Program Removed
This program is no longer available on Bugcrowd. The scope data shown below is historical and may not reflect the final state of the program.
upwork
25
In Scope
28
Out of Scope
In-Scope Assets (25)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| api.upwork.com/graphql | URL | Yes | ||
| direct contracts | URL | Yes | - | |
| direct contracts | URL | Yes | - | |
| https://api.upwork.com/graphql | URL | Yes | ||
| https://api.upwork.com/graphql | URL | Yes | ||
| https://www.upwork.com | URL | Yes | ||
| https://www.upwork.com | URL | Yes | ||
| https://www.upwork.com/api | URL | Yes | ||
| https://www.upwork.com/downloads | URL | Yes | ||
| upwork - android application | ANDROID | Yes | - | |
| upwork - android application | ANDROID | Yes | - | |
| upwork - api.upwork.com/graphql | URL | Yes | - | |
| upwork - ios application | IOS | Yes | - | |
| upwork - ios application | IOS | Yes | - | |
| upwork - marketplace portal | URL | Yes | - | |
| upwork - marketplace portal | URL | Yes | - | |
| upwork - messages | URL | Yes | - | |
| upwork - messages | URL | Yes | - | |
| upwork - mobile application android | ANDROID | Yes | - | |
| upwork - mobile application android | ANDROID | Yes | - | |
| upwork - mobile application ios | IOS | Yes | - | |
| upwork - mobile application ios | IOS | Yes | - | |
| upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | Yes | - | |
| upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | Yes | - | |
| www.upwork.com/api | URL | Yes |
Out-of-Scope Assets (28)
| Asset | Category | Bounty | |
|---|---|---|---|
| any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Yes | |
| any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Yes | |
| any third-party services | OTHER | Yes | |
| any third-party services | OTHER | Yes | |
| careers.upwork.com | OTHER | Yes | |
| careers.upwork.com | URL | Yes | |
| community.stage.upwork.com | OTHER | Yes | |
| community.stage.upwork.com | URL | Yes | |
| community.upwork.com | URL | Yes | |
| community.upwork.com | OTHER | Yes | |
| e.upwork.com | OTHER | Yes | |
| e.upwork.com | URL | Yes | |
| pardot.upwork.com | OTHER | Yes | |
| pardot.upwork.com | OTHER | Yes | |
| signature.upwork.com | OTHER | Yes | |
| signature.upwork.com | URL | Yes | |
| social media hijacking | OTHER | Yes | |
| social media hijacking | OTHER | Yes | |
| stage.upwork.com | URL | Yes | |
| stage.upwork.com | OTHER | Yes | |
| status.upwork.com | OTHER | Yes | |
| status.upwork.com | URL | Yes | |
| support.upwork.com | URL | Yes | |
| support.upwork.com | OTHER | Yes | |
| tip.upwork.com | URL | Yes | |
| tip.upwork.com | URL | Yes | |
| tip.upwork.com | OTHER | Yes | |
| tip.upwork.com | URL | Yes |
Scope Changes (185)
Jun 26, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Program Removed | — | — | — | 06:34 |
Jun 17, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | https://www.upwork.com | URL | In Scope | 11:34 |
| Added | upwork - android application | ANDROID | In Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Added | signature.upwork.com | URL | Out of Scope | 11:34 |
| Added | stage.upwork.com | URL | Out of Scope | 11:34 |
| Added | community.upwork.com | URL | Out of Scope | 11:34 |
| Added | social media hijacking | OTHER | Out of Scope | 11:34 |
| Added | upwork - mobile application ios | IOS | In Scope | 11:34 |
| Added | upwork - ios application | IOS | In Scope | 11:34 |
| Added | https://www.upwork.com | URL | In Scope | 11:34 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | status.upwork.com | URL | Out of Scope | 11:34 |
| Added | e.upwork.com | URL | Out of Scope | 11:34 |
| Added | community.stage.upwork.com | URL | Out of Scope | 11:34 |
| Added | upwork - mobile application android | ANDROID | In Scope | 11:34 |
| Added | www.upwork.com/api | URL | In Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Added | careers.upwork.com | URL | Out of Scope | 11:34 |
| Added | support.upwork.com | URL | Out of Scope | 11:34 |
| Added | any third-party services | OTHER | Out of Scope | 11:34 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 11:34 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | upwork - messages | URL | In Scope | 11:34 |
| Added | upwork - marketplace portal | URL | In Scope | 11:34 |
| Added | api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | direct contracts | URL | In Scope | 11:34 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 11:34 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | tip.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Added | careers.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | signature.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | status.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | e.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | stage.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | community.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | support.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | any third-party services | OTHER | Out of Scope | 11:34 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 11:34 |
| Added | social media hijacking | OTHER | Out of Scope | 11:34 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | upwork - mobile application android | ANDROID | In Scope | 11:34 |
| Added | upwork - mobile application ios | IOS | In Scope | 11:34 |
| Added | upwork - messages | URL | In Scope | 11:34 |
| Added | upwork - marketplace portal | URL | In Scope | 11:34 |
| Added | api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | direct contracts | URL | In Scope | 11:34 |
| Added | www.upwork.com/api | URL | In Scope | 11:34 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 11:34 |
| Added | upwork - ios application | IOS | In Scope | 11:34 |
| Added | upwork - android application | ANDROID | In Scope | 11:34 |
| Program Removed | — | — | — | 10:34 |
Mar 5, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | community.stage.upwork.com | URL | Out of Scope | 22:31 |
| Added | support.upwork.com | URL | Out of Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | careers.upwork.com | URL | Out of Scope | 22:31 |
| Added | status.upwork.com | URL | Out of Scope | 22:31 |
| Added | e.upwork.com | URL | Out of Scope | 22:31 |
| Added | stage.upwork.com | URL | Out of Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | signature.upwork.com | URL | Out of Scope | 22:31 |
| Added | community.upwork.com | URL | Out of Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | careers.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | signature.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | status.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | e.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | support.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
Feb 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | social media hijacking | OTHER | Out of Scope | 19:14 |
| Added | any third-party services | OTHER | Out of Scope | 19:14 |
| Added | community.stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | e.upwork.com | URL | Out of Scope | 19:14 |
| Added | status.upwork.com | URL | Out of Scope | 19:14 |
| Added | careers.upwork.com | URL | Out of Scope | 19:14 |
| Added | www.upwork.com/api | URL | In Scope | 19:14 |
| Added | direct contracts | URL | In Scope | 19:14 |
| Added | api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | upwork - messages | URL | In Scope | 19:14 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 19:14 |
| Added | support.upwork.com | URL | Out of Scope | 19:14 |
| Added | upwork - android application | ANDROID | In Scope | 19:14 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 19:14 |
| Added | upwork - mobile application ios | IOS | In Scope | 19:14 |
| Added | upwork - mobile application android | ANDROID | In Scope | 19:14 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | https://www.upwork.com | URL | In Scope | 19:14 |
| Added | community.upwork.com | URL | Out of Scope | 19:14 |
| Added | signature.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 19:14 |
| Added | upwork - ios application | IOS | In Scope | 19:14 |
| Added | upwork - marketplace portal | URL | In Scope | 19:14 |
| Program Removed | — | — | — | 17:22 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | e.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | status.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | signature.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | careers.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | signature.upwork.com | URL | Out of Scope | 17:13 |
| Added | careers.upwork.com | URL | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | e.upwork.com | URL | Out of Scope | 17:13 |
| Added | status.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | community.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | URL | Out of Scope | 17:13 |
| Added | stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |