Work at Intercom? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.
We appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Intercom. Every day new security issues and attack vectors are created. Intercom strives to keep abreast on the latest state-of-the-art security developments by working with security researchers and companies. We appreciate the community's efforts in creating a more secure world. Rewards: Intercom will rely on the Bugcrowd Vulnerability Rating Taxonomy for prioritization of findings- but reserve the right to either downgrade or upgrade findings’ severity based on the criticality of their underlying risk to Intercom. Appropriate payouts will then be awarded accordingly. Any downgraded submission with come with a full and detailed explanation.
Scope
12 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.intercomassets.com / *.intercomcdn.com | website | ✓ bounty | not set |
| Android SDK | android | ✓ bounty | not set |
| fin.ai | website | ✓ bounty | not set |
| https://*.mobile-messenger.intercom.com | api | ✓ bounty | not set |
| https://api-iam.intercom.io | api | ✓ bounty | not set |
Show all 12 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| https://api.intercom.io | api | ✓ bounty | not set |
| https://app.fin.ai/ | website | ✓ bounty | not set |
| https://app.intercom.com | website | ✓ bounty | not set |
| https://app.intercom.io | website | ✓ bounty | not set |
| https://www.intercom.com | website | ✓ bounty | not set |
| iOS SDK | ios | ✓ bounty | not set |
| mcp.intercom.com | website | ✓ bounty | not set |