Does X / xAI have a bug bounty program?

Yes, X / xAI runs a public bug bounty program on HackerOne. It currently lists 23 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/x

X / xAI

HackerOne·updated 11h ago·−1· 7d

bountyswagmanagedopen

Discord → RSS

payout: no bounty
scope: 23 in · 1 out
safe harbor: unknown
response: no reports

open program

signalsscope ×1.1 in 90dderived from our snapshot history

hunt score

cashfresh

formula →

payout

0/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

23 in-scope

12urls
6wildcards
3other
2ios

Scope

In scope

023

wildcards06

+*.grok.comscope· critical
+*.twimg.comscope· critical
+*.twitter.comscope· critical
+*.vine.coscope· critical
+*.x.aiscope· critical
+*.x.comscope· critical

urls12

+accounts.x.ai· critical
+chat.x.com· critical
+console.x.ai· critical
+console.x.com· critical
+grok.com· critical
+grokipedia.com· critical
+money.x.com· critical
+pscp.tv· critical
+t.co· medium
+x.ai· critical
▸▾show 2 morehide 2 more
- +x.com· critical
- +xadsacademy.com· medium

ios02

+ai.x.GrokApp· critical
+com.atebits.Tweetie2· critical

other03

+X Pixel Helper (Chrome Extension)· critical
+ai.x.grok· critical
+com.twitter.android· critical

Out of scope

001

−grok-buildother

Change history

3 events

in-scope over 89dpeak 24

first indexedscope addedscope removedreward change

2026-11-03
− removed 1 scope · grok-build
3d ago
2026-09-03
+ added 7 scopes
− removed 3 scopes · *.twitter.biz, gnip.com, grok-build-cli
64d ago
2026-08-06
first indexed
92d ago · 20 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for X / xAI.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/x",
  "name": "X / xAI",
  "handle": "x",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.grok.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.twimg.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.twitter.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.vine.co",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.x.ai",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.x.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "X Pixel Helper (Chrome Extension)",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "accounts.x.ai",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "ai.x.GrokApp",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "ai.x.grok",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "chat.x.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.atebits.Tweetie2",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.twitter.android",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "console.x.ai",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "console.x.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "grok.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "grokipedia.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "money.x.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "pscp.tv",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "medium",
        "asset_identifier": "t.co",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "x.ai",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "x.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "medium",
        "asset_identifier": "xadsacademy.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "grok-build",
        "eligible_for_bounty": false,
        "integrity_requirement": "medium",
        "eligible_for_submission": false,
        "availability_requirement": "none",
        "confidentiality_requirement": "medium"
      }
    ]
  },
  "website": "https://x.com",
  "offers_swag": true,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 472,
  "response_efficiency_percentage": 72,
  "average_time_to_report_resolved": 1884,
  "average_time_to_first_program_response": 60
}