Hex

Program Rules

• Do not test on production (https://app.hex.tech). For access to the bug bounty instance, please email bug-bounty at our domain, and provide your HackerOne handle.
• Do not message support chat on https://app.hex.tech.
• Please provide detailed reports, along with attack scenario. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
• Only interact with accounts you own or with explicit permission of the account holder.

Focus Areas

• Cross-tenancy (cross-workspace) data leakages
• Broken access controls
• AuthN/AuthZ on all interfaces - web, API, CLI, MCP, etc
• AuthZ within AI agent interfaces
• Container escapes
• Remote code execution (excluding kernel environments)
• XSS on core app domain (not in cell outputs)
• AI security impacting customer data
• Input sanitization
• Hex API

Out-of-Scope

• HackerOne Core Ineligible Findings
• Within kernel environments (e.g. in Python or SQL cells): remote code execution, arbitrary SQL execution, or filesystem access
• JavaScript execution on cell output domains (*.hexoutputs.tech)
• Access to product features from a different tier
• User subscription upgrade or cancel flow
• Non-security bugs, or bugs without practical impact to confidentiality, integrity, or availability

Note: The app allows you to be logged into multiple user accounts and orgs at the same time. To properly test cross-org authorization, you need to start with two separate browsers or profiles, ensure you're fully logged out on both, then on each browser log in with a different email address. Ensure that the attacker's email address isn't a member of the target org.

Thank you for helping keep Hex Technologies and our users safe!