# Twilio: bug bounty program on HackerOne

> Twilio is a bug bounty program on HackerOne. Its critical reports have paid an average of $2,064 across 145 reports (HackerOne figures, November 7, 2026). It received 1,710 reports in the 90 days to November 7, 2026, about 17 per in-scope asset.

- **Company:** Twilio
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/twilio
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** January 21, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/twilio

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $2,064 | 145 |
| High | $931 | 226 |
| Medium | $268 | 2,117 |
| Low | $150 | 576 |

- Reports received in the last 90 days: 1,710 (about 17 per in-scope asset)
- Bounties paid in the last 90 days: $61,520
- Bounties paid in total: $143,652
- Researchers participating: 260
- Response efficiency: 79%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 103 assets in scope (103 bounty-eligible), 43 out of scope. The policy page is the authority.

- `*.sip.*.twilio.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `1console.twilio.com` (URL): in scope, bounty-eligible, max severity critical
- `accounts.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `Any host/web property verified to be owned by Twilio et al.` (OTHER): in scope, bounty-eligible, max severity critical
- `api.authy.com` (API): in scope, bounty-eligible, max severity critical
- `api.segment.io` (API): in scope, bounty-eligible, max severity critical
- `api.segmentapis.com` (API): in scope, bounty-eligible, max severity critical
- `api.sendgrid.com` (URL): in scope, bounty-eligible, max severity critical
- `api.stytch.com` (API): in scope, bounty-eligible, max severity critical
- `api.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `app.segment.com` (URL): in scope, bounty-eligible, max severity critical
- `app.sendgrid.com` (URL): in scope, bounty-eligible, max severity critical
- `assistants.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `Authy/Verify Targets` (OTHER): in scope, bounty-eligible, max severity critical
- `blog.twilio.com` (URL): in scope, bounty-eligible, max severity critical
- `bulkexports.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `client.dev` (URL): in scope, bounty-eligible, max severity critical
- `com.authy` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `com.authy.authy` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `connectedapps.dev` (URL): in scope, bounty-eligible, max severity critical
- `console.twilio.com` (URL): in scope, bounty-eligible, max severity critical
- `content.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `conversations.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `events.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `flex-api.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `frontline-api.twilio.com` (API): in scope, bounty-eligible, max severity critical
- `github.com/segmentio` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/sendgrid` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/is-agent` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/samlshield` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-android` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-browser` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-dotnet` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-go` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-ios` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-ios-dfp` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-java` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-management-go` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-management-python` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `github.com/stytchauth/stytch-mobile` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- and 106 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.