Program Removed
This program is no longer available on Bugcrowd. The scope data shown below is historical and may not reflect the final state of the program.
upwork
25
In Scope
28
Out of Scope
In-Scope Assets (25)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| api.upwork.com/graphql | URL | Yes | ||
| direct contracts | URL | Yes | - | |
| direct contracts | URL | Yes | - | |
| https://api.upwork.com/graphql | URL | Yes | ||
| https://api.upwork.com/graphql | URL | Yes | ||
| https://www.upwork.com | URL | Yes | ||
| https://www.upwork.com | URL | Yes | ||
| https://www.upwork.com/api | URL | Yes | ||
| https://www.upwork.com/downloads | URL | Yes | ||
| upwork - android application | ANDROID | Yes | - | |
| upwork - android application | ANDROID | Yes | - | |
| upwork - api.upwork.com/graphql | URL | Yes | - | |
| upwork - ios application | IOS | Yes | - | |
| upwork - ios application | IOS | Yes | - | |
| upwork - marketplace portal | URL | Yes | - | |
| upwork - marketplace portal | URL | Yes | - | |
| upwork - messages | URL | Yes | - | |
| upwork - messages | URL | Yes | - | |
| upwork - mobile application android | ANDROID | Yes | - | |
| upwork - mobile application android | ANDROID | Yes | - | |
| upwork - mobile application ios | IOS | Yes | - | |
| upwork - mobile application ios | IOS | Yes | - | |
| upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | Yes | - | |
| upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | Yes | - | |
| www.upwork.com/api | URL | Yes |
Out-of-Scope Assets (28)
| Asset | Category | Bounty | |
|---|---|---|---|
| any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Yes | |
| any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Yes | |
| any third-party services | OTHER | Yes | |
| any third-party services | OTHER | Yes | |
| careers.upwork.com | OTHER | Yes | |
| careers.upwork.com | URL | Yes | |
| community.stage.upwork.com | OTHER | Yes | |
| community.stage.upwork.com | URL | Yes | |
| community.upwork.com | URL | Yes | |
| community.upwork.com | OTHER | Yes | |
| e.upwork.com | OTHER | Yes | |
| e.upwork.com | URL | Yes | |
| pardot.upwork.com | OTHER | Yes | |
| pardot.upwork.com | OTHER | Yes | |
| signature.upwork.com | OTHER | Yes | |
| signature.upwork.com | URL | Yes | |
| social media hijacking | OTHER | Yes | |
| social media hijacking | OTHER | Yes | |
| stage.upwork.com | URL | Yes | |
| stage.upwork.com | OTHER | Yes | |
| status.upwork.com | OTHER | Yes | |
| status.upwork.com | URL | Yes | |
| support.upwork.com | URL | Yes | |
| support.upwork.com | OTHER | Yes | |
| tip.upwork.com | URL | Yes | |
| tip.upwork.com | URL | Yes | |
| tip.upwork.com | OTHER | Yes | |
| tip.upwork.com | URL | Yes |
Scope Changes (185)
Jun 26, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Program Removed | — | — | — | 06:34 |
Jun 17, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | upwork - android application | ANDROID | In Scope | 11:34 |
| Added | https://www.upwork.com | URL | In Scope | 11:34 |
| Added | upwork - android application | ANDROID | In Scope | 11:34 |
| Added | upwork - ios application | IOS | In Scope | 11:34 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 11:34 |
| Added | www.upwork.com/api | URL | In Scope | 11:34 |
| Added | direct contracts | URL | In Scope | 11:34 |
| Added | api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | upwork - marketplace portal | URL | In Scope | 11:34 |
| Added | upwork - messages | URL | In Scope | 11:34 |
| Added | upwork - mobile application ios | IOS | In Scope | 11:34 |
| Added | upwork - mobile application android | ANDROID | In Scope | 11:34 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | social media hijacking | OTHER | Out of Scope | 11:34 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 11:34 |
| Added | any third-party services | OTHER | Out of Scope | 11:34 |
| Added | support.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | community.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | stage.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | e.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | status.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | signature.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | careers.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Added | tip.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 11:34 |
| Added | direct contracts | URL | In Scope | 11:34 |
| Added | api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | upwork - marketplace portal | URL | In Scope | 11:34 |
| Added | upwork - messages | URL | In Scope | 11:34 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 11:34 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 11:34 |
| Added | any third-party services | OTHER | Out of Scope | 11:34 |
| Added | support.upwork.com | URL | Out of Scope | 11:34 |
| Added | careers.upwork.com | URL | Out of Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Added | www.upwork.com/api | URL | In Scope | 11:34 |
| Added | upwork - mobile application android | ANDROID | In Scope | 11:34 |
| Added | community.stage.upwork.com | URL | Out of Scope | 11:34 |
| Added | e.upwork.com | URL | Out of Scope | 11:34 |
| Added | status.upwork.com | URL | Out of Scope | 11:34 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 11:34 |
| Added | https://www.upwork.com | URL | In Scope | 11:34 |
| Added | upwork - ios application | IOS | In Scope | 11:34 |
| Added | upwork - mobile application ios | IOS | In Scope | 11:34 |
| Added | social media hijacking | OTHER | Out of Scope | 11:34 |
| Added | community.upwork.com | URL | Out of Scope | 11:34 |
| Added | stage.upwork.com | URL | Out of Scope | 11:34 |
| Added | signature.upwork.com | URL | Out of Scope | 11:34 |
| Added | tip.upwork.com | URL | Out of Scope | 11:34 |
| Program Removed | — | — | — | 10:34 |
Mar 5, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 22:31 |
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | support.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | e.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | status.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | signature.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | careers.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | tip.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | community.upwork.com | URL | Out of Scope | 22:31 |
| Added | signature.upwork.com | URL | Out of Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | stage.upwork.com | URL | Out of Scope | 22:31 |
| Added | e.upwork.com | URL | Out of Scope | 22:31 |
| Added | status.upwork.com | URL | Out of Scope | 22:31 |
| Added | careers.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | support.upwork.com | URL | Out of Scope | 22:31 |
| Added | community.stage.upwork.com | URL | Out of Scope | 22:31 |
Feb 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | upwork - marketplace portal | URL | In Scope | 19:14 |
| Added | social media hijacking | OTHER | Out of Scope | 19:14 |
| Added | any third-party services | OTHER | Out of Scope | 19:14 |
| Added | community.stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | e.upwork.com | URL | Out of Scope | 19:14 |
| Added | status.upwork.com | URL | Out of Scope | 19:14 |
| Added | careers.upwork.com | URL | Out of Scope | 19:14 |
| Added | www.upwork.com/api | URL | In Scope | 19:14 |
| Added | direct contracts | URL | In Scope | 19:14 |
| Added | api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | upwork - messages | URL | In Scope | 19:14 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 19:14 |
| Added | support.upwork.com | URL | Out of Scope | 19:14 |
| Added | upwork - android application | ANDROID | In Scope | 19:14 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 19:14 |
| Added | upwork - mobile application ios | IOS | In Scope | 19:14 |
| Added | upwork - mobile application android | ANDROID | In Scope | 19:14 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | https://www.upwork.com | URL | In Scope | 19:14 |
| Added | community.upwork.com | URL | Out of Scope | 19:14 |
| Added | signature.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 19:14 |
| Added | upwork - ios application | IOS | In Scope | 19:14 |
| Program Removed | — | — | — | 17:22 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | e.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | status.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | signature.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | careers.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | signature.upwork.com | URL | Out of Scope | 17:13 |
| Added | careers.upwork.com | URL | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | e.upwork.com | URL | Out of Scope | 17:13 |
| Added | status.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | community.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | URL | Out of Scope | 17:13 |
| Added | stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |