LastPass
- Points – $5,000 per vulnerability
Updates to LastPass Bug Bounty Program
We have exciting news for LastPass!
There have been updates within the brief as of January 31, 2024 - including updates to the In Scope targets, Out of Scope targets, and increased reward ranges!
Current In Scope Targets (as of 1/31/24)
- https://lastpass.com
- https://www.lastpass.com
- https://admin.lastpass.com
- https://auth.lastpass.com
- https://accounts.lastpass.com
- https://support.lastpass.com
- https://forums.lastpass.com
- https://blog.lastpass.com
- LastPass browser extensions (Chrome / Safari / Edge / Firefox)
- Local computer apps (UWP application / Windows installer (MSI) / MacOS)
- LastPass Password Manager (iOS)
- LastPass Password Manager (Android)
- LastPass Authenticator (iOS)
- LastPass Authenticator (Android)
- Workstation MFA (WMFA)
Current Out of Scope Targets (as of 1/31/24)
- https://identity.lastpass.com
- https://info.lastpass.com
- LastPass CLI tool
Reward Range Updates
| Priority | Previous Reward Range | New Reward Range |
|---|---|---|
| P2 | $600 – $2000 | $600 – $2200 |
| P3 | $150 – $500 | $150 – $600 |
| P4 | $0 – $100 | $0 – $150 |
As always, please be sure to review the program brief in detail, and if you have any questions, please reach out Bugcrowd Support at https://bugcrowd-support.freshdesk.com/.
Happy Hunting!
annfrance