Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
16 in-scope
*.base.appscope· critical*.cbhq.netscope· critical*.coinbase-corp.comscope· critical*.coinbase.comscope· criticalcom.vilcsak.bitcoin2· criticalorg.toshi.distribution· criticalgithub.com/base/*· criticalgithub.com/coinbase/*· criticalgithub.com/coinbase/cb-mpc· criticalgithub.com/coinbase/cb-mpc-go· critical*.base.orgscope· critical54.175.255.192/27· criticalOther· mediumcom.coinbase.android· criticalchrome.google.com/webstore/detail/…-wallet-extension/hnfank…naad· criticalorg.toshi· criticalstatus.*.coinbase.comN/A - Not Coinbase owned or operated+ added 3 scopes · *.base.app, https://github.com/base/*, https://github.com/coinbase/*
− removed 16 scopes
90d ago
first indexed
92d ago · 29 in-scope assets
No reports yet. Be the first to share your triage timing for Coinbase.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/coinbase",
"name": "Coinbase",
"handle": "coinbase",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.base.app",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "*.base.org",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.cbhq.net",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.coinbase-corp.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "Coinbase's main domain.",
"max_severity": "critical",
"asset_identifier": "*.coinbase.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "CIDR",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "54.175.255.192/27",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "OTHER",
"instruction": "Applications that may have been missed as a part of our standard scope; this will be assessed on a by submission basis. ",
"max_severity": "medium",
"asset_identifier": "Other",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Coinbase's retail mobile app on Android.",
"max_severity": "critical",
"asset_identifier": "com.coinbase.android",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Coinbase's retail mobile app on iOS.",
"max_severity": "critical",
"asset_identifier": "com.vilcsak.bitcoin2",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://github.com/base/*",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://github.com/coinbase/*",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://github.com/coinbase/cb-mpc",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "While we appreciate submissions regarding this repo, this repo is not eligible for bounties.",
"max_severity": "critical",
"asset_identifier": "https://github.com/coinbase/cb-mpc-go",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Base Android app",
"max_severity": "critical",
"asset_identifier": "org.toshi",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "high"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Base iOS app",
"max_severity": "critical",
"asset_identifier": "org.toshi.distribution",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "high"
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "This asset labelling is used to signal to a reporter that the asset in question is not owned or operated by Coinbase in any capacity.",
"max_severity": "none",
"asset_identifier": "N/A - Not Coinbase owned or operated",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "Out of Scope. Please see https://github.com/x402-foundation/x402/blob/main/SECURITY.md",
"max_severity": "none",
"asset_identifier": "https://github.com/coinbase/x402",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "Out of Scope. Please see https://github.com/x402-foundation/x402/blob/main/SECURITY.md",
"max_severity": "none",
"asset_identifier": "https://github.com/x402-foundation/",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "none",
"asset_identifier": "status.*.coinbase.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "status.coinbase.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://coinbase.com/security",
"offers_swag": true,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 1117,
"response_efficiency_percentage": 91,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": null
}