H1 HackerOne LIVE
HubSpot
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://hubspot.com
- managed triage
- yes
- response efficiency
- 73%
- first response
- 1h avg
- time to bounty
- 128h avg
15 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
chatspot.ai | domain | yes | medium | 2026-09-20 |
hubspot.net | domain | yes | medium | 2026-09-20 |
HubSpot Android Mobile App | mobile | yes | high | 2026-09-20 |
HubSpot iOS Mobile App | mobile | yes | high | 2026-09-20 |
Customer Connected Domain | other | yes | medium | 2026-09-20 |
Customer Portal | other | yes | low | 2026-09-20 |
HubSpot Sales Office 365 add-in | other | yes | medium | 2026-09-20 |
Other HubSpot-owned (sub)domains not listed as Out of Scope | other | yes | low | 2026-09-20 |
*.hs-sites(-eu1)?.com | wildcard | yes | low | 2026-09-20 |
*.hubspotemail.net | wildcard | yes | medium | 2026-09-20 |
*.hubspotpagebuilder.com | wildcard | yes | low | 2026-09-20 |
*.hubspotpagebuilder.eu | wildcard | yes | low | 2026-09-20 |
api*.hubapi.com | wildcard | yes | critical | 2026-09-20 |
api*.hubspot.com | wildcard | yes | critical | 2026-09-20 |
app*.hubspot.com | wildcard | yes | critical | 2026-09-20 |
6 out of scope — black ICE, don't touch
connect.comdomainevents.hubspot.comdomainir.hubspot.comdomainshop.hubspot.comdomainthespot.hubspot.comdomaintrust.hubspot.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.