H1 HackerOne LIVE
Spotify
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://spotify.com
- managed triage
- yes
- response efficiency
- 82%
- first response
- 86h avg
- time to bounty
- 1396h avg
43 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api-partner.spotify.com | api | yes | critical | 2026-09-20 |
api.spotify.com | domain | yes | critical | 2026-09-20 |
assets.spotify.com | domain | yes | critical | 2026-09-20 |
backstage.io | domain | yes | medium | 2026-09-20 |
https://www.whosampled.com/ | domain | yes | critical | 2026-09-20 |
Save to Spotify CLI | executable | yes | critical | 2026-09-20 |
Spotify desktop application (Windows and Mac) | executable | yes | critical | 2026-09-20 |
com.anchorfminc.Anchor | mobile | yes | critical | 2026-09-20 |
com.spotify.client | mobile | yes | critical | 2026-09-20 |
com.spotify.kids | mobile | yes | critical | 2026-09-20 |
com.spotify.music | mobile | yes | critical | 2026-09-20 |
com.spotify.s4a | mobile | yes | critical | 2026-09-20 |
com.spotify.tv.android | mobile | yes | critical | 2026-09-20 |
fm.anchor.android | mobile | yes | critical | 2026-09-20 |
Anchor | other | yes | critical | 2026-09-20 |
Core Assets | other | yes | critical | 2026-09-20 |
DRM (Digital Rights Management) System | other | yes | critical | 2026-09-20 |
GHE | other | yes | critical | 2026-09-20 |
Jira | other | yes | critical | 2026-09-20 |
Megaphone | other | yes | critical | 2026-09-20 |
Non-Core Assets | other | yes | critical | 2026-09-20 |
Okta | other | yes | critical | 2026-09-20 |
Other Spotify websites | other | yes | critical | 2026-09-20 |
Podsights | other | yes | critical | 2026-09-20 |
Sonantic | other | yes | critical | 2026-09-20 |
VPN | other | yes | critical | 2026-09-20 |
Wrapped | other | yes | critical | 2026-09-20 |
Android SDK | source code | yes | critical | 2026-09-20 |
Core Backstage source code | source code | yes | critical | 2026-09-20 |
Spotify SDKs | source code | yes | critical | 2026-09-20 |
Web Playback SDK | source code | yes | critical | 2026-09-20 |
https://github.com/backstage/backstage | source code | yes | medium | 2026-09-20 |
iOS SDK | source code | yes | critical | 2026-09-20 |
*.atspotify.com | wildcard | yes | low | 2026-09-20 |
*.avecspotify.com | wildcard | yes | low | 2026-09-20 |
*.byspotify.com | wildcard | yes | low | 2026-09-20 |
*.enspotify.com | wildcard | yes | low | 2026-09-20 |
*.forspotify.com | wildcard | yes | low | 2026-09-20 |
*.fromspotify.com | wildcard | yes | low | 2026-09-20 |
*.spotify.com | wildcard | yes | critical | 2026-09-20 |
*.spotify.net | wildcard | yes | critical | 2026-09-20 |
*.tospotify.com | wildcard | yes | low | 2026-09-20 |
*.withspotify.com | wildcard | yes | low | 2026-09-20 |
7 out of scope — black ICE, don't touch
everynoise.comdomainexample.comdomaincom.soundtrap.studioappmobileFindawayotherPreactotherSoundtrapotherThe Ringerother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.