This Bounty Policy governs your participation in the bounty program and forms part of the Tencent Security Response Center Terms of Service.<\/p>\n
Note:<\/strong> For a smooth payment, make sure to use the same email address<\/strong> on both TSRC and YesWeHack. Eligible reports will be imported to the program and hunters will be able to claim<\/a> them. Once claimed, these reports will be eligible for a payment.<\/p>\n For any questions or clarifications, you may contact the Tencent Security Team at security@tencent.com<\/a>.<\/p>\n Other links:<\/p>\n The classification of a vulnerability (Critical, High, Moderate or Low as described below), whether a product or application is in scope of the bounty program and its classification (core, important, and other in-scope), and whether to grant a monetary reward and its amount will be within the sole discretion of the Tencent Security Team, based on a number of factors including, without limitation, quality of the report, severity of the vulnerability, reproducibility of the vulnerability, its Any design or implementation issue regarding any qualifying product that is reproducible and substantially affects the security of Tencent users is likely to be in scope for the program.<\/p>\n However, reports and researchers must meet the following requirements to be eligible to receive a monetary reward through YesWeHack platform:<\/p>\n You grant Tencent a non-exclusive, royalty-free, irrevocable, perpetual, transferable, worldwide license (with the right to sublicense) to copy, reproduce, use, modify, test, create derivative works (including commercial products) based upon, distribute, publish, display and otherwise exploit your reports and other information you provide to us under this Agreement.<\/p>\n Rewards are stated in USD.<\/p>\n All reports will be reviewed based on the impact and severity of the reported vulnerability. Any qualifying report that results in a change being made will at a minimum receive the Hall of Fame recognition.<\/p>\n The main categories of vulnerabilities that we are primarily concerned about are:<\/p>\n Products, services and applications distributed and made available in any form by or on behalf of Tencent and described in \"Core Products\" and \"Other In-Scope Products\" below are in scope. For more information about our products and services, please visit https:\/\/www.tencent.com\/en-us\/business.html<\/a>.<\/p>\n It includes the majority of Tencent's products and businesses, such as Tencent Game Helper (\u817e\u8baf\u6e38\u620f\u52a9\u624b), Tencent Ride Code Mini Program(\u817e\u8baf\u4e58\u8f66\u7801\u5c0f\u7a0b\u5e8f), QQ Music and other products, including but not limited to mobile applications, clients, mini programs, web sites, hardware, IoT, server services, and other product models.<\/p>\n Only vulnerabilities affecting the platform itself and IP owned by Tencent will be accepted. If an IP belongs to Tencent Cloud external customer, it is not considered in scope.<\/p>\n You can use a QQ or Wechat account to log into all Tencent's products and services. 1. To register a QQ account, please go to https:\/\/ssl.zc.qq.com\/v3\/index-en.html?type=0<\/a> and follow the instructions. 2. To register a WeChat account, please download an WeChat app from App store or through Android system, then follow the registration guide. Once you have a QQ or WeChat account, you can start testing.<\/p>\n When reporting vulnerabilities, please consider (1) attack scenario \/ exploitability, and (2) security impact of the bug. The following issues are considered out of scope (either ineligible or false positives):<\/p>\n We have set up a \"demo\" service for SSRF testing. If you believe you have an SSRF in production, please use either of the following IP\/port combinations for testing:<\/p>\n This service will accept HTTP requests to any endpoint, of any request type, and will return a secret token in both headers and response body.<\/p>","type":"bug-bounty","status":"V","demo":false,"public":true,"bounty":true,"gift":false,"hall_of_fame":true,"hacktivity":false,"report_count_per_scope":false,"report_collaboration_active":true,"pid":null,"secured":false,"triaged":null,"disabled":false,"vdp":false,"reports_count":15,"reports_imported_count":null,"pending_hunter_suggestions_count":0,"bounty_reward_min":8,"bounty_reward_max":5000,"scopes_count":2,"archived":false,"thumbnail":{"name":"6f1a3272-3912-4f7c-a7b2-c6ed38d3212a","original_name":"VDvv02E__400x400.jpeg","mime_type":"image\/jpeg","size":3985,"url":"https:\/\/cdn-yeswehack.com\/program\/thumbnail\/6f1a3272-3912-4f7c-a7b2-c6ed38d3212a"},"event":null,"business_unit":{"name":"Tencent","slug":"tencent","description":"Tencent is a world-leading internet and technology company that develops innovative products and services to improve the quality of life of people around the world.","currency":"USD","already_activate_product":true,"logo":{"name":null,"original_name":null,"mime_type":null,"size":null,"url":null}},"vpn_outbound_ips":null,"id":null,"scopes":[{"scope":"Core Assets In-Scope Products (for the full list please visit https:\/\/en.security.tencent.com\/index.php\/policy)","scope_type":"other","scope_type_name":"Other","asset_value":"CRITICAL","report_count":null},{"scope":"Non Core Assets In-Scope Products (for the full list please visit https:\/\/en.security.tencent.com\/index.php\/policy)","scope_type":"other","scope_type_name":"Other","asset_value":"MEDIUM","report_count":null}],"out_of_scope":["Please note that the vulnerabilities reported for the following assets will not be eligible for bounties.","*.qzoneapp.com","*. myqcloud.com","Third-party applications and websites","*Notes about Tencent Cloud (cloud.tencent.com as included in *.tencent.com)","Only vulnerabilities affecting the platform itself and IP owned by Tencent will be accepted. If an IP belongs to Tencent Cloud external customer, it is not considered in scope."],"qualifying_vulnerability":["Cross-site Scripting (XSS)","Cross-site Request Forgery (CSRF)","Server-Side Request Forgery (SSRF)","SQL Injection","Remote Code Execution (RCE)","XML External Entity Attacks (XXE)","Access Control Issues (Insecure Direct Object Reference issues, etc.)","Exposed Administrative Panels that without strong protection","Directory Traversal Issues","Local File Disclosure (LFD)","Vast Users' Sensitive Information Leakage","Vast Order details Leakage"],"non_qualifying_vulnerability":["\"Self\" XSS","Session fixation","Content Spoofing","Missing cookie flags","SSL\/TLS best practices","Mixed content warnings","Clickjacking\/UI redressing","Flash-based vulnerabilities","Admin panel can be brute force","Local denial of service of Mobile APP","Reflected file download attacks (RFD)","Physical or social engineering attacks","Feedback,comment,message,etc. flooding","SMS\/Email flooding for some of our business","CSRF\/XSS with long or unpredictable parameter","Login\/logout\/unauthenticated\/low-impact CSRF","Unverified Results of automated tools or scanners","No SPF\/DMARC in non-email domains\/subdomains","Attacks requiring MITM or physical access to a user's device","Issues related to networking protocols or industry standards","Error information disclosure that cannot be used to make a direct attack","Missing security-related HTTP headers which do not lead directly to a vulnerability","Information leakage that cannot be used to make a direct attack,like server IP,server version,path,error message,internal IP,etc."],"disclose_bounty_min_reward":null,"disclose_bounty_average_reward":null,"disclose_bounty_max_reward":null,"reward_grid_default":{"bounty_low":32,"bounty_medium":130,"bounty_high":780,"bounty_critical":6425},"reward_grid_very_low":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_low":{"bounty_low":32,"bounty_medium":130,"bounty_high":780,"bounty_critical":6425},"reward_grid_medium":{"bounty_low":20,"bounty_medium":50,"bounty_high":400,"bounty_critical":1200},"reward_grid_high":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_critical":{"bounty_low":30,"bounty_medium":100,"bounty_high":600,"bounty_critical":5000},"tags":null,"vpn_active":false,"vpn_ips":null,"account_access":null,"account_access_html":null,"user_agent":"-BugBounty-tencent-31337","disable_message":null,"stats":{"max_reward":null,"average_reward":null,"average_first_time_response":0,"total_reports":15,"total_reports_last24_hours":0,"total_reports_last7_days":0,"total_reports_current_month":0},"supported_languages":["GB","CN"],"report_import_nb_max":null,"report_import_line_max":null,"banner":{"name":null,"original_name":null,"mime_type":null,"size":null,"url":null},"restricted_ips":null,"has_pending_version":null,"rights":["view"],"attachments":null,"hunter_message_enabled":null,"send_hunter_message_validation_required":null,"max_credential_pool_number":null,"videos_attachments_enabled":true,"sla_enabled":null,"sla_grid":null,"systemic_issue_rule_enabled":false,"systemic_issue_rule_grid":{"level1":100,"level2":100,"level3":0,"level4":0,"level5":0,"level6":0},"leakage_rule_enabled":false,"leakage_rule_grid_in_scope":{"fully_in_scope":false,"partially_in_scope":false,"out_of_scope":false},"leakage_rule_grid_out_of_scope":{"fully_in_scope":false,"partially_in_scope":false,"out_of_scope":false},"ywh_triager_user_agent":null,"report_submission_cost":0,"program_metrics":{"report_count":null,"rewards_total_amount":null,"hunter_members_count":null,"active_hunters_count":null,"launched_agentic_campaigns_count":null,"total_agentic_campaigns_count":null,"reports_in_progress_count":null,"reports_in_progress_high_critical_count":null,"reports_assessed_count":null,"reports_assessed_high_critical_count":null,"reports_accepted_count":null,"reports_accepted_high_critical_count":null,"reports_resolved_count":null,"reports_closed_count":null,"computed_at":"2026-11-05T02:45:05+01:00"},"credit_balance":null,"credit_balance_projected":null,"has_history":true,"last_update_at":"2026-08-03T08:40:21+02:00","last_program_version":null}Contact us<\/h2>\n
\n
Rules of Engagement<\/h2>\n
\nimpact on our users and other products and services, ease of exploitation and many other factors.<\/p>\n\n
\n
Grant of License<\/h3>\n
Rewards<\/h3>\n
<\/p>\n
Severity Rating<\/h3>\n
[Critical]<\/h4>\n
<\/p>\n
[High]<\/h4>\n
<\/p>\n
[Moderate]<\/h4>\n
<\/p>\n
[Low]<\/h4>\n
<\/p>\n
\n
\netc.)<\/li>\nIn-Scope Assets<\/h3>\n
1. Core Assets<\/h4>\n
\n
*.exmail.qq.com<\/code>)<\/li>\n*.mail.qq.com<\/code>)<\/li>\n2. Other In-Scope Assets:<\/h4>\n
3. *Notes about Tencent Cloud (cloud.tencent.com as included in *.tencent.com)<\/h4>\n
Test Plan<\/h3>\n
Out-of-Scope Vulnerabilities<\/h3>\n
\n
Detecting SSRF<\/h3>\n
\n