Etsy

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 10 Nov 2026.

Program Overview Etsy is the global marketplace for unique and creative goods, connecting millions of buyers and sellers around the world. Through our marketplace and seller tools, we help creative entrepreneurs start, manage, and grow their businesses. Our mission is simple: Keep Commerce Human. Our bug bounty program has been running since 2012, and it remains an important part of how we protect the Etsy community. We partner with security researchers who practice responsible disclosure and help us identify vulnerabilities that could impact the safety, trust, and resilience of our marketplace. If you discover a valid security issue, we want to hear from you. Please use your @bugcrowdninja.com email address when creating testing account(s). To protect the integrity of the program, we reserve the right to suspend, delete, or block any test accounts that violate our testing guidelines. Vulnerability Guidelines & Exceptions Vulnerability reports MUST have a proof of concept or detailed explanation of the security issue. Please note the Vulnerability Exceptions section for a list of vulnerabilities which are NOT accepted. Higher quality reproduction steps and reports will be a strong factor in determining a valid issue's final bounty reward amount (In general, better reports -> bigger bounty reward). PLEASE provide clear step-by-step for replication. Rewards This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. Changes to VRT priorities for certain bugs are listed below: VRT Adjustments VRT Category Adjusted Value No Rate Limiting on Form - Login P5 No Rate Limiting on Form - email triggering P5 Cross-Site Scripting - IE-only/older version P5 Username Enumeration P5 No Password Policy P5