TM
BugcrowdOffers Rewards
T-mobile
T-mobile appears to run a bug bounty or vulnerability disclosure program on Bugcrowd. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (73)
Self-Register Account on T-Mobile Microsoft Entra ID
Cellular Network Auth Bypass via Web App/T-Life (404-200-7239)
T&P Servers (Temporarily Out of Scope)
https://t-mobile.com
https://account.t-mobile.com
https://api.t-mobile.com
https://metrobyt-mobile.com
https://sprint.com
https://tfb.t-mobile.com
https://devedge.t-mobile.com
https://tess.service-now.com
https://digits.t-mobile.com
https://account.business.t-mobile.com
https://api.vistarmedia.com
https://packages.cortexpowered.com
https://api.vistarmedia.eu
https://production-dynam-creative.vistarmedia.com
https://storybook.vistarmedia.com
https://creatives.vistarmedia.com
https://sflower.cortexpowered.com
https://production-delivery-metrics-svc.vistarmedia.com
https://maps.vistarmedia.com
https://transcodes-cdn.vistarmedia.com
https://assets-cdn.vistarmedia.com
https://docker-staging.adstruc.com
https://staging-trafficking.vistarmedia.com
https://job-svc-b.vistarmedia.com
https://docsite.vistarmedia.com
https://sfleet.cortexpowered.com
https://audience-builder.vistarmedia.com
https://staging-login.vistarmedia.com
https://clients.adstruc.com
https://demo.adstruc.com
https://*.uscc.net
https://*.uscc.com
https://*.uscellular.com
https://dashboard-101.moengage.com
https://www.assurancewireless.com
https://*.assurancewireless.com
https://assets.platform.blis.com
https://assets.development.amazon-tacticalplanner.com
https://assets.platform.development.blis.com
https://assets.platform.rc.blis.com
https://audiencelogos.blis.com
https://blis.com
https://creative.infinity.blismedia.com
https://development.wmaudience.com
https://imply-pivot.blis.com
https://imply-pivot.test.blis.com
https://imply.blis.com
https://imply.internal.platform.blis.com
https://imply.platform.blis.com
https://imply.platform.development.blis.com
https://imply.platform.rc.blis.com
https://imply.test.blis.com
https://imply.wmaudience.com
https://internal.platform.blis.com
https://jenkins-github.gcp.blis.com
https://platform.blis.com
https://platform.blismedia.com
https://platform.development.blis.com
https://platform.development2.blis.com
https://platform.rc.blis.com
https://privacy.blismedia.com
https://rc.wmaudience.com
https://signature.blis.com
https://sitepixel.blis.com
https://sitepixel.dev.blis.com
https://wiki.atom-lens.com
https://wmaudience.com
Subdomain Takeover
https://apps.apple.com/us/app/t-life/id1111876388
https://play.google.com/store/apps/details?id=com.tmobile.tuesdays&hl=en_US&gl=US
Out of Scope (9)
/self-service-*
http://10.72.218.66/flag.txt
http://10.62.252.214/flag.txt
*.sprint.net
*.mobile.uscc.net
*.mobile.uscc.com
https://*.moengage.com
https://appointments.uscellular.com
Any domain, property, product, protocol, or service of the app/hardware/software version not explicitly listed in the In-Scope section is out of scope; submissions are welcome but not guaranteed for the bounty/bonus.