Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.

Block, Inc. In 2021, Square officially changed its name to Block with Square now being one of our product lines. The Square Bug Bounty program is limited to this line of business and includes the target components outlined in the ‘Target Information’ section. Block engages with Bugcrowd to provide proactive security testing across the majority of our other product lines. Please reach out to support@bugcrowd.com if you have any questions. You can participate in our other product bug bounty programs as noted below: Cash App Tidal Afterpay Block Open Source Serious about security Our approach to security is designed to protect buyers and sellers. We monitor every transaction, continuously innovate in fraud prevention, and we protect businesses’ data like our business depends on it—because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization. Ratings and rewards Only Critical (P1), Severe (P2), and Moderate (P3) submissions will be rewarded. P4 findings will NOT be accepted. For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Access A Bugcrowd account is required. Please sign up for a Square account using your @bugcrowdninja.com email address only. Do not use personal email addresses. If for any reason your Square seller account gets deactivated during testing, please escalate to Bugcrowd. Do not create multiple merchant accounts as this can be disruptive. If your testing requires two separate Square accounts, please add "+1" to your email address for the secondary account. Using your @bugcrowdninja.com address helps us identify you. For more info regarding @bugcrowdninja email addresses, see here. Rules of Engagement If you are able to access or modify personal data of Square customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work. Do not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. For test merchant accounts, please do not sign up for Text Message Marketing (TMM) or Messages Plus (M+) products as both are used for verification of business. This would have negative impact with our carriers. If you have any questions on our third party products, we encourage you to reach out. Do not attempt a denial-of-service attack. For hardware testing, research must be done on one's own Square Register or Terminal. Do not use ChatGPT, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms. Please contact support@bugcrowd.com for any escalations. Do not contact Block or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion. Focus Areas Flaws within payments or checkout flows, especially findings that may expose personal information Square Banking (see here) Issues in our hardware or firmware of Square's point of sale (POS) systems