H1 HackerOne LIVE
Netlify
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.netlify.com
- managed triage
- yes
- response efficiency
- 63%
- first response
- 25h avg
- time to bounty
- 277h avg
14 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.netlify.com | domain | yes | critical | 2026-09-20 |
app.netlify.com | domain | yes | critical | 2026-09-20 |
internal-docs.netlify.com | domain | yes | medium | 2026-09-20 |
internal.netlify.com | domain | yes | critical | 2026-09-20 |
list-v2--netlify-plugins.netlify.app | domain | yes | medium | 2026-09-20 |
netlify-cdp-loader.netlify.app | domain | yes | critical | 2026-09-20 |
netlify-rum.netlify.app | domain | yes | medium | 2026-09-20 |
screenshot-proxy.netlify.app | domain | yes | medium | 2026-09-20 |
supportal.netlify.app | domain | yes | medium | 2026-09-20 |
*.infra-prod.nsvcs.net | wildcard | yes | critical | 2026-09-20 |
*.onegraph.com | wildcard | yes | high | 2026-09-20 |
*.ops.netlify.com | wildcard | yes | critical | 2026-09-20 |
*.services-prod.nsvcs.net | wildcard | yes | critical | 2026-09-20 |
*.services.netlify.com | wildcard | yes | critical | 2026-09-20 |
8 out of scope — black ICE, don't touch
answers.netlify.comdomaindocs.netlify.comdomainhttps://github.com/netlify/domainwebpop.comdomainwww.netlify.comdomain*.netlify.appwildcard*.netlify.comwildcard*.netlifycms.orgwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.