsafe deserialization, exploitable memory corruption | Critical |

| SQL Injection, XML External Entity Injection (XXE), Command injection | High - Critical |

| Leaked Credential, Cryptographic flaw | Medium - High |

| Cross-Site Scripting (XSS) | Medium - High |

| Server-Side Request Forgery | Medium - High |

| Directory Traversal | Medium - High |

| Authentication/Authorization Bypass (Broken Access Control) | Medium - High |

| File Inclusion | Medium - Critical |

| Insecure Direct Object Reference | Medium - Critical |

| Misconfiguration/ Open Redirect | Low - Medium |

| CRLF Injection | Low - Medium |

| Cross Site Request Forgery | Low - High |

| Information Disclosure | Low - Medium |

| Subdomain takeover | Medium - High |

| HTML injections (w/o XSS), XSS on harmless subdomains, attacks requiring unlikely user interaction | Low - Medium |

High-quality reports may be awarded an extra bonus. A high-quality report is a thoroughly written vulnerability report that includes (when applicable) a working proof-of-concept, root cause analysis, a suggested fix, and any other relevant information. We also ask that researchers be responsive and collaborative which helps us efficiently implement and deliver fixes in a timely manner.

The criteria used to determine reward amount, bonuses, and eligibility are solely at our discretion.

Not Eligible for Reward

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) potential security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions

• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

• Attacks requiring MITM or physical access to a user's device

• Previously known vulnerable libraries without a working Proof of Concept

• Comma Separated Values (CSV) injection without demonstrating a vulnerability

• Missing best practices in SSL/TLS configuration

• Any activity that could lead to the disruption of our service (DoS) or a violation of the privacy of any user, employee or contractor of TikTok or any of its affiliates or business partners

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

• Rate limiting or bruteforce issues on non-authentication endpoints

• Missing best practices in Content Security Policy

• Missing Referrer Policy

• Missing Subresource Integrity directives

• Missing anti-clickjacking mechanisms

• Missing HttpOnly, Secure, SameSite cookie attributes

• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)

• Vulnerabilities only affecting users of outdated or unpatched browsers (more than 2 stable versions behind the latest released stable version)

• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).

• Public Zero-day vulnerabilities that have had an official disclosure less than 1 month before are on a case by case basis.

• Tabnabbing

• Open redirect - unless an additional security impact can be demonstrated

• Issues that require unlikely user interaction

• Vulnerabilities that are already known (e.g. discovered and reported by other researchers or by an internal team)

• CSRF issues on seller-id.tiktok.com domain will be temporarily out of scope (Starting Nov 23, 2021) as the team is working on the fix.

• Self-XSS, which includes any payload entered by the victim

Known Issues

Please note that these known issues will not be eligible for bounties:

• Cross-Site Request Forgery (CSRF) issues on TikTok Web App/TikTok Mobile App.

Good Faith Guidelines

To encourage good faith research and responsible disclosure of security vulnerabilities, we will not threaten or bring legal action against what we determine to be accidental or good faith violation of this policy. This includes claims under the DMCA for circumventing technological measures to protect the services and applications eligible under this policy.

To the extent your security research activities are inconsistent with certain restrictions in our relevant site policies but are consistent with the terms of our bug bounty program, we may waive those restrictions for the sole and limited purpose of permitting good faith security research under this bug bounty program.

If your security research involves the networks, systems, information, applications, products, or services of a third party, including any TikTok users, we cannot bind that third party, and they may pursue legal action or law enforcement notice. We cannot, and do not, authorize security research in the name of other entities or individuals, and cannot in any way offer to defend, indemnify, or otherwise protect you from any third party action based on your actions.

You must, as always, comply with all laws applicable to you, and not disrupt or compromise any data beyond what our bug bounty program permits.

Be proactive in contacting us before engaging in any action that may violate or is unaddressed by this policy or good faith. We reserve the sole right to determine whether a violation of this policy is accidental or in good faith.