Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.

Hey, you! Wanna be part of our cyber food program? So pay attention to how you can deliver vulnerabilities to us! Let the Hunger Games begin! Thanks for your interest in the iFood bug bounty program! We're happy you're here. Our goal is to set a benchmark for security and we see that ongoing process as a team effort. External security evaluations are an important part of the process and make iFood a better, safer environment. We need researchers who can think creatively and work outside the box to find security bugs. We are committed to working with you to verify, reproduce and respond to legitimate reported vulnerabilities covered by this page. If you have something that you feel is close to exploitation, or if you'd like some information regarding the internals of our systems, or generally have any questions regarding the app that would help in your efforts, please create a submission and ask for that information. iFood will also accept flaw-hypothesis submissions, without penalty, and will work with you to develop a reasonable hypothesis into a working exploit, should one be possible. This program is exclusively limited to app and web applications listed in this document. Please, take note of the current scope outlined below. Ratings/Rewards: There's no need to reinvent the wheel. The iFood program will use what's best on the market and we hope to improve it over time! For now, we are using the Bugcrowd Vulnerability Rating Taxonomy. However, it's important to note: Sometimes, our analysis team can modify a vulnerability priority due to its likelihood or impact. But fear not, you'll be notified and a detailed explanation will be provided - along with the opportunity to appeal and make a case for a higher priority.