# Whatnot: bug bounty program on HackerOne

> Whatnot is a bug bounty program on HackerOne. Its critical reports have paid an average of $10,000 across 28 reports (HackerOne figures, November 8, 2026). It received 499 reports in the 90 days to November 8, 2026, about 62 per in-scope asset.

- **Company:** Whatnot
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/whatnot
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** March 17, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/whatnot

## Payouts and volume

HackerOne's own published figures, captured November 8, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $10,000 | 28 |
| High | $5,000 | 46 |
| Medium | $1,000 | 54 |
| Low | $300 | 38 |

- Reports received in the last 90 days: 499 (about 62 per in-scope asset)
- Bounties paid in the last 90 days: $30,900
- Bounties paid in total: $368,612
- Researchers participating: 159
- Response efficiency: 88%
- First-response target: 1 day
- Triage target: 10 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 8 assets in scope (8 bounty-eligible), 1 out of scope. The policy page is the authority.

- `*.whatnot.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `api.whatnot.com` (URL): in scope, bounty-eligible, max severity critical
- `auction-service.whatnot.com` (URL): in scope, bounty-eligible, max severity critical
- `com.whatnot_mobile` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `http://api.whatnot.com/graphql` (URL): in scope, bounty-eligible, max severity critical
- `live-service.whatnot.com` (URL): in scope, bounty-eligible, max severity critical
- `Whatnot: Shop, Sell, Connect` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `www.whatnot.com` (URL): in scope, bounty-eligible, max severity critical
- `admin.whatnot.com` (URL): out of scope, max severity none

---

Generated November 8, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.