spotify

HackerOneView on HackerOne
RawAI Enhanced
43
In Scope
8
Out of Scope
In-Scope Assets (43)
AssetCategoryBountyQuick Links
*.atspotify.comWILDCARDYes
*.avecspotify.comWILDCARDYes
*.byspotify.comWILDCARDYes
*.enspotify.comWILDCARDYes
*.forspotify.comWILDCARDYes
*.fromspotify.comWILDCARDYes
*.spotify.comWILDCARDYes
*.spotify.netWILDCARDYes
*.tospotify.comWILDCARDYes
*.withspotify.comWILDCARDYes
AnchorOTHERYes-
Android SDKCODEYes-
Core AssetsOTHERYes-
Core Backstage source codeCODEYes-
GHEOTHERYes-
JiraOTHERYes-
MegaphoneOTHERYes-
Non-Core AssetsOTHERYes-
OktaOTHERYes-
Other Spotify websitesOTHERYes-
PodsightsOTHERYes-
SonanticOTHERYes-
Spotify SDKsCODEYes-
Spotify desktop application (Windows and Mac)BINARYYes-
VPNOTHERYes-
Web Playback SDKCODEYes-
WrappedOTHERYes-
api-partner.spotify.comURLYes
api.spotify.comURLYes
assets.spotify.comURLYes
backstage.ioURLYes
com.anchorfminc.AnchorIOSYes-
com.spotify.clientIOSYes-
com.spotify.kidsANDROIDYes
com.spotify.kidsIOSYes-
com.spotify.musicANDROIDYes
com.spotify.s4aIOSYes-
com.spotify.s4aANDROIDYes
com.spotify.tv.androidANDROIDYes
fm.anchor.androidANDROIDYes
https://github.com/backstage/backstageCODEYes-
https://www.whosampled.com/URLYes
iOS SDKCODEYes-
Out-of-Scope Assets (8)
AssetCategoryBounty
FindawayOTHERNo
PreactOTHERNo
SoundtrapOTHERNo
The RingerOTHERNo
com.soundtrap.studioappANDROIDNo
com.soundtrap.studioappIOSNo
everynoise.comURLNo
example.comURLNo
Scope Changes (337)
Feb 25, 2026
ChangeAssetCategoryScopeTime
Addedcore backstage source codeCODEIn Scope19:09
Added*.spotify.comWILDCARDIn Scope19:09
Addedhttps://www.whosampled.com/URLIn Scope19:09
Addedhttps://github.com/backstage/backstageOTHERIn Scope19:09
Added*.fromspotify.comWILDCARDIn Scope19:09
Addedcom.spotify.clientIOSIn Scope19:09
Addedandroid sdkCODEIn Scope19:09
Addedbackstage.ioURLIn Scope19:09
Addedcore assetsOTHERIn Scope19:09
AddedgheOTHERIn Scope19:09
Addedexample.comURLOut of Scope19:09
Added*.tospotify.comWILDCARDIn Scope19:09
Addedcom.spotify.s4aIOSIn Scope19:09
Added*.byspotify.comWILDCARDIn Scope19:09
Added*.forspotify.comWILDCARDIn Scope19:09
Addedeverynoise.comURLOut of Scope19:09
Addedspotify desktop application (windows and mac)OTHERIn Scope19:09
Addedcom.spotify.kidsIOSIn Scope19:09
Addedfm.anchor.androidANDROIDIn Scope19:09
Added*.spotify.netWILDCARDIn Scope19:09
AddedpreactOTHEROut of Scope19:09
Addedios sdkCODEIn Scope19:09
Addedweb playback sdkCODEIn Scope19:09
Added*.enspotify.comWILDCARDIn Scope19:09
AddedvpnOTHERIn Scope19:09
Addedcom.soundtrap.studioappIOSOut of Scope19:09
Addedthe ringerOTHEROut of Scope19:09
Addedassets.spotify.comURLIn Scope19:09
Addedcom.spotify.tv.androidANDROIDIn Scope19:09
Addedspotify sdksCODEIn Scope19:09
AddedanchorOTHERIn Scope19:09
Addedcom.spotify.kidsANDROIDIn Scope19:09
Addedapi-partner.spotify.comURLIn Scope19:09
AddedmegaphoneOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
AddedpodsightsOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedother spotify websitesOTHERIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
AddedjiraOTHERIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
Addedcore backstage source codeCODEIn Scope19:09
AddedsonanticOTHERIn Scope19:09
AddedsonanticOTHERIn Scope19:09
AddedsonanticOTHERIn Scope19:09
Added*.withspotify.comWILDCARDIn Scope19:09
Added*.atspotify.comWILDCARDIn Scope19:09
AddedwrappedOTHERIn Scope19:09
Addedcom.soundtrap.studioappANDROIDOut of Scope19:09
AddedfindawayOTHEROut of Scope19:09
Addedcom.anchorfminc.anchorIOSIn Scope19:09
AddedoktaOTHERIn Scope19:09
Addedapi.spotify.comURLIn Scope19:09
AddedsoundtrapOTHEROut of Scope19:09
Addedcom.spotify.s4aANDROIDIn Scope19:09
Addedcom.spotify.musicANDROIDIn Scope19:09
Added*.avecspotify.comWILDCARDIn Scope19:09
Addednon-core assetsOTHERIn Scope19:09
Feb 22, 2026
ChangeAssetCategoryScopeTime
Addedcore assetsOTHERIn Scope00:40
AddedanchorURLIn Scope00:40
Addedfm.anchor.androidANDROIDIn Scope00:40
AddedsonanticURLIn Scope00:40
AddedsonanticURLIn Scope00:40
AddedsonanticURLIn Scope00:40
Added*.tospotify.comWILDCARDIn Scope00:40
Addednon-core assetsOTHERIn Scope00:40
AddedjiraOTHERIn Scope00:40
Addedcom.spotify.kidsIOSIn Scope00:40
Added*.avecspotify.comWILDCARDIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
AddedpodsightsOTHERIn Scope00:40
Addedhttps://github.com/backstage/backstageOTHERIn Scope00:40
Addedcom.soundtrap.studioappIOSOut of Scope00:40
AddedpreactOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedthe ringerOTHEROut of Scope00:40
Addedeverynoise.comURLOut of Scope00:40
Addedassets.spotify.comURLIn Scope00:40
Addedspotify desktop application (windows and mac)OTHERIn Scope00:40
Addedios sdkCODEIn Scope00:40
Addedcom.anchorfminc.anchorIOSIn Scope00:40
Added*.atspotify.comWILDCARDIn Scope00:40
Addedcom.spotify.s4aIOSIn Scope00:40
Addedcom.spotify.musicANDROIDIn Scope00:40
Added*.withspotify.comWILDCARDIn Scope00:40
Added*.spotify.comWILDCARDIn Scope00:40
Addedhttps://www.whosampled.com/URLIn Scope00:40
Added*.byspotify.comWILDCARDIn Scope00:40
AddedwrappedOTHERIn Scope00:40
Addedexample.comURLOut of Scope00:40
Addedcom.spotify.s4aANDROIDIn Scope00:40
Addedspotify sdksCODEIn Scope00:40
Addedandroid sdkCODEIn Scope00:40
Added*.enspotify.comWILDCARDIn Scope00:40
Added*.forspotify.comWILDCARDIn Scope00:40
AddedgheOTHERIn Scope00:40
AddedoktaOTHERIn Scope00:40
Added*.spotify.netWILDCARDIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedother spotify websitesOTHERIn Scope00:40
Addedcore backstage source codeCODEIn Scope00:40
Addedcom.spotify.kidsANDROIDIn Scope00:40
Added*.fromspotify.comWILDCARDIn Scope00:40
AddedvpnOTHERIn Scope00:40
Addedapi-partner.spotify.comURLIn Scope00:40
Addedcom.soundtrap.studioappANDROIDOut of Scope00:40
AddedfindawayOTHEROut of Scope00:40
AddedfindawayOTHEROut of Scope00:40
AddedfindawayOTHEROut of Scope00:40
Addedcom.spotify.tv.androidANDROIDIn Scope00:40
Addedbackstage.ioURLIn Scope00:40
Addedapi.spotify.comURLIn Scope00:40
AddedmegaphoneOTHEROut of Scope00:40
AddedsoundtrapOTHEROut of Scope00:40
Addedcom.spotify.clientIOSIn Scope00:40
Addedweb playback sdkCODEIn Scope00:40
Feb 21, 2026
ChangeAssetCategoryScopeTime
Removedassets.spotify.comURLIn Scope21:38
Removedcom.spotify.clientIOSIn Scope21:38
Removedcom.spotify.s4aIOSIn Scope21:38
Removedcom.spotify.tv.androidANDROIDIn Scope21:38
Removedcom.spotify.s4aANDROIDIn Scope21:38
Removedspotify sdksCODEIn Scope21:38
Removedother spotify websitesOTHERIn Scope21:38
Removedcom.spotify.musicANDROIDIn Scope21:38
Removedspotify desktop application (windows and mac)BINARYIn Scope21:38
RemovedanchorOTHERIn Scope21:38
Removedcom.spotify.kidsIOSIn Scope21:38
Removedios sdkCODEIn Scope21:38
Removedandroid sdkCODEIn Scope21:38
Removedweb playback sdkCODEIn Scope21:38
Removedbackstage.ioURLIn Scope21:38
Removedcore backstage source codeCODEIn Scope21:38
Removedcom.spotify.kidsANDROIDIn Scope21:38
Removedcom.anchorfminc.anchorIOSIn Scope21:38
Removedfm.anchor.androidANDROIDIn Scope21:38
RemovedsonanticOTHERIn Scope21:38
Removed*.withspotify.comWILDCARDIn Scope21:38
Removed*.byspotify.comWILDCARDIn Scope21:38
Removed*.atspotify.comWILDCARDIn Scope21:38
Removed*.avecspotify.comWILDCARDIn Scope21:38
Removed*.enspotify.comWILDCARDIn Scope21:38
Removed*.forspotify.comWILDCARDIn Scope21:38
Removed*.fromspotify.comWILDCARDIn Scope21:38
Removed*.tospotify.comWILDCARDIn Scope21:38
Removedcore assetsOTHERIn Scope21:38
Removednon-core assetsOTHERIn Scope21:38
RemovedgheOTHERIn Scope21:38
RemovedjiraOTHERIn Scope21:38
RemovedoktaOTHERIn Scope21:38
RemovedvpnOTHERIn Scope21:38
Removed*.spotify.comWILDCARDIn Scope21:38
Removed*.spotify.netWILDCARDIn Scope21:38
Removedapi.spotify.comURLIn Scope21:38
Removedapi-partner.spotify.comURLIn Scope21:38
RemovedmegaphoneOTHERIn Scope21:38
Removedhttps://www.whosampled.com/URLIn Scope21:38
RemovedpodsightsOTHERIn Scope21:38
Removedhttps://github.com/backstage/backstageCODEIn Scope21:38
RemovedwrappedOTHERIn Scope21:38