Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
8 in-scope
*.database.dev/· mediumapi.supabase.com· criticalmcp.supabase.com/mcp· criticalmultiplayer.dev· lowsupabase.help· nonesupabase.link· nonesupabase.com· criticalgithub.com/supabase· critical− removed 2 scopes · https://github.com/supabase-community/supabase-mcp, https://supabase.store
13d ago
first indexed
92d ago · 10 in-scope assets
No reports yet. Be the first to share your triage timing for Supabase.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/supabase",
"name": "Supabase",
"handle": "supabase",
"targets": {
"in_scope": [
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "api.supabase.com",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "WILDCARD",
"instruction": "The database package manager for Trusted Language extensions.",
"max_severity": "medium",
"asset_identifier": "https://*.database.dev/",
"eligible_for_bounty": false,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "medium"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "https://github.com/supabase",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "Please consult our docs about this resource: https://supabase.com/docs/guides/getting-started/mcp\n\n`SQL injection` on the `executeSQL` function will not be accepted. This is intended functionality. ",
"max_severity": "critical",
"asset_identifier": "https://mcp.supabase.com/mcp",
"eligible_for_bounty": false,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "https://nixfbjgqturwbakhnwym.supabase.co\n\nDemo application showcasing Supabase Realtime",
"max_severity": "low",
"asset_identifier": "https://multiplayer.dev",
"eligible_for_bounty": false,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "URL",
"instruction": "Redirects to the Supabase dashboard for creating support tickets",
"max_severity": "none",
"asset_identifier": "https://supabase.help",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "URL shortener for branded links",
"max_severity": "none",
"asset_identifier": "https://supabase.link",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "supabase.com",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
}
],
"out_of_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Supabase database domains belonging to our customers.\nTest only domains belonging to your own account. Domains that are part of your account are in-scope",
"max_severity": "none",
"asset_identifier": "db.*.supabase.co",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Supabase Product APIs and database domains belonging to our customers.\nTest only domains belonging to your own account. Domains that are part of your account are in-scope",
"max_severity": "none",
"asset_identifier": "https://*.supabase.co",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": false,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "This is intended to take raw SQL queries. This end-point is not \"SQL injectable\". The ability to escalate privileges via this end-point is a valid issue, but executing SQL is not.",
"max_severity": "none",
"asset_identifier": "https://api.supabase.com/platform/pg-meta/project_id/query",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Capture the Flag leaderboard",
"max_severity": "none",
"asset_identifier": "https://ctf.supabase.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://github.com/supabase-community/",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "Supabase Contributor Portal - Guide for contributing to Supabase",
"max_severity": "none",
"asset_identifier": "https://supabase.dev/",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "The official Supabase album",
"max_severity": "none",
"asset_identifier": "https://supabase.productions/",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Website for purchasing Supabase Swag.",
"max_severity": "none",
"asset_identifier": "https://supabase.store",
"eligible_for_bounty": false,
"integrity_requirement": "medium",
"eligible_for_submission": false,
"availability_requirement": "low",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "This allows command execution (ssh supabase.sh) and this is expected behaviour. This is sandboxed and not attached to the Supabase platform in any way",
"max_severity": "none",
"asset_identifier": "supabase.sh",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
}
]
},
"website": "https://supabase.com",
"offers_swag": false,
"managed_program": false,
"offers_bounties": false,
"submission_state": "open",
"allows_bounty_splitting": false,
"average_time_to_bounty_awarded": null,
"response_efficiency_percentage": 78,
"average_time_to_report_resolved": 315,
"average_time_to_first_program_response": 65
}