Skip to content
Connect AISign inSign up free

Bug bounty program

SL

Slack

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
19
Disclosed reports
133
Subdomains
137,436
Vendor on CyberSIXT
Slack (3 CVEs, 0 exploited)

Most upvoted reports133

All reports
Most upvoted reports of Slack
ReportWeaknessDisclosedBountyVotes
Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesAnalysed#737140Injection and Smuggling2020-03-12–870
Remote Code Execution in Slack desktop apps + bonusAnalysed#783877Command and Code Injection2020-08-28–509
XSS vulnerable parameter in a location hashAnalysed#146336Cross-site Scripting2019-10-16–455
URL link spoofingAnalysed#481472Input Validation and Logic2020-04-26$250362
TURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesAnalysed#333419Server-Side Request Forgery2020-03-12$3,500323
AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822Information Disclosure2019-02-23$1,500321
Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032Cryptography2020-03-12$2,000170
XSS in gist integrationAnalysed#11073Cross-site Scripting2019-04-28$500157
Unauthenticated LFI revealing log informationAnalysed#272578Information Disclosure2018-01-26–123
Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainAnalysed#207170Misconfiguration and Insecure Design2017-02-28–120

Subdomains137,436

Root
Scope:In scope
Name suggests:Test and QA
First seen
Text fileClear filters134+ names
Subdomains of Slack
NameScopeFirst seen
api-test.quip.comapi, testIn scope2026-11-14
budget-test.quip.comtestIn scope2026-11-14
demo.quip.comtestIn scope2026-11-14
autoconfig.demo.quip.comtestIn scope2026-11-14
autodiscover.demo.quip.commail, testIn scope2026-11-14
ftp.demo.quip.comdata, testIn scope2026-11-14
ipv4.demo.quip.comtestIn scope2026-11-14
m.demo.quip.comtestIn scope2026-11-14
ns.demo.quip.comtestIn scope2026-11-14
webdisk.demo.quip.comtestIn scope2026-11-14
webmail.demo.quip.commail, testIn scope2026-11-14
www.demo.quip.comtestIn scope2026-11-14
demo01.quip.comtestIn scope2026-11-14
demo02.quip.comtestIn scope2026-11-14
demo1.quip.comtestIn scope2026-11-14
www.demo1.quip.comtestIn scope2026-11-14
demo10.quip.comtestIn scope2026-11-14
demo11.quip.comtestIn scope2026-11-14
demo12.quip.comtestIn scope2026-11-14
demo13.quip.comtestIn scope2026-11-14
demo14.quip.comtestIn scope2026-11-14
demo15.quip.comtestIn scope2026-11-14
demo16.quip.comtestIn scope2026-11-14
demo17.quip.comtestIn scope2026-11-14
demo18.quip.comtestIn scope2026-11-14
demo19.quip.comtestIn scope2026-11-14
demo2.quip.comtestIn scope2026-11-14
www.demo2.quip.comtestIn scope2026-11-14
demo3.quip.comtestIn scope2026-11-14
www.demo3.quip.comtestIn scope2026-11-14
demo4.quip.comtestIn scope2026-11-14
demo5.quip.comtestIn scope2026-11-14
demo6.quip.comtestIn scope2026-11-14
demo7.quip.comtestIn scope2026-11-14
demo8.quip.comtestIn scope2026-11-14
demo9.quip.comtestIn scope2026-11-14
forum-test.quip.comtestIn scope2026-11-14
idp-test.quip.comauth, testIn scope2026-11-14
qa.legacy.quip.comlegacy, testIn scope2026-11-14
m-test.quip.comtestIn scope2026-11-14
test.m.quip.comtestIn scope2026-11-14
mobile-test.quip.comtestIn scope2026-11-14
qa.quip.comtestIn scope2026-11-14
qa-partner-portal.quip.comtestIn scope2026-11-14
qa-verio-portal.quip.comtestIn scope2026-11-14
www.qa.quip.comtestIn scope2026-11-14
quip-demo-org-qebn8d.quip.comtestIn scope2026-11-14
sandbox.quip.comtestIn scope2026-11-14
autoconfig.sandbox.quip.comtestIn scope2026-11-14
autodiscover.sandbox.quip.commail, testIn scope2026-11-14
webdisk.sandbox.quip.comtestIn scope2026-11-14
www.sandbox.quip.comtestIn scope2026-11-14
sandbox1.quip.comtestIn scope2026-11-14
sandbox2.quip.comtestIn scope2026-11-14
qa.secure.quip.comtestIn scope2026-11-14
test.secure.quip.comtestIn scope2026-11-14
test.shop.quip.comtestIn scope2026-11-14
sit.quip.comtestIn scope2026-11-14
test.support.quip.comtestIn scope2026-11-14
test.quip.comtestIn scope2026-11-14
test-m.quip.comtestIn scope2026-11-14
test-www.quip.comtestIn scope2026-11-14
admin.test.quip.comadmin, testIn scope2026-11-14
api.test.quip.comapi, testIn scope2026-11-14
autoconfig.test.quip.comtestIn scope2026-11-14
autodiscover.test.quip.commail, testIn scope2026-11-14
ftp.test.quip.comdata, testIn scope2026-11-14
m.test.quip.comtestIn scope2026-11-14
mail.test.quip.commail, testIn scope2026-11-14
ns.test.quip.comtestIn scope2026-11-14
webdisk.test.quip.comtestIn scope2026-11-14
webmail.test.quip.commail, testIn scope2026-11-14
www.test.quip.comtestIn scope2026-11-14
test001.quip.comtestIn scope2026-11-14
test002.quip.comtestIn scope2026-11-14
test007.quip.comtestIn scope2026-11-14
test01.quip.comtestIn scope2026-11-14
test02.quip.comtestIn scope2026-11-14
test03.quip.comtestIn scope2026-11-14
test04.quip.comtestIn scope2026-11-14
test07.quip.comtestIn scope2026-11-14
test1.quip.comtestIn scope2026-11-14
test10.quip.comtestIn scope2026-11-14
test11.quip.comtestIn scope2026-11-14
test111.quip.comtestIn scope2026-11-14
test12.quip.comtestIn scope2026-11-14
test123.quip.comtestIn scope2026-11-14
test1234.quip.comtestIn scope2026-11-14
test13.quip.comtestIn scope2026-11-14
test14.quip.comtestIn scope2026-11-14
test15.quip.comtestIn scope2026-11-14
test16.quip.comtestIn scope2026-11-14
test17.quip.comtestIn scope2026-11-14
test18.quip.comtestIn scope2026-11-14
test19.quip.comtestIn scope2026-11-14
test2.quip.comtestIn scope2026-11-14
test2-0.quip.comtestIn scope2026-11-14
www.test2.quip.comtestIn scope2026-11-14
test20.quip.comtestIn scope2026-11-14
test22.quip.comtestIn scope2026-11-14

20,412 names are covered by the program's own scope; 7 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated