MongoDB

{
  "id": 0,
  "url": "https://hackerone.com/mongodb",
  "name": "MongoDB",
  "handle": "mongodb",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "[Non-Core]\n.mongodb.com/ is in scope, and includes\nmongodb.com/docs/\nsupport.mongodb.com\nAll others sites that follow that pattern are in-scope. If the site is owned by MongoDB, it is eligible for a bounty. If it’s owned by a 3rd party, it is not eligible for a bounty. This scope is a catch-all for all products not listed individually with the 'Atlas' Prefix, or covered as an Atlas product, listed elsewhere in the scope.\nmongodb.com/community/forums is in scope, but not eligible for a bounty.\nfeedback.mongodb.com is out of scope and not eligible for bounty. Please do not test that platform. All bugs should be reported to AHA, not MongoDB.\nArtifactory is being deprecated and not eligible for bounty.\n",
        "max_severity": "critical",
        "asset_identifier": "*.mongodb.com/*",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "MongoDB App Services (fka Realm) has been deprecated. ",
        "max_severity": "critical",
        "asset_identifier": "App Services/Realm",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\ncharts.mongodb.com",
        "max_severity": "critical",
        "asset_identifier": "Atlas Charts",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nAtlas Data Federation is embedded into the Atlas Platform. Read more here:\nhttps://www.mongodb.com/products/platform/atlas-data-federation\n",
        "max_severity": "critical",
        "asset_identifier": "Atlas Data Federation",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\naccount.mongodb.com and other Identity and Access Management bugs within Atlas, regarding Organizations, Projects and permissions.",
        "max_severity": "critical",
        "asset_identifier": "Atlas IAM",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nhttps://www.mongodb.com/docs/atlas/infinite/atlas-infinite-landing/",
        "max_severity": "critical",
        "asset_identifier": "Atlas Infinite",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nBilling is integrated into the Atlas Platform, read more here: https://www.mongodb.com/docs/atlas/billing/",
        "max_severity": "critical",
        "asset_identifier": "Atlas Payments/Billing",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://www.mongodb.com/try/download/mongosync",
        "max_severity": "critical",
        "asset_identifier": "Cluster-To-Cluster sync",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://www.mongodb.com/try/download/compass\nResponsible social engineering reports are in scope but not eligible for bounty. \n",
        "max_severity": "critical",
        "asset_identifier": "Compass",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "[Non-Core]\nhttps://www.mongodb.com/try/download/database-tools",
        "max_severity": "critical",
        "asset_identifier": "Database Tools",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "[Non-Core]\nThese are the following drivers that are in scope:\nAtlas SQL JDBC Driver\nAtlas SQL ODBC Driver\nC\nC++\nGo\nJVM (Java, Scala, Kotlin)\nLibmongocrypt\nNode.js/Typescript\nPHP\nPython\nRuby\nRust\nThe Swift Driver is not in scope and not eligible for bounty.\n",
        "max_severity": "critical",
        "asset_identifier": "Drivers",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nOps manager and Cloud manager",
        "max_severity": "critical",
        "asset_identifier": "Enterprise Edition Products and Tools",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://github.com/evergreen-ci/evergreen",
        "max_severity": "critical",
        "asset_identifier": "Evergreen",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nMongoDB is open-sourced and has publicly visible JIRA tickets. Only report information disclosure issues-- no technical bugs are accepted. Bounty may be varied.",
        "max_severity": "critical",
        "asset_identifier": "Jira Projects",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nMongoDB Assistant is integrated into Data Explorer and Compass.",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Assistant",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nAtlas and Atlas Features and Products are in scope and eligible for bounty.\nAtlas IAM, Charts, Data Federation, Payments/Billing, are listed elsewhere in the scope. Other Atlas products not explicitly listed elsewhere in the scope should be submitted here. This includes, but is not limited to Streams, Online Archive, Clusters, and Backup.\nhttps://cloud.mongodb.com\n",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Atlas",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nhttps://www.mongodb.com/docs/agentengine/\nCustomers are responsible for the correct functioning of their MongoDB-hosted agent, so no bug reports will be accepted for misbehaving agents. Bug reports will also not be accepted for agents that violate our Acceptable Use Policy or Terms of Service. Otherwise, security gaps in the Atlas Agent Engine control plane or data plane, especially where cross-customer data access or availability impacts are possible, should be reported.",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Atlas Agent Engine ",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nResponsible social engineering reports are in scope but not eligible for bounty. ",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Atlas Agent Engine CLI and First Party Libraries",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nThe Connectors are in scope. This includes\nKafka Connector\nPowerBI Connector\nBI Connector\nSpark Connector\nTableau Connector\n",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Connectors",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://plugins.jetbrains.com/plugin/24377-mongodb",
        "max_severity": "critical",
        "asset_identifier": "MongoDB IntelliJ Plugin",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://github.com/mongodb-js/mongodb-mcp-server",
        "max_severity": "critical",
        "asset_identifier": "MongoDB MCP Server",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nOnly github.com/mongodb is considered to be eligible for bounty. Other MongoDB owned repositories are in scope, but not eligible for bounty.\nhttps://github.com/mongodb/kingfisher is out of scope and not eligible for bounty.\n",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Owned GitHub Repositories",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://cloud.mongodb.com/ecosystem\nPartner integrations may be eligible for bounties, depending on the owner of the issue.\n",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Partner Integrations",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Core]\nServer Community and Server Enterprise are in scope and eligible for bounty.",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Server",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://www.mongodb.com/try/download/shell",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Shell",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttp://mongodbtoolchain.build.10gen.cc",
        "max_severity": "critical",
        "asset_identifier": "MongoDB Toolchain",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://www.mongodb.com/try/download/relational-migrator",
        "max_severity": "critical",
        "asset_identifier": "Relational Migrator",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nlearn.mongodb.com is owned by 3rd party and not eligible for bounty",
        "max_severity": "critical",
        "asset_identifier": "University Platform",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "[Non-Core]\nhttps://marketplace.visualstudio.com/items?itemName=mongodb.mongodb-vscode",
        "max_severity": "critical",
        "asset_identifier": "VS Code Plugin",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "[Non-Core]\nhttps://www.voyageai.com\nhttps://ai.mongodb.com\nhttps://api.voyageai.com\nhttps://blog.voyageai.com/\nhttps://docs.voyageai.com/docs/introduction",
        "max_severity": "critical",
        "asset_identifier": "voyageai.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      }
    ],
    "out_of_scope": []
  },
  "website": "https://mongodb.com",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 696,
  "response_efficiency_percentage": 79,
  "average_time_to_report_resolved": 1260,
  "average_time_to_first_program_response": 2
}