Featured on
Featured on
*.hs-sites(-eu1)?.com· low*.hubspotemail.net· medium*.hubspotpagebuilder.com— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for HubSpot.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 128,
"average_time_to_first_program_response": 1,
"average_time_to_report_resolved": 1030,
"handle": "hubspot",
"id": 0,
"managed_program": true,
"name": "HubSpot",
"offers_bounties": true,
"offers_swag": false,
"response_efficiency_percentage": 72,
"submission_state": "open",
"url": "https://hackerone.com/hubspot",
"website": "http://hubspot.com",
"targets": {
"in_scope": [
{
"asset_identifier": "*.hs-sites(-eu1)?.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "*.hubspotemail.net",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "*.hubspotpagebuilder.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "*.hubspotpagebuilder.eu",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "Customer Connected Domain",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Refers to domains connected within a HubSpot portal. For example, an XSS vulnerability identified on a HubSpot hosted page (where customer domain is connected in the HubSpot portal).",
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "Customer Portal",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Instructions on setting up a customer portal linked below:\nhttps://knowledge.hubspot.com/inbox/set-up-a-customer-portal",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "HubSpot Android Mobile App",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You can download the app at the link below:\nhttps://play.google.com/store/apps/details?id=com.hubspot.android&hl=en_US&gl=US&pli=1",
"integrity_requirement": null,
"max_severity": "high"
},
{
"asset_identifier": "HubSpot Sales Office 365 add-in",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Setup instructions linked below:\nhttps://knowledge.hubspot.com/connected-email/get-started-with-the-hubspot-sales-office-365-add-in",
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "HubSpot iOS Mobile App",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You can download the app at the link below:\nhttps://apps.apple.com/us/app/hubspot-crm-grow-better/id1107711722",
"integrity_requirement": null,
"max_severity": "high"
},
{
"asset_identifier": "Other HubSpot-owned (sub)domains not listed as Out of Scope",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Other HubSpot-owned (sub)domains not listed as Out of Scope . Please make sure to exercise due diligence before testing. You must include proof that the subdomain is registered to HubSpot to be eligible for a reward.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "api*.hubapi.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "api*.hubspot.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "app*.hubspot.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "chatspot.ai",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "medium",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "medium",
"max_severity": "medium"
},
{
"asset_identifier": "hubspot.net",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "medium"
}
],
"out_of_scope": [
{
"asset_identifier": "connect.com",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "medium",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Please note that connect.com will be sunset as of June 13, 2025. As a result, functionality associated with connect.com, even under api*.hubspot.com, will also be considered out of scope. In a case where a vulnerability stemming from connect.com results in compromise of HubSpot accounts or other features not associated with connect.com, those will be considered in-scope.",
"integrity_requirement": "medium",
"max_severity": "none"
},
{
"asset_identifier": "events.hubspot.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "ir.hubspot.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "shop.hubspot.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "thespot.hubspot.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "trust.hubspot.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
}
]
}
}api*.hubapi.com· criticalapi*.hubspot.com· criticalapp*.hubspot.com· criticalHubSpot iOS Mobile App· highCustomer Connected Domain· mediumCustomer Portal· lowHubSpot Android Mobile App· highHubSpot Sales Office 365 add-in· mediumOther HubSpot-owned (sub)domains not listed as Out of Scope· low