NL
HackerOneOffers Rewards
Notion Labs, Inc.
Notion Labs, Inc. appears to run a bug bounty or vulnerability disclosure program on HackerOne. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (12)
Github Repositories or other public artifacts owned by makenotion
Notion AI ( We are particularly interested in the ability to access data the user lacks permission to view. Prompt engineering for inappropriate AI responses is out of scope. The usage of obfuscated or invisible characters to alter AI responses is in scope if security impact can be demonstrated. )
Notion Authentication
Notion Desktop App ( Any desktop app available for download at www.notion.so/desktop We only reward for the most recent version of the app. )
Notion Frontend ( Includes any resources served to or affects a user from notion.so/ or our marketing site on notion.so. )
Notion Integrations ( We are most interested in any CSRF in third-party integrations. )
Privilege Escalation ( We are particularly interested in the ability to access pages a given user should lack the ability to access. Additionally, if a page is available through “Anyone with a link at…” (permission grant), we are interested in cases where another user could access that page without explicitly receiving the link. )
Product API ( Includes resources at notion.so/api/v3. Attacks we are most interested in receiving reports about include: injection attacks, remote code execution, server-side request forgery, IDOR, and privilege escalation. This list is not exhaustive; please submit anything related to the API here. )
Public API ( Includes resources at [api.notion.com](https://api.notion.com/). We are particularly interested in the ability to escalate your privileges beyond the scope of our API tokens. )
calendar.notion.so
mail.notion.so
notion.id
Out of Scope (0)
No out-of-scope items specified