H1 HackerOne LIVE
GitLab
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://about.gitlab.com
- managed triage
- yes
- response efficiency
- 72%
- first response
- 3h avg
- time to bounty
- 999h avg
19 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
about.gitlab.com | domain | yes | medium | 2026-09-20 |
advisories.gitlab.com | domain | yes | medium | 2026-09-20 |
customers.gitlab.com | domain | yes | critical | 2026-09-20 |
design.gitlab.com | domain | yes | medium | 2026-09-20 |
docs.gitlab.com | domain | yes | medium | 2026-09-20 |
gitlab.com | domain | yes | critical | 2026-09-20 |
registry.gitlab.com | domain | yes | critical | 2026-09-20 |
GitLab for Jira Cloud | other | yes | medium | 2026-09-20 |
Other non-production infrastructure | other | yes | medium | 2026-09-20 |
Your Own GitLab Instance | other | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitaly | source code | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitlab | source code | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitlab-pages | source code | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitlab-runner | source code | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitlab-shell | source code | yes | critical | 2026-09-20 |
https://gitlab.com/gitlab-org/gitlab-vscode-extension | source code | yes | critical | 2026-09-20 |
*.gitlab.net | wildcard | yes | medium | 2026-09-20 |
*.gitlab.org | wildcard | yes | medium | 2026-09-20 |
*.gitlap.com | wildcard | yes | medium | 2026-09-20 |
25 out of scope — black ICE, don't touch
alerts.gitlab.comdomainaptly.gitlab.comdomaindashboards.gitlab.comdomainfederal-support.gitlab.comdomainforum.gitlab.comdomaingitlab.biterg.iodomaingitlabdemo.clouddomaingitlabsandbox.netdomaingitlabtraining.clouddomainir.gitlab.comdomainlevelup.gitlab.comdomainpackages.gitlab.comdomainpartners.gitlab.comdomainshop.gitlab.comdomainstatus.gitlab.comdomainsupport.gitlab.comdomaintranslate.gitlab.comdomainus-federal-gitlab.comdomainhttps://gitlab.com/gitlab-org/cli/source codehttps://gitlab.com/gitlab-org/opstrace/opstracesource codehttps://gitlab.com/gitlab-org/opstrace/opstrace-uisource code*.gitlab-private.orgwildcard*.gitlab.cnwildcard*.runway.gitlab.netwildcard*.service-now.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.