H1 HackerOne LIVE
Supabase
no bountyVDP
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://supabase.com
- managed triage
- no
- response efficiency
- 89%
- first response
- 50h avg
10 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.supabase.com | domain | no | critical | 2026-09-20 |
https://github.com/supabase-community/supabase-mcp | domain | no | critical | 2026-09-20 |
https://mcp.supabase.com/mcp | domain | no | critical | 2026-09-20 |
https://multiplayer.dev | domain | no | low | 2026-09-20 |
https://supabase.help | domain | no | none | 2026-09-20 |
https://supabase.link | domain | no | none | 2026-09-20 |
https://supabase.store | domain | no | medium | 2026-09-20 |
supabase.com | domain | no | critical | 2026-09-20 |
https://github.com/supabase | source code | no | critical | 2026-09-20 |
https://*.database.dev/ | wildcard | no | medium | 2026-09-20 |
8 out of scope — black ICE, don't touch
https://api.supabase.com/platform/pg-meta/project_id/querydomainhttps://ctf.supabase.comdomainhttps://supabase.dev/domainhttps://supabase.productions/domainsupabase.shdomainhttps://github.com/supabase-community/source codedb.*.supabase.cowildcardhttps://*.supabase.cowildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.