Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
19 in-scope
*.gitlab.netscope· medium*.gitlab.orgscope· medium*.gitlap.comscope· mediumabout.gitlab.com· mediumadvisories.gitlab.com· mediumcustomers.gitlab.com· criticaldesign.gitlab.com· mediumdocs.gitlab.com· mediumgitlab.com· criticalregistry.gitlab.com· criticalgitlab.com/gitlab-org/gitaly· criticalgitlab.com/gitlab-org/gitlab· criticalgitlab.com/gitlab-org/gitlab-pages· criticalgitlab.com/gitlab-org/gitlab-runner· criticalgitlab.com/gitlab-org/gitlab-shell· criticalgitlab.com/gitlab-org/gitlab-vscode-extension· criticalGitLab for Jira Cloud· mediumOther non-production infrastructure· mediumYour Own GitLab Instance· criticalfirst indexed
93d ago · 19 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for GitLab.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/gitlab",
"name": "GitLab",
"handle": "gitlab",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Hosts owned and operated by GitLab.",
"max_severity": "medium",
"asset_identifier": "*.gitlab.net",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "WILDCARD",
"instruction": "Hosts owned and operated by GitLab.",
"max_severity": "medium",
"asset_identifier": "*.gitlab.org",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "WILDCARD",
"instruction": "Hosts owned and operated by GitLab. gitla**p** with a p!",
"max_severity": "medium",
"asset_identifier": "*.gitlap.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "medium",
"asset_identifier": "GitLab for Jira Cloud",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Hosts owned and operated by GitLab other than gitlab.com itself and our static websites.",
"max_severity": "medium",
"asset_identifier": "Other non-production infrastructure",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "Your Own GitLab Instance",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable.",
"max_severity": "medium",
"asset_identifier": "about.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable.",
"max_severity": "medium",
"asset_identifier": "advisories.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Server-side Denial of Service is out of scope as per our Policy.",
"max_severity": "critical",
"asset_identifier": "customers.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable.",
"max_severity": "medium",
"asset_identifier": "design.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable.",
"max_severity": "medium",
"asset_identifier": "docs.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitaly",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitlab",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitlab-pages",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitlab-runner",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitlab-shell",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://gitlab.com/gitlab-org/gitlab-vscode-extension",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "registry.gitlab.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Dangling DNS for *.gitlab-private.org is out of scope",
"max_severity": "none",
"asset_identifier": "*.gitlab-private.org",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "`gitlab.cn` and the JiHu-specific GitLab distribution which are property of GitLab Information Technology (Hubei) Co., Ltd. (JiHu), security issues in those products should be reported to `security@gitlab.cn`",
"max_severity": "none",
"asset_identifier": "*.gitlab.cn",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*.runway.gitlab.net",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*.service-now.com",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "alerts.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "aptly.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "dashboards.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "federal-support.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "forum.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "This is a third-party website that aggregates public data from GitLab.com. It is out of scope and the data hosted there is not meant to be confidential. https://contributors.gitlab.com/ redirects to this website.",
"max_severity": "none",
"asset_identifier": "gitlab.biterg.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "gitlabdemo.cloud",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "gitlabsandbox.net",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "gitlabtraining.cloud",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "This is a community project that is [now officially maintained by GitLab](https://about.gitlab.com/blog/2022/12/07/introducing-the-gitlab-cli/). It will be in scope at a later time but it is not ready yet.",
"max_severity": "none",
"asset_identifier": "https://gitlab.com/gitlab-org/cli/",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "none",
"asset_identifier": "https://gitlab.com/gitlab-org/opstrace/opstrace",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "none",
"asset_identifier": "https://gitlab.com/gitlab-org/opstrace/opstrace-ui",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "ir.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "levelup.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "packages.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "partners.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "shop.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "status.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "support.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "translate.gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "us-federal-gitlab.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://about.gitlab.com",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 998,
"response_efficiency_percentage": 77,
"average_time_to_report_resolved": 1591,
"average_time_to_first_program_response": 2
}