Program Removed

This program is no longer available on HackerOne. The scope data shown below is historical and may not reflect the final state of the program.

metamask

HackerOneView on HackerOne

RawAI Enhanced

In Scope

Out of Scope

In-Scope Assets (21)

Asset	Category	Bounty	Quick Links
api-dashboard.web3auth.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
api-wallet.web3auth.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
api.cx.metamask.io	WILDCARD	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
dashboard.web3auth.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
developer.metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
https://github.com/web3auth/web3auth-web	CODE	Yes	-
https://metamask.github.io/phishing-warning/%3Cvx.y.z%3E	OTHER	Yes	-
https://user-storage.api.cx.metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
io.metamask	ANDROID	Yes	Play Store APKPure APKMirror
io.metamask.metamask	IOS	Yes	-
message signing snap	OTHER	Yes	-
metamask browser extension	OTHER	Yes	-
metamask sdk	OTHER	Yes	-
metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
metamask.io	WILDCARD	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
portfolio.metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
signature-insights.api.cx.metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
snaps	OTHER	Yes	-
snaps development packages	CODE	Yes	-
snaps.metamask.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
wallet.web3auth.io	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa

Out-of-Scope Assets (34)

Asset	Category	Bounty
api.cx.metamask.io	OTHER	No
app.metamask.io	URL	No
authentication.api.cx.metamask.io	OTHER	No
card.metamask.io	URL	No
community.metamask.io	URL	No
https://chrome.google.com/webstore/detail/metamask-flask-developmen/ljfoeinjpaedjfecbmggjgodbgkmjkjk	OTHER	No
https://metamask.github.io/	OTHER	No
https://metamask.github.io/phishing-warning/vx.y.z	OTHER	No
https://mmi-support.metamask.io	URL	No
https://snaps.metamask.io	WILDCARD	No
https://support.metamask.io	URL	No
message signing snap	OTHER	No
metamask extension	OTHER	No
metamask flask extension	OTHER	No
metamask mobile (io.metamask.metamask, io.metamask)	OTHER	No
metamask sdk	OTHER	No
metamask snaps	OTHER	No
metamask.io	OTHER	No
metamask.io	WILDCARD	No
musd stablecoin	OTHER	Yes
oidc.api.cx.metamask.io	OTHER	No
permissionless.snaps.metamask.io	URL	No
portfolio.metamask.io	OTHER	No
portfolio.metamask.io	URL	No
portfolio.metamask.io (app.metamask.io)	URL	No
signature-insights.api.cx.metamask.io	OTHER	No
snaps development packages	WILDCARD	No
third party snaps	OTHER	No
travel.metamask.io	URL	No
user-storage.api.cx.metamask.io	OTHER	No
vulnerabilities within npm packages in the @metamask namespace that do not pose a risk to metamask users	OTHER	No
web3auth dashboard and its api	OTHER	No
web3auth sdk	OTHER	No
web3auth wallet services and its api	OTHER	No

Scope Changes (153)

Oct 5, 2026

Change	Asset	Category	Scope	Time
Program Removed	—	—	—	14:17

Sep 25, 2026

Change	Asset	Category	Scope	Time
Removed	*.metamask.io	WILDCARD	Out of Scope	13:10

Sep 4, 2026

Change	Asset	Category	Scope	Time
Removed	core tier assets	OTHER	Out of Scope	15:55
Removed	non-core tier assets	OTHER	Out of Scope	15:55
Removed	*.metamask.io	WILDCARD	Out of Scope	15:55
Removed	*.api.cx.metamask.io	WILDCARD	Out of Scope	15:55

May 14, 2026

Change	Asset	Category	Scope	Time
Removed	core tier assets	OTHER	Out of Scope	13:27

May 13, 2026

Change	Asset	Category	Scope	Time
Removed	https://github.com/Web3Auth/web3auth-web	CODE	Out of Scope	10:27

Apr 30, 2026

Change	Asset	Category	Scope	Time
Removed	portfolio.metamask.io	URL	Out of Scope	09:27
Added	portfolio.metamask.io (app.metamask.io)	URL	Out of Scope	09:27
Added	portfolio.metamask.io (app.metamask.io)	URL	Out of Scope	09:27
Added	portfolio.metamask.io (app.metamask.io)	URL	Out of Scope	09:27

Mar 6, 2026

Change	Asset	Category	Scope	Time
Removed	core tier assets	OTHER	Out of Scope	13:40
Removed	snaps development packages	CODE	Out of Scope	13:40
Removed	portfolio.metamask.io	URL	Out of Scope	13:40
Removed	api-dashboard.web3auth.io	URL	Out of Scope	13:40
Removed	dashboard.web3auth.io	URL	Out of Scope	13:40
Removed	message signing snap	OTHER	Out of Scope	13:40
Removed	developer.metamask.io	URL	Out of Scope	13:40
Removed	https://user-storage.api.cx.metamask.io	URL	Out of Scope	13:40
Removed	non-core tier assets	OTHER	Out of Scope	13:40

Feb 25, 2026

Change	Asset	Category	Scope	Time
Added	non-core tier assets	WILDCARD	Out of Scope	19:16
Added	https://www.npmjs.com/search?q=%40metamask	OTHER	Out of Scope	19:16
Added	metamask flask extension	OTHER	Out of Scope	19:16
Added	metamask flask extension	OTHER	Out of Scope	19:16
Added	*.metamask.io	WILDCARD	In Scope	19:16
Added	api-dashboard.web3auth.io	URL	In Scope	19:16
Added	wallet.web3auth.io	URL	In Scope	19:16
Added	https://support.metamask.io/	URL	Out of Scope	19:16
Added	card.metamask.io	URL	Out of Scope	19:16
Added	portfolio.metamask.io	URL	In Scope	19:16
Added	*.api.cx.metamask.io	WILDCARD	In Scope	19:16
Added	message signing snap	OTHER	In Scope	19:16
Added	metamask sdk	OTHER	In Scope	19:16
Added	metamask.io	URL	In Scope	19:16
Added	io.metamask.metamask	IOS	In Scope	19:16
Added	dashboard.web3auth.io	URL	In Scope	19:16
Added	community.metamask.io	URL	Out of Scope	19:16
Added	permissionless.snaps.metamask.io	URL	Out of Scope	19:16
Added	signature-insights.api.cx.metamask.io	URL	In Scope	19:16
Added	https://mmi-support.metamask.io/	URL	Out of Scope	19:16
Added	https://metamask.github.io/phishing-warning/%3CvX.Y.Z%3E	OTHER	In Scope	19:16
Added	snaps.metamask.io	URL	In Scope	19:16
Added	travel.metamask.io	URL	Out of Scope	19:16
Added	https://user-storage.api.cx.metamask.io	URL	In Scope	19:16
Added	developer.metamask.io	URL	In Scope	19:16
Added	metamask browser extension	OTHER	In Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	third party snaps	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	wallet tier assets	OTHER	Out of Scope	19:16
Added	wallet tier assets	OTHER	Out of Scope	19:16
Added	wallet tier assets	OTHER	Out of Scope	19:16
Added	snaps development packages	CODE	In Scope	19:16
Added	core tier assets	OTHER	Out of Scope	19:16
Added	https://github.com/Web3Auth/web3auth-web	CODE	In Scope	19:16
Added	snaps	OTHER	In Scope	19:16
Added	io.metamask	ANDROID	In Scope	19:16
Added	musd stablecoin	OTHER	Out of Scope	19:16
Added	api-wallet.web3auth.io	URL	In Scope	19:16
Added	https://metamask.github.io/	OTHER	Out of Scope	19:16
Added	non-core tier assets	WILDCARD	Out of Scope	19:16
Added	non-core tier assets	WILDCARD	Out of Scope	19:16

Feb 22, 2026

Change	Asset	Category	Scope	Time
Added	card.metamask.io	URL	Out of Scope	00:45
Added	https://metamask.github.io/phishing-warning/%3CvX.Y.Z%3E	OTHER	In Scope	00:45
Added	io.metamask.metamask	IOS	In Scope	00:45
Added	musd stablecoin	OTHER	In Scope	00:45
Added	dashboard.web3auth.io	URL	In Scope	00:45
Added	https://github.com/Web3Auth/web3auth-web	CODE	In Scope	00:45
Added	https://www.npmjs.com/search?q=%40metamask	OTHER	Out of Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	snaps development packages	CODE	In Scope	00:45
Added	https://user-storage.api.cx.metamask.io	URL	In Scope	00:45
Added	io.metamask	ANDROID	In Scope	00:45
Added	snaps	OTHER	In Scope	00:45
Added	*.metamask.io	WILDCARD	In Scope	00:45
Added	*.api.cx.metamask.io	WILDCARD	In Scope	00:45
Added	https://support.metamask.io/	URL	Out of Scope	00:45
Added	metamask flask extension	OTHER	Out of Scope	00:45
Added	metamask flask extension	OTHER	Out of Scope	00:45
Added	snaps.metamask.io	URL	In Scope	00:45
Added	wallet.web3auth.io	URL	In Scope	00:45
Added	https://mmi-support.metamask.io/	URL	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	core tier assets	OTHER	Out of Scope	00:45
Added	non-core tier assets	WILDCARD	Out of Scope	00:45
Added	non-core tier assets	WILDCARD	Out of Scope	00:45
Added	non-core tier assets	WILDCARD	Out of Scope	00:45
Added	message signing snap	OTHER	In Scope	00:45
Added	api-dashboard.web3auth.io	URL	In Scope	00:45
Added	api-wallet.web3auth.io	URL	In Scope	00:45
Added	permissionless.snaps.metamask.io	URL	Out of Scope	00:45
Added	wallet tier assets	OTHER	Out of Scope	00:45
Added	wallet tier assets	OTHER	Out of Scope	00:45
Added	wallet tier assets	OTHER	Out of Scope	00:45
Added	travel.metamask.io	URL	Out of Scope	00:45
Added	metamask sdk	OTHER	In Scope	00:45
Added	third party snaps	OTHER	Out of Scope	00:45
Added	developer.metamask.io	URL	In Scope	00:45
Added	https://metamask.github.io/	OTHER	Out of Scope	00:45
Added	signature-insights.api.cx.metamask.io	URL	In Scope	00:45
Added	metamask.io	URL	In Scope	00:45
Added	metamask browser extension	OTHER	In Scope	00:45
Added	community.metamask.io	URL	Out of Scope	00:45
Added	portfolio.metamask.io	URL	In Scope	00:45

Feb 21, 2026

Change	Asset	Category	Scope	Time
Removed	portfolio.metamask.io	URL	In Scope	21:38
Removed	io.metamask.metamask	IOS	In Scope	21:38
Removed	metamask browser extension	OTHER	In Scope	21:38
Removed	musd stablecoin	OTHER	In Scope	21:38
Removed	dashboard.web3auth.io	URL	In Scope	21:38
Removed	api-dashboard.web3auth.io	URL	In Scope	21:38
Removed	https://github.com/Web3Auth/web3auth-web	CODE	In Scope	21:38
Removed	wallet.web3auth.io	URL	In Scope	21:38
Removed	api-wallet.web3auth.io	URL	In Scope	21:38
Removed	io.metamask	ANDROID	In Scope	21:38
Removed	metamask.io	URL	In Scope	21:38
Removed	signature-insights.api.cx.metamask.io	URL	In Scope	21:38
Removed	developer.metamask.io	URL	In Scope	21:38
Removed	message signing snap	OTHER	In Scope	21:38
Removed	metamask sdk	OTHER	In Scope	21:38
Removed	https://user-storage.api.cx.metamask.io	URL	In Scope	21:38
Removed	*.api.cx.metamask.io	WILDCARD	In Scope	21:38
Removed	*.metamask.io	WILDCARD	In Scope	21:38
Removed	snaps development packages	CODE	In Scope	21:38
Removed	snaps.metamask.io	URL	In Scope	21:38
Removed	snaps	OTHER	In Scope	21:38
Removed	https://metamask.github.io/phishing-warning/%3CvX.Y.Z%3E	OTHER	In Scope	21:38
Added	third party snaps	OTHER	In Scope	19:12