HackerOne

{ "id": 0, "url": "https://hackerone.com/freshworks", "name": "Freshworks ", "handle": "freshworks", "targets": { "in_scope": [ { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshcaller iOS app can be downloaded from https://apps.apple.com/us/app/freshcaller/id1424866045\n", "max_severity": "critical", "asset_identifier": "Freshcaller-iOS-App", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshchat iOS app can be downloaded from \nhttps://apps.apple.com/us/app/freshchat/id1273666080", "max_severity": "critical", "asset_identifier": "Freshchat-iOS-App", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshdesk iOS app can be downloaded from https://apps.apple.com/us/app/freshdesk/id849713306", "max_severity": "critical", "asset_identifier": "Freshdesk-iOS-App", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshservice Intune iOS app can be downloaded from https://apps.apple.com/us/app/freshservice-for-intune/id6475669802\n", "max_severity": "critical", "asset_identifier": "Freshservice-Intune-iOS-App", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshservice iOS app can be downloaded from https://apps.apple.com/us/app/freshservice/id891265220", "max_severity": "critical", "asset_identifier": "Freshservice-iOS-App", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshchat Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshchat.agent.android\n", "max_severity": "critical", "asset_identifier": "com.freshchat.agent.android", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshdesk Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshdesk.helpdesk", "max_severity": "critical", "asset_identifier": "com.freshdesk.helpdesk", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshservice Android App can be downloaded from https://play.google.com/store/apps/details?id=com.freshservice.helpdesk", "max_severity": "critical", "asset_identifier": "com.freshservice.helpdesk", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshservice Intune Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshservice.helpdesk.intune", "max_severity": "critical", "asset_identifier": "com.freshservice.helpdesk.intune", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshcaller Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshworks.freshcaller", "max_severity": "critical", "asset_identifier": "com.freshworks.freshcaller", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Please sign up to create your account and start testing. Read the \"In scope\" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eligible for bounty.", "max_severity": "critical", "asset_identifier": "yourdomain.freshcaller.com", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Please sign up to create your account and start testing. Read the \"In scope\" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eligible for bounty.", "max_severity": "critical", "asset_identifier": "yourdomain.freshchat.com", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Please sign up to create your account and start testing. Read the \"In scope\" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eligible for bounty.", "max_severity": "critical", "asset_identifier": "yourdomain.freshdesk.com", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Freshrelease is an agile project management tool bundled with the ITSM solution, Freshservice. It is hosted at yourdomain.freshrelease.com and integrated into Freshservice via an iframe, accessible under yourdomain.freshservice.com → Projects", "max_severity": "critical", "asset_identifier": "yourdomain.freshrelease.com", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Please sign up to create your account and start testing. Read the \"In scope\" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eligible for bounty.", "max_severity": "critical", "asset_identifier": "yourdomain.freshservice.com", "eligible_for_bounty": true, "integrity_requirement": null, "eligible_for_submission": true, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "As part of our ongoing product revamp, we have decided to remove the CRM Suite of products from the HackerOne program scope.\n\nOut of Scope:\nCRM Suite of Products – https://yourdomain.myfreshworks.com/crm/*\n\nPlease note that the main domain \"https://yourdomain.myfreshworks.com\" remains in scope. Only the /crm/* path has been removed from the HackerOne program scope.\n\nWe request that researchers ensure all security testing is limited to the assets and endpoints currently listed as “In-Scope” in the HackerOne program description.", "max_severity": "critical", "asset_identifier": "yourdomain.myfreshworks.com", "eligible_for_bounty": true, "integrity_requirement": "not_defined", "eligible_for_submission": true, "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined" } ], "out_of_scope": [ { "asset_type": "APPLE_STORE_APP_ID", "instruction": "Freshsales iOS app can be downloaded from https://apps.apple.com/us/app/freshsales/id1073125057\n", "max_severity": "none", "asset_identifier": "Freshsales-iOS-App", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "OTHER", "instruction": "The Marketplace apps are out of scope for the bug bounty program. The domains listed below are provided as examples and may not represent the complete list. Reach out to security@freshworks.com if you have any doubts.\n\nhttps://marketplace-*.freshworks.com\nhttps://marketplace.freshworks.com\nhttps://yourdomain.myfreshworks.com/developer/*\nhttps://*.appgallery-*.freshworks.com\n.. etc", "max_severity": "none", "asset_identifier": "Marketplace Apps", "eligible_for_bounty": false, "integrity_requirement": "not_defined", "eligible_for_submission": false, "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined" }, { "asset_type": "GOOGLE_PLAY_APP_ID", "instruction": "Freshsales Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshdesk.helpdesk", "max_severity": "none", "asset_identifier": "com.freshdesk.freshsales.mobile", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "We don't use this Atlassian JIRA instance.", "max_severity": "none", "asset_identifier": "freshworks.atlassian.net", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Due to a product revamp, we have decided to remove Freshmarketer product from the HackerOne \"In-scope\" items. This policy will be effective from Nov 26th, 2024. Any bugs reported by HackerOne researchers before Nov 26th,2024 will be considered by the team.\n\nFreshmarketer Endpoint - yourdomain.myfreshworks.com/crm/marketer", "max_severity": "none", "asset_identifier": "http://yourdomain.myfreshworks.com/crm/marketer", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "Due to a product revamp, we have decided to remove Freshsales product from the HackerOne \"In-scope\" items. This policy will be effective from Nov 26th, 2024. Any bugs reported by HackerOne researchers before Nov 26th,2024 will be considered by the team.\n\nFreshsales Endpoint - yourdomain.myfreshworks.com/crm/sales", "max_severity": "none", "asset_identifier": "http://yourdomain.myfreshworks.com/crm/sales", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "", "max_severity": "none", "asset_identifier": "wchat.freshchat.com", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "The domain www.freshworks.com is a static webpage containing no sensitive information.", "max_severity": "none", "asset_identifier": "www.freshworks.com", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "", "max_severity": "none", "asset_identifier": "yourdomain.freshping.io", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "", "max_severity": "none", "asset_identifier": "yourdomain.freshstatus.io", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null }, { "asset_type": "URL", "instruction": "", "max_severity": "none", "asset_identifier": "yourdomain.freshsurvey.io", "eligible_for_bounty": false, "integrity_requirement": null, "eligible_for_submission": false, "availability_requirement": null, "confidentiality_requirement": null } ] }, "website": "https://www.freshworks.com/", "offers_swag": false, "managed_program": false, "offers_bounties": true, "submission_state": "open", "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 45, "response_efficiency_percentage": 77, "average_time_to_report_resolved": null, "average_time_to_first_program_response": null }

Freshworks

In scope

Recent changes

Community reports

Your notes

History

Out of scope