Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
7 in-scope
*.staging-airtableblocks.comscope· critical*.staging.airtable.comscope· criticalapi-staging.airtable.com· criticalmcp.staging.airtable.com· criticalstaging.airtable.com· criticalairtable.js SDK (https://www.npmjs.com/package/airtable)· criticalwww.npmjs.com/package/@airtable/mcp-cli· criticalfirst indexed
93d ago · 7 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for Airtable.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/airtable",
"name": "Airtable",
"handle": "airtable",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "IMPORTANT: this domain is NOT eligible for stored XSS via building custom apps/blocks functionality.",
"max_severity": "critical",
"asset_identifier": "*.staging-airtableblocks.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.staging.airtable.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "- Install `airtable.js` via `npm install airtable`\n- Visit https://staging.airtable.com/account and generate an API key\n- Create a new Javascript file and add the following lines:\n\n```javascript\nconst Airtable = require('airtable');\nconst airtable = new Airtable({\n apiKey: 'PUT YOUR API KEY HERE',\n endpointUrl: 'https://api-staging.airtable.com', // IMPORTANT: you MUST set the endpointUrl attribute to this URL, or else you will be testing on airtable.com, which is out of scope\n});\n```\n\nSee https://staging.airtable.com/api for instructions on how to use the API, as well as [the source code on Github](https://github.com/airtable/airtable.js)\n\nPlease note that reports about outdated/vulnerable dependencies flagged by `npm audit` or `yarn audit` are **out of scope**. Vulnerabilities discovered via manual code audits are acceptable.",
"max_severity": "critical",
"asset_identifier": "airtable.js SDK (https://www.npmjs.com/package/airtable)",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Go to https://staging.airtable.com/account to generate an API key. See https://staging.airtable.com/api for API documentation per base.",
"max_severity": "critical",
"asset_identifier": "api-staging.airtable.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "Source code for our MCP CLI.\n\nVulnerabilities assuming a malicious MCP server must be paired with a demonstrated MCP exploit that provides a full exploit chain in order to be considered.",
"max_severity": "critical",
"asset_identifier": "https://www.npmjs.com/package/@airtable/mcp-cli",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Use the official Airtable MCP CLI (https://www.npmjs.com/package/@airtable/mcp-cli) to interact with the MCP server. \n\nMCP CLI code is also in scope, but vulnerabilities assuming a malicious MCP server must be paired with a demonstrated MCP exploit that provides a full exploit chain.",
"max_severity": "critical",
"asset_identifier": "mcp.staging.airtable.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "staging.airtable.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "The Airtable Windows app is available for download at: https://staging.airtable.com/downloads",
"max_severity": "none",
"asset_identifier": "Airtable Windows app",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "The Airtable macOS app is available for download at: https://staging.airtable.com/downloads",
"max_severity": "none",
"asset_identifier": "Airtable macOS app",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "This is production environment. All testing should be performed against staging.airtable.com.",
"max_severity": "none",
"asset_identifier": "airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "blog.airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Airtable's iOS is not in-scope for bounties.",
"max_severity": "none",
"asset_identifier": "com.FormaGrid.Hyperbase",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "",
"max_severity": "none",
"asset_identifier": "com.formagrid.airtable",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "community.airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "dl.airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "dl.getforma.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "guide.airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "support.airtable.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://staging.airtable.com/",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 355,
"response_efficiency_percentage": 78,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": null
}