Bug bounty program

Slack

Platform: HackerOne
Bounties: Pays
Assets in scope: 19
Disclosed reports: 133
Subdomains: 137,436
Vendor on CyberSIXT: Slack (3 CVEs, 0 exploited)

Most upvoted reports133

Most upvoted reports of Slack
Report	Weakness	Disclosed	Bounty	Votes
Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesAnalysed#737140	Injection and Smuggling	2020-03-12	–	870
Remote Code Execution in Slack desktop apps + bonusAnalysed#783877	Command and Code Injection	2020-08-28	–	509
XSS vulnerable parameter in a location hashAnalysed#146336	Cross-site Scripting	2019-10-16	–	455
URL link spoofingAnalysed#481472	Input Validation and Logic	2020-04-26	$250	362
TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesAnalysed#333419	Server-Side Request Forgery	2020-03-12	$3,500	323
AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822	Information Disclosure	2019-02-23	$1,500	321
Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032	Cryptography	2020-03-12	$2,000	170
XSS in gist integrationAnalysed#11073	Cross-site Scripting	2019-04-28	$500	157
Unauthenticated LFI revealing log informationAnalysed#272578	Information Disclosure	2018-01-26	–	123
Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainAnalysed#207170	Misconfiguration and Insecure Design	2017-02-28	–	120

Subdomains137,436

Root

Scope

Name suggests:Development

First seen:This month

Text fileClear filters3+ names

Subdomains of Slack
Name	Scope	First seen
files.dev.slack.comNewdata, dev	Not in the scope	2026-11-15
wss-backup.dev.slack.comNewdata, dev	Not in the scope	2026-11-15
wss-mobile.dev.slack.comNewdev	Not in the scope	2026-11-15

20,412 names are covered by the program's own scope; 7 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.