upwork
12
In Scope
14
Out of Scope
In-Scope Assets (12)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| Direct Contracts | URL | Yes | - | |
| Upwork - Android Application | ANDROID | Yes | - | |
| Upwork - Marketplace Portal | URL | Yes | - | |
| Upwork - Messages | URL | Yes | - | |
| Upwork - Mobile Application Android | ANDROID | Yes | - | |
| Upwork - Mobile Application IOS | IOS | Yes | - | |
| Upwork - api.upwork.com/graphql | URL | Yes | - | |
| Upwork - iOS Application | IOS | Yes | - | |
| Upwork Dash Messenger Desktop Version (www.upwork.com/downloads) | HARDWARE | Yes | - | |
| api.upwork.com/graphql | URL | Yes | ||
| https://www.upwork.com | URL | Yes | ||
| www.upwork.com/api | URL | Yes |
Out-of-Scope Assets (14)
| Asset | Category | Bounty | |
|---|---|---|---|
| Any Third-party Services | OTHER | Yes | |
| Any subdomain/domain/property not listed in the 'in scope' section, is out of scope. | OTHER | Yes | |
| Social media hijacking | OTHER | Yes | |
| careers.upwork.com | OTHER | Yes | |
| community.stage.upwork.com | OTHER | Yes | |
| community.upwork.com | OTHER | Yes | |
| e.upwork.com | OTHER | Yes | |
| pardot.upwork.com | OTHER | Yes | |
| signature.upwork.com | OTHER | Yes | |
| stage.upwork.com | OTHER | Yes | |
| status.upwork.com | OTHER | Yes | |
| support.upwork.com | OTHER | Yes | |
| tip.upwork.com | URL | Yes | |
| tip.upwork.com | OTHER | Yes |
Scope Changes (131)
Mar 5, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | support.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | community.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | stage.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | e.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | status.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | signature.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | careers.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | tip.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - mobile application ios | IOS | In Scope | 22:31 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 22:31 |
| Added | upwork - android application | ANDROID | In Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 22:31 |
| Added | www.upwork.com/api | URL | In Scope | 22:31 |
| Added | upwork - messages | URL | In Scope | 22:31 |
| Added | tip.upwork.com | URL | Out of Scope | 22:31 |
| Added | api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | community.upwork.com | URL | Out of Scope | 22:31 |
| Added | signature.upwork.com | URL | Out of Scope | 22:31 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 22:31 |
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | https://www.upwork.com | URL | In Scope | 22:31 |
| Added | direct contracts | URL | In Scope | 22:31 |
| Added | upwork - marketplace portal | URL | In Scope | 22:31 |
| Added | any third-party services | OTHER | Out of Scope | 22:31 |
| Added | stage.upwork.com | URL | Out of Scope | 22:31 |
| Added | e.upwork.com | URL | Out of Scope | 22:31 |
| Added | status.upwork.com | URL | Out of Scope | 22:31 |
| Added | careers.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - mobile application android | ANDROID | In Scope | 22:31 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 22:31 |
| Added | social media hijacking | OTHER | Out of Scope | 22:31 |
| Added | support.upwork.com | URL | Out of Scope | 22:31 |
| Added | community.stage.upwork.com | URL | Out of Scope | 22:31 |
| Added | upwork - ios application | IOS | In Scope | 22:31 |
Feb 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | upwork - marketplace portal | URL | In Scope | 19:14 |
| Added | upwork - ios application | IOS | In Scope | 19:14 |
| Added | social media hijacking | OTHER | Out of Scope | 19:14 |
| Added | any third-party services | OTHER | Out of Scope | 19:14 |
| Added | community.stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | e.upwork.com | URL | Out of Scope | 19:14 |
| Added | status.upwork.com | URL | Out of Scope | 19:14 |
| Added | careers.upwork.com | URL | Out of Scope | 19:14 |
| Added | www.upwork.com/api | URL | In Scope | 19:14 |
| Added | direct contracts | URL | In Scope | 19:14 |
| Added | api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | upwork - messages | URL | In Scope | 19:14 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 19:14 |
| Added | support.upwork.com | URL | Out of Scope | 19:14 |
| Added | upwork - android application | ANDROID | In Scope | 19:14 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 19:14 |
| Added | upwork - mobile application ios | IOS | In Scope | 19:14 |
| Added | upwork - mobile application android | ANDROID | In Scope | 19:14 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 19:14 |
| Added | stage.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | https://www.upwork.com | URL | In Scope | 19:14 |
| Added | community.upwork.com | URL | Out of Scope | 19:14 |
| Added | signature.upwork.com | URL | Out of Scope | 19:14 |
| Added | tip.upwork.com | URL | Out of Scope | 19:14 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 19:14 |
| Program Removed | — | — | — | 17:22 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | HARDWARE | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | community.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | stage.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | e.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | status.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | signature.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | careers.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | social media hijacking | OTHER | Out of Scope | 17:13 |
| Added | any subdomain/domain/property not listed in the 'in scope' section, is out of scope | OTHER | Out of Scope | 17:13 |
| Added | community.stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | signature.upwork.com | URL | Out of Scope | 17:13 |
| Added | careers.upwork.com | URL | Out of Scope | 17:13 |
| Added | pardot.upwork.com | OTHER | Out of Scope | 17:13 |
| Added | direct contracts | URL | In Scope | 17:13 |
| Added | upwork - marketplace portal | URL | In Scope | 17:13 |
| Added | upwork - api.upwork.com/graphql | URL | In Scope | 17:13 |
| Added | e.upwork.com | URL | Out of Scope | 17:13 |
| Added | status.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | https://www.upwork.com | URL | In Scope | 17:13 |
| Added | upwork - mobile application android | ANDROID | In Scope | 17:13 |
| Added | community.upwork.com | URL | Out of Scope | 17:13 |
| Added | tip.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - android application | ANDROID | In Scope | 17:13 |
| Added | upwork dash messenger desktop version (www.upwork.com/downloads) | URL | In Scope | 17:13 |
| Added | www.upwork.com/api | URL | In Scope | 17:13 |
| Added | upwork - messages | URL | In Scope | 17:13 |
| Added | upwork - mobile application ios | IOS | In Scope | 17:13 |
| Added | any third-party services | OTHER | Out of Scope | 17:13 |
| Added | support.upwork.com | URL | Out of Scope | 17:13 |
| Added | stage.upwork.com | URL | Out of Scope | 17:13 |
| Added | upwork - ios application | IOS | In Scope | 17:13 |