notion

HackerOneView on HackerOne
RawAI Enhanced
12
In Scope
0
Out of Scope
In-Scope Assets (12)
AssetCategoryBountyQuick Links
Github Repositories or other public artifacts owned by makenotionOTHERYes-
Notion AIAIYes-
Notion AuthenticationOTHERYes-
Notion Desktop AppBINARYYes-
Notion FrontendOTHERYes-
Notion IntegrationsOTHERYes-
Privilege EscalationOTHERYes-
Product APIOTHERYes-
Public APIOTHERYes-
calendar.notion.soURLYes
mail.notion.soURLYes
notion.idANDROIDYes
Scope Changes (36)
Feb 25, 2026
ChangeAssetCategoryScopeTime
Addedmail.notion.soURLIn Scope19:17
Addednotion authenticationOTHERIn Scope19:17
Addedpublic apiURLIn Scope19:17
Addedproduct apiURLIn Scope19:17
Addednotion frontendURLIn Scope19:17
Addednotion desktop appURLIn Scope19:17
Addedcalendar.notion.soURLIn Scope19:17
Addednotion.idANDROIDIn Scope19:17
Addedgithub repositories or other public artifacts owned by makenotionOTHERIn Scope19:17
Addedprivilege escalationOTHERIn Scope19:17
Addednotion integrationsOTHERIn Scope19:17
Addednotion aiAIIn Scope19:17
Feb 22, 2026
ChangeAssetCategoryScopeTime
Addednotion authenticationOTHERIn Scope00:46
Addednotion.idANDROIDIn Scope00:46
Addednotion frontendURLIn Scope00:46
Addedproduct apiURLIn Scope00:46
Addedpublic apiURLIn Scope00:46
Addednotion integrationsOTHERIn Scope00:46
Addedprivilege escalationOTHERIn Scope00:46
Addedmail.notion.soURLIn Scope00:46
Addednotion desktop appURLIn Scope00:46
Addednotion aiAIIn Scope00:46
Addedcalendar.notion.soURLIn Scope00:46
Addedgithub repositories or other public artifacts owned by makenotionOTHERIn Scope00:46
Feb 21, 2026
ChangeAssetCategoryScopeTime
Removednotion.idANDROIDIn Scope21:38
Removedgithub repositories or other public artifacts owned by makenotionOTHERIn Scope21:38
Removedcalendar.notion.soURLIn Scope21:38
Removedmail.notion.soURLIn Scope21:38
Removednotion authenticationOTHERIn Scope21:38
Removedprivilege escalationOTHERIn Scope21:38
Removednotion integrationsOTHERIn Scope21:38
Removednotion aiAIIn Scope21:38
Removedpublic apiOTHERIn Scope21:38
Removedproduct apiOTHERIn Scope21:38
Removednotion frontendOTHERIn Scope21:38
Removednotion desktop appBINARYIn Scope21:38