Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.

Program Purpose T-Mobile USA, Inc. ("T-Mobile") is committed to protecting our customers, our employees, our partners, and our brand. As part of this commitment, T-Mobile works with the security community to keep our customers and business safe. If you have identified a high-impact, reproducible security vulnerability in a T-Mobile property, application, or system, we encourage you to report it. We are especially interested in vulnerabilities that could materially affect: T-Mobile customers, employees, and owned brands or acquired businesses; customer accounts, billing, identity, authentication, and line-management systems; cellular, MSISDN, SIM/eSIM, DIGITS, messaging, location, and carrier-trust workflows; T-Mobile internal, cloud, administrative, and business operations. We evaluate reported vulnerabilities and promptly take appropriate action. Scope Boundary In this policy, T-Mobile means T-Mobile USA, Inc. and its affiliates. This program is limited to T-Mobile-owned or T-Mobile-controlled assets explicitly listed as in scope. T-Mobile does not own — and cannot remediate findings on — non-T-Mobile assets, including Deutsche Telekom assets and third-party vendors. Deutsche Telekom domains, applications, systems, networks, services, subsidiaries, infrastructure, employee accounts, customer data, and corporate environments are out of scope and not eligible for bounty — even where the asset references T-Mobile, shares branding, links to T-Mobile properties, or appears related to T-Mobile business operations. Any domain, property, product, protocol, or service not explicitly listed in scope is out of scope. Submissions against unlisted assets are welcome but not guaranteed a bounty. Eligibility The following are not eligible to participate. T-Mobile determines eligibility in its sole discretion, evaluated at submission and at payment. residents of countries or regions under applicable U.S. sanctions or export restrictions; persons on the U.S. Treasury SDN List or another applicable restricted-party list; current or former employees, contractors, consultants, interns, or vendor staff of T-Mobile or any T-Mobile affiliate, regardless of when the relationship ended; current or former employees of SoftBank Group Corp. or any of its affiliates; immediate family or household members of any person in the preceding two bullets; any person bound by a current or former NDA, confidentiality, or similar agreement with T-Mobile or any T-Mobile affiliate covering T-Mobile systems, security, source code, operations, or customer/employee data; any person who has had, at any time, non-public access to T-Mobile systems, source code, vulnerabilities, security testing, internal tools, credentials, or customer/employee data; any Bugcrowd staff member with access to the T-Mobile program, and their immediate family or household members; any person who learned of, identified, or developed the finding while in any role, agreement, or access above, regardless of current status; any other person prohibited by applicable law, regulation, contract, or program rule. T-Mobile affiliate means any parent, subsidiary, predecessor, successor, acquired entity, branded MVNO, joint venture, or otherwise controlled entity of T-Mobile USA, Inc. Immediate family means spouse, domestic partner, parent, child, sibling, and step/half/in-law equivalents. Household member means anyone sharing the researcher’s residence. Submitting on behalf of an ineligible person through a proxy, agent, alt account, or third party voids the submission. Researchers must promptly disclose any fact that could affect eligibility, and T-Mobile may require identity, employment, or tax documentation as a condition of triage or payment. Ineligible submissions are void. T-Mobile may withhold unpaid rewards and, where permitted, recover amounts already paid, close associated submissions, ban the researcher, and refer the matter to Bugcrowd, law enforcement, or regulators. Program Terms Participation in T-Mobile’s Bug Bounty Program is voluntary and subject to the terms and conditions of this policy. By submitting a vulnerability report to T-Mobile, researchers acknowledge that they have read and agree to comply with this policy. T-Mobile may modify this policy at any time. Continued participation in the program after a modification constitutes acceptance of the modified policy. Submission of a security report does not create a consumer, employment, contractor, partnership, or agency relationship between the researcher and T-Mobile. All communications regarding vulnerability findings, submissions, appeals, questions, or T-Mobile Bug Bounty Program policies must be conducted through the Bugcrowd platform. Researchers must not use any alternative channel unless expressly authorized in writing by T-Mobile or Bugcrowd. Prohibited channels include but are not limited to: direct contact with T-Mobile employees or executives by any means; social-media messages or posts directed at T-Mobile personnel; T-Mobile customer, enterprise, support, sales, PR, HR, or legal channels; physical visits to T-Mobile locations; any T-Mobile contact, regardless of how it was obtained. Intent (e.g., “just a heads-up”) does not create an exception. Failure to comply may result in removal from the program, reduced or forfeited bounty payments, ineligibility for future participation, and/or other punitive actions. T-Mobile may use the contents of submitted reports for any purpose related to validation, remediation, legal obligations, regulatory obligations, contractual obligations, security operations, or protection of T-Mobile, its customers, employees, partners, products, services, or systems. Information provided to T-Mobile will be handled according to T-Mobile’s Privacy Policy. Researchers must adhere to the Bugcrowd Community Code of Conduct and Bugcrowd Terms and Conditions. If this policy conflicts with Bugcrowd disclosure guidance or platform rules, this policy controls for the