UP
BugcrowdOffers Rewards
Upwork
Upwork appears to run a bug bounty or vulnerability disclosure program on Bugcrowd. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (12)
https://www.upwork.com
Upwork - Android Application
Upwork - iOS Application
Upwork Dash Messenger Desktop Version (www.upwork.com/downloads)
www.upwork.com/api
Direct Contracts
api.upwork.com/graphql
Upwork - Marketplace Portal
Upwork - Messages
Upwork - Mobile Application IOS
Upwork - Mobile Application Android
Upwork - api.upwork.com/graphql
Out of Scope (14)
Social media hijacking
Any subdomain/domain/property not listed in the 'in scope' section, is out of scope.
Any Third-party Services
support.upwork.com
community.stage.upwork.com
community.upwork.com
stage.upwork.com
e.upwork.com
status.upwork.com
signature.upwork.com
careers.upwork.com
tip.upwork.com
tip.upwork.com
pardot.upwork.com