Notion Labs, Inc.

{
  "id": 0,
  "url": "https://hackerone.com/notion",
  "name": "Notion Labs, Inc.",
  "handle": "notion",
  "targets": {
    "in_scope": [
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "Github Repositories or other public artifacts owned by makenotion",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "AI_MODEL",
        "instruction": "We are particularly interested in the ability to access data the user lacks permission to view. Prompt engineering for inappropriate AI responses is out of scope. The usage of obfuscated or invisible characters to alter AI responses is in scope if security impact can be demonstrated.",
        "max_severity": "critical",
        "asset_identifier": "Notion AI",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "Notion Authentication",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "Any desktop app available for download at www.notion.so/desktop\n\nWe only reward for the most recent version of the app.",
        "max_severity": "critical",
        "asset_identifier": "Notion Desktop App",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "OTHER",
        "instruction": "Includes any resources served to or affects a user from notion.so/ or our marketing site on notion.so.",
        "max_severity": "critical",
        "asset_identifier": "Notion Frontend",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "OTHER",
        "instruction": "We are most interested in any CSRF in third-party integrations.",
        "max_severity": "critical",
        "asset_identifier": "Notion Integrations",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "Notion MCP",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "We are particularly interested in the ability to access pages a given user should lack the ability to access. \n\nAdditionally, if a page is available through “Anyone with a link at…” (permission grant), we are interested in cases where another user could access that page without explicitly receiving the link.",
        "max_severity": "critical",
        "asset_identifier": "Privilege Escalation",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "Includes resources at notion.so/api/v3.\n\nAttacks we are most interested in receiving reports about include: injection attacks, remote code execution, server-side request forgery, IDOR, and privilege escalation. This list is not exhaustive; please submit anything related to the API here.",
        "max_severity": "critical",
        "asset_identifier": "Product API",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "Includes resources at [api.notion.com](https://api.notion.com/).\n\nWe are particularly interested in the ability to escalate your privileges beyond the scope of our API tokens.",
        "max_severity": "critical",
        "asset_identifier": "Public API",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "calendar.notion.so",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "mail.notion.so",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "Includes the Android app available for download at https://play.google.com/store/apps/details?id=notion.id. We only reward for the most recent version of the app.",
        "max_severity": "critical",
        "asset_identifier": "notion.id",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      }
    ],
    "out_of_scope": []
  },
  "website": "https://www.notion.com",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 431,
  "response_efficiency_percentage": 90,
  "average_time_to_report_resolved": 1260,
  "average_time_to_first_program_response": 5
}