1password

HackerOneView on HackerOne
RawAI Enhanced
4
In Scope
4
Out of Scope
In-Scope Assets (4)
AssetCategoryBountyQuick Links
<Your own 1Password account> —> Latest stable, beta, or nightly Browser Extension (Chrome, Brave, Firefox, Edge, and Safari)OTHERYes-
<Your own 1Password account> —> Latest stable, beta, or nightly Command Line Interface (CLI)OTHERYes-
http://--your-own-1password-account--.1password.comURLYes
https://events.1password.com/api/URLYes
Out-of-Scope Assets (4)
AssetCategoryBounty
*.agilebits.comWILDCARDNo
All other domains, subdomains, and 1Password Accounts that are not owned by you, including accounts where you are a user but not the owner, are out of scope.OTHERNo
https://support.1password.comURLNo
https://www.1password.com/URLNo
Scope Changes (20)
Feb 25, 2026
ChangeAssetCategoryScopeTime
Addedhttps://support.1password.comURLOut of Scope19:20
Added*.agilebits.comWILDCARDOut of Scope19:20
Addedhttps://events.1password.com/apiURLIn Scope19:20
Addedhttps://www.1password.com/URLOut of Scope19:20
Addedall other domains, subdomains, and 1password accounts that are not owned by you, including accounts where you are a user but not the owner, are out of scopeOTHEROut of Scope19:20
Addedhttp://--your-own-1password-account--.1password.comURLIn Scope19:20
Added<your own 1password account> —> latest stable, beta, or nightly command line interface (cli)OTHERIn Scope19:20
Added<your own 1password account> —> latest stable, beta, or nightly browser extension (chrome, brave, firefox, edge, and safari)OTHERIn Scope19:20
Feb 22, 2026
ChangeAssetCategoryScopeTime
Addedhttp://--your-own-1password-account--.1password.comURLIn Scope00:48
Added<your own 1password account> —> latest stable, beta, or nightly browser extension (chrome, brave, firefox, edge, and safari)OTHERIn Scope00:48
Addedhttps://events.1password.com/apiURLIn Scope00:48
Added*.agilebits.comWILDCARDOut of Scope00:48
Addedhttps://support.1password.comURLOut of Scope00:48
Addedhttps://www.1password.com/URLOut of Scope00:48
Addedall other domains, subdomains, and 1password accounts that are not owned by you, including accounts where you are a user but not the owner, are out of scopeOTHEROut of Scope00:48
Added<your own 1password account> —> latest stable, beta, or nightly command line interface (cli)OTHERIn Scope00:48
Feb 21, 2026
ChangeAssetCategoryScopeTime
Removedhttp://--your-own-1password-account--.1password.comURLIn Scope21:40
Removedhttps://events.1password.com/apiURLIn Scope21:40
Removed<your own 1password account> —> latest stable, beta, or nightly browser extension (chrome, brave, firefox, edge, and safari)OTHERIn Scope21:40
Removed<your own 1password account> —> latest stable, beta, or nightly command line interface (cli)OTHERIn Scope21:40