Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Matomo.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": false,
"average_time_to_bounty_awarded": 173,
"average_time_to_first_program_response": 7,
"average_time_to_report_resolved": 165,
"handle": "matomo",
"id": 0,
"managed_program": false,
"name": "Matomo",
"offers_bounties": true,
"offers_swag": true,
"response_efficiency_percentage": 100,
"submission_state": "open",
"url": "https://hackerone.com/matomo",
"website": "https://matomo.org",
"targets": {
"in_scope": [
{
"asset_identifier": "737216887",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": true,
"instruction": "Matomo Mobile 2 iOS App\nOnly critical issues compromising the token are in scope.",
"integrity_requirement": "low",
"max_severity": "medium"
},
{
"asset_identifier": "https://github.com/innocraft/",
"asset_type": "SOURCE_CODE",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "All other software on the innocraft GitHub organisation. Archived or forked repositories are explicitly out of scope.",
"integrity_requirement": "not_defined",
"max_severity": "high"
},
{
"asset_identifier": "https://github.com/matomo-org",
"asset_type": "SOURCE_CODE",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "All other software on the matomo-org GitHub organisation not listed separately. Archived or forked repositories are explicitly out of scope.",
"integrity_requirement": "not_defined",
"max_severity": "high"
},
{
"asset_identifier": "https://github.com/matomo-org/developer-documentation",
"asset_type": "SOURCE_CODE",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Developer Documentation. Vulnerabilities are only in scope in case they affect https://developer.matomo.org/",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "https://github.com/matomo-org/docker",
"asset_type": "URL",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": " Official Docker project for Matomo Analytics ",
"integrity_requirement": "low",
"max_severity": "critical"
},
{
"asset_identifier": "https://github.com/matomo-org/matomo",
"asset_type": "SOURCE_CODE",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "this repository contains the source code of Matomo Analytics",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "https://github.com/matomo-org/tracker-proxy",
"asset_type": "SOURCE_CODE",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Matomo Tracker Proxy",
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "https://plugins.matomo.org/developer/innocraft",
"asset_type": "SOURCE_CODE",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Official plugins by Innocraft",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "https://plugins.matomo.org/developer/matomo-org",
"asset_type": "SOURCE_CODE",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Official plugins by the Matomo team",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "matomo.cloud",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Matomo Analytics Cloud\n*$username.matomo.cloud* is also in scope, but please limit tests to ones that don't affect the live instance. (no automated tools) You can easily set up your own Matomo instance for extensive testing (see https://matomo.org/docs/installation/) ",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "org.piwik.mobile2",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": true,
"instruction": "Matomo Mobile 2 Android App\nOnly critical issues compromising the token are in scope.",
"integrity_requirement": "low",
"max_severity": "medium"
}
],
"out_of_scope": [
{
"asset_identifier": "api.matomo.org",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "high",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "medium",
"max_severity": "none"
},
{
"asset_identifier": "forum.matomo.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Please don't post test posts on the forum.\nThe forum is using discourse, so please report any security issues [on their bug bounty](https://hackerone.com/discourse)",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "matomo.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Project website",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "plugins.matomo.org",
"asset_type": "URL",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "The Matomo Marketplace Platform is excluded from this bug bounty",
"integrity_requirement": "medium",
"max_severity": "none"
},
{
"asset_identifier": "shop.matomo.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
}
]
}
}737216887· mediumorg.piwik.mobile2· medium