H1 HackerOne LIVE
Box BB
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://box.com
- managed triage
- yes
- response efficiency
- 97%
- first response
- 1h avg
- time to bounty
- 865h avg
12 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
account.box.com | domain | yes | critical | 2026-09-20 |
api.box.com | domain | yes | critical | 2026-09-20 |
app.box.com | domain | yes | critical | 2026-09-20 |
cloud.app.box.com | domain | yes | critical | 2026-09-20 |
dl.boxcloud.com | domain | yes | critical | 2026-09-20 |
m.box.com | domain | yes | critical | 2026-09-20 |
notes.services.box.com | domain | yes | critical | 2026-09-20 |
upload.box.com | domain | yes | critical | 2026-09-20 |
Android Box Mobile App | mobile | yes | critical | 2026-09-20 |
iOS Box Mobile App | mobile | yes | critical | 2026-09-20 |
Box Drive | other | yes | critical | 2026-09-20 |
Box Tools | other | yes | critical | 2026-09-20 |
2 out of scope — black ICE, don't touch
signrequest.comdomainsr-staging-1.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.