Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
19 in-scope
*.quip.comscope· criticalapi.slack.com· criticalapp.slack.com· criticaledgeapi.slack.com· criticalslack-imgs.com· criticalslack-redir.net· criticalslack-status.com· criticalslack.com· criticalslackatwork.com· criticalslackb.com· criticalspaces.pm· criticalwww.quip.com· criticalcom.slack.slackmdm· criticalcom.tinyspeck.chatlyio· criticalapps.apple.com/us/app/quip-docs-chat-sheets/id647922896· criticalgithub.com/slackhq/nebula· criticalSlack Desktop Application· criticalcom.Slack· criticalsalesforce.quip.com/blog/desktop· critical3rd Party Quip Appscom.Slack.intunefirst indexed
92d ago · 19 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for Slack.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/slack",
"name": "Slack",
"handle": "slack",
"targets": {
"in_scope": [
{
"asset_type": "URL",
"instruction": "Only accepting Critical reports as of 2023-12-01",
"max_severity": "critical",
"asset_identifier": "*.quip.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "Slack Desktop Application",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "The Slack API",
"max_severity": "critical",
"asset_identifier": "api.slack.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "app.slack.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "com.Slack",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Reports are accepted for vulnerabilities specific to the [Slack EMM/MDM version of the app](https://apps.apple.com/us/app/slack-for-emm/id1254292716).\n\nEMM client vulnerabilities in the absence of a valid MDM configuration via a supported MDM provider, (such as MobileIron), on an EMM-enabled Slack team are excluded.",
"max_severity": "critical",
"asset_identifier": "com.slack.slackmdm",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "The main Slack app is included: [Slack iOS App](https://apps.apple.com/us/app/slack/id618783545)\n\nOther versions of the app, such as the EMM and Intune versions, are not included.",
"max_severity": "critical",
"asset_identifier": "com.tinyspeck.chatlyio",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "edgeapi.slack.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "Only accepting Critical reports as of 2023-12-01",
"max_severity": "critical",
"asset_identifier": "https://apps.apple.com/us/app/quip-docs-chat-sheets/id647922896",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "Accepting Critical severity ONLY as of 2026-05-27. Refer to Out of Scope section for detailed guidance",
"max_severity": "critical",
"asset_identifier": "https://github.com/slackhq/nebula",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "DOWNLOADABLE_EXECUTABLES",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://salesforce.quip.com/blog/desktop",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "slack-imgs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "slack-redir.net",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "slack-status.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "The slack.com site and application.",
"max_severity": "critical",
"asset_identifier": "slack.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "slackatwork.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "slackb.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "spaces.pm",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "Only accepting Critical reports as of 2023-12-01",
"max_severity": "critical",
"asset_identifier": "www.quip.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "URL",
"instruction": "This domain was part of a prior company. ",
"max_severity": "none",
"asset_identifier": "*.glitchthegame.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "3rd Party Quip App are not eligible for bug bounty program.",
"max_severity": "none",
"asset_identifier": "3rd Party Quip Apps",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "",
"max_severity": "none",
"asset_identifier": "com.Slack.intune",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "",
"max_severity": "none",
"asset_identifier": "com.slack.slackintune",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Includes any subdomains (e.g.*.slackhq.com)",
"max_severity": "none",
"asset_identifier": "slackhq.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "The Slack status site",
"max_severity": "none",
"asset_identifier": "status.slack.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://slack.com",
"offers_swag": false,
"managed_program": false,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 134,
"response_efficiency_percentage": 99,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": null
}