Work at Soundcloud? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.
At SoundCloud, we take the safety of our users very seriously. If you believe you have discovered a possible security vulnerability on our app(s), API(s), platform, or in any other SoundCloud service, please help us to fix it as quickly as possible by submitting your findings in accordance with this policy. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, you have the opportunity to appeal, and make a case for a higher priority. Please ensure to kindly include a video recording with your submission, showing the steps taken to find the vulnerability.
Scope
27 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.s-cloud.net | website | ✓ bounty | not set |
| *.services.repostnetwork.com | api | ✓ bounty | not set |
| *.soundcloud.com | api | ✓ bounty | not set |
| *.soundcloud.org | website | ✓ bounty | not set |
| api-*.soundcloud.com | api | ✓ bounty | not set |
Show all 27 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| artists.soundcloud.com | website | ✓ bounty | not set |
| SoundCloud Android app | android | ✓ bounty | not set |
| SoundCloud iOS app | ios | ✓ bounty | not set |
| soundcloud.com | website | ✓ bounty | not set |
| soundcloud.org | website | ✓ bounty | not set |
| advertising.soundcloud.com | website | out | not set |
| blog.soundcloud.com | website | out | not set |
| community.soundcloud.com | website | out | not set |
| contest.soundcloud.com | website | out | not set |
| copyright.soundcloud.com | website | out | not set |
| firston.soundcloud.com | website | out | not set |
| help.soundcloud.com | website | out | not set |
| jobs.soundcloud.com | website | out | not set |
| playback.soundcloud.com | website | out | not set |
| playerone.soundcloud.com | website | out | not set |
| press.soundcloud.com | website | out | not set |
| promote.soundcloud.com | website | out | not set |
| scdrops.soundcloud.com | website | out | not set |
| secdomaintest.soundcloud.com | website | out | not set |
| soundcloudmail.com | other | out | not set |
| status.soundcloud.com | website | out | not set |
| support.soundcloud.org | website | out | not set |