Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
TikTok’s current route for reporting a security vulnerability is its HackerOne program. The public bug bounty dates to 2020; its rules, eligible systems, and any reward depend on the live HackerOne policy. Separately, TikTok and ByteDance challenged a federal divest-or-ban law, while a 2026 Justice Department opinion addressed a different question: whether the U.S. joint venture’s version of TikTok falls under a federal-device restriction.
How to report a TikTok security vulnerability
TikTok’s Report Security Vulnerabilities support page directs researchers to HackerOne, which TikTok identifies as its security bug bounty partner. The page says to consult HackerOne’s program policy for reporting rules, scope, and rewards. Check that policy before submitting: TikTok’s support page does not establish a payout amount or guarantee that a particular finding qualifies.
TikTok lists examples of technical issues that may be reportable, including cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), SQL injection, exposed sensitive credentials, dangerous APIs, user-data leaks, authentication or authorization flaws, access to internal resources, and arbitrary code execution. These examples are not a substitute for the live policy’s scope and eligibility requirements.
When TikTok’s public bug bounty began
TikTok announced its global public HackerOne bug bounty in 2020, describing it as an expansion of its existing vulnerability disclosure policy. In the company’s 2020 newsroom announcement, TikTok said: “Today, we are announcing the expansion of our existing vulnerability disclosure policy to a global public bug bounty program through a partnership with HackerOne.” The current support page continues to point security reporters to HackerOne.
#1 Best Overall
Two different U.S. legal matters
The court challenge to the federal divest-or-ban law and the later Justice Department opinion about federal devices concern different legal instruments and questions. The Supreme Court docket for No. 24-656 identifies TikTok Inc. and ByteDance Ltd. v. Garland and records the earlier challenge to the law. The docket is procedural history; it should not be read as the July 2026 government-device opinion.
On January 23, 2026, TikTok announced that TikTok USDS Joint Venture LLC had been established. TikTok described the venture as majority-American-owned and responsible for safeguards involving U.S. user data, algorithm security, content moderation, and software assurance. Those are the company’s descriptions of its structure and safeguards. TikTok’s U.S. terms, last updated July 15, 2026, identify the joint venture as the platform operator in the United States.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the July 2026 opinion says—and does not say
On July 16, 2026, the Justice Department’s Office of Legal Counsel concluded that the version of TikTok operated by the U.S. joint venture was not prohibited by the No TikTok on Government Devices Act. The opinion cited the venture’s independence and majority-American ownership, along with changes to the recommendation algorithm and cybersecurity program. It concerns that statute and the joint-venture-operated service, not every possible restriction on TikTok.
Free tools Windows power users keep installed
One-click scans. No signup required.
The opinion also recognizes agency discretion and relevant workplace policies. It is therefore not a guarantee that TikTok can be used on every federal device. The Federal Acquisition Regulation clause addresses covered applications in federal procurement and refers to TikTok or successor applications developed or provided by ByteDance or an entity it owns. That clause should be read alongside the later OLC opinion; by itself, it does not resolve how the post-divestiture service is treated under the separate government-device law.
Quick Recap
| Issue | Divest-or-ban challenge | Government-device opinion |
|---|---|---|
| Date and record | Earlier challenge reflected in Supreme Court docket No. 24-656. | OLC opinion issued July 16, 2026. |
| Legal question | TikTok and ByteDance’s challenge to the federal divest-or-ban law. | Whether the No TikTok on Government Devices Act prohibits the joint-venture-operated U.S. service. |
| Scope | The challenged federal law; the docket documents the case and its procedural history. | Use of the relevant service under a federal-device statute, with agency discretion and workplace policies still relevant. |
| Stated outcome | The cited docket establishes the case’s identity and history, not a conclusion supplied by the July 2026 opinion. | OLC concluded that the joint-venture-operated version was not prohibited by the government-device statute. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
