Airtable bug bounty programs
airtable.com Updated
Airtable runs two public programs: a Sorona bug bounty paying up to $4,375 and a HackerOne bug bounty paying up to $3,500.
- Top reward
- $4,375
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 15
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Airtable MCP CLI
Sorona · Pays the most of the 2 programs: up to $4,375.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Airtable MCP CLI
Sorona · Bug bounty |
$4,375 (highest) | $938 (highest) | $500 (highest) | $250 (highest) | $4,375 | Partial | – | – | Open |
|
Airtable
HackerOne · Bug bounty |
$3,500 | $750 | $400 | $200 | $3,500 | – | – | – | Open |
-
- Critical
- $4,375 (highest)
- High
- $938 (highest)
- Medium
- $500 (highest)
- Low
- $250 (highest)
- Safe harbor
- Partial
-
- Critical
- $3,500
- High
- $750
- Medium
- $400
- Low
- $200
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 2 programs, each listed once with the programs that cover it. 19 excluded.
-
Airtable's scope list carries npm @airtable/mcp-cli as a bounty-eligible source-code asset in its own right, instruction "Source code for our MCP CLI.", maximum severity critical. Any security issue in Airtable/airtable-mcp-cli is accepted
Products and areas
Covered by Sorona
-
Enterprise admin surfaces under staging.airtable.com/admin, including service accounts and user groups
Products and areas
Covered by Sorona
-
mcp.staging.airtable.com, the MCP server the CLI talks to, whose own instruction repeats that the CLI code is in scope alongside it
Products and areas
Covered by Sorona
-
*.staging-airtableblocks.com, the custom apps and blocks domain, also bounty-eligible at critical
Products and areas
Covered by Sorona
-
The airtable.js SDK published as npm airtable, a second bounty-eligible source-code row on the same program
Products and areas
Covered by Sorona
-
The staging web app and API the two of them run against: staging.airtable.com, api-staging.airtable.com and the *.staging.airtable.com wildcard, each carried at critical
Products and areas
Covered by Sorona
-
The whole of the CLI as shipped: configuration and credential handling, the personal access token it is given, the MCP transport it speaks, and every tool it exposes to the agent driving it
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 19
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
airtable.com
HackerOne
-
blog.airtable.com
HackerOne
-
community.airtable.com
HackerOne
-
dl.airtable.com
HackerOne
-
dl.getforma.com
HackerOne
-
guide.airtable.com
HackerOne
-
support.airtable.com
HackerOne
-
com.formagrid.airtable
HackerOne
-
com.FormaGrid.Hyperbase
HackerOne
-
Airtable macOS app
HackerOne
-
Airtable Windows app
HackerOne
-
Anything tested against production airtable.com, which the scope list marks ineligible and the SDK instruction is emphatic about
Sorona
-
DMARC, DKIM, SPF and DNSSEC configuration findings
Sorona
-
Self-XSS, Referer leakage and exploits that only work on legacy browsers, all treated as Low severity at best
Sorona
-
Session cookie duration and password policy complaints
Sorona
-
Stored XSS reached through the custom apps and blocks functionality on *.staging-airtableblocks.com, which that scope row rules out by name
Sorona
-
The marketing and support properties: the blog, support, guide, community and dl subdomains, and the Airtable macOS app, all carried at severity none and not bounty-eligible
Sorona
-
Two-factor bypass that depends on a third-party sign-in such as Google
Sorona
-
Vulnerabilities in third-party services, which do not qualify for the published reward amounts and are assessed case by case instead
Sorona
Recent changes
Reward and scope changes across every Airtable program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Airtable products, from the NVD.
-
CVE-2022-46155 High
Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. Specifically, the AIRTABLE_API_KEY and AIRTABLE_ENDPOINT_URL environment variables are inserted during Browserify builds due to being referenc
-
CVE-2022-46155 High
Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. Specifically, the AIRTABLE_API_KEY and AIRTABLE_ENDPOINT_URL environment variables are inserted during Browserify builds due to being referenc
About this page
This page gathers every public program listed under airtable.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.