- Top reward
- $3,000
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $3,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,000 |
| High |
|
$1,000 |
| Medium |
|
$400 |
| Low |
|
$100 |
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 17 excluded.
Web 9
- accounts.insightly.com Critical
- crm.na1.insightly.com Critical
- http://api.insightly.com/v3.1 Critical
- http://api.na1.insightly.com/v3.1 Critical
- login.insightly.com Critical
- marketing.na1.insightly.com Critical
- mobileapi.insightly.com Critical
- mobileapi.na1.insightly.com Critical
- outlook.insightly.com Critical
Out of scope (17)
- com.insightly.droid
- 563017797
- blog.insightly.com
- chloe.insightly.com
- frontdoorproxy.insightly.com
- gmailaddon.insightly.com
- help.insightly.com
- insight.ly
- insightly.com
- my.insightly.com
- newsletter.insightly.com
- podapi.na1.insightly.com
- support.insightly.com
- webhook.insightly.com
- www.insight.ly
- www.insightly.com
- *.insight.ly
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Insightly (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
-
Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
We also ask for an exploit or proof of concept for reports.
Not accepted
-
Denial of service
-
Spamming
-
Social engineering (including phishing) of Insightly staff or contractors
-
Any physical attempts against Insightly property or data centers
-
Man-in-the-middle (MITM) attacks outside of Insightly's control
-
Attacks requiring access to a user's device
-
Attacks requiring the user's credentials
-
Exported CSV files that can execute commands in Excel, Numbers, Google Sheets, or other CSV programs
-
Exploits requiring users to modify code running on their own device
-
Mis-adherence to best practices that does not lead to an exploit
-
Vulnerabilities in third-party code or services that do not lead to an exploit
-
Generic information disclosure, such as the Server or X-Powered-By headers
-
Missing HTTP security headers
-
Username or email enumeration
-
Denials of service scoped to a single user or workspace
-
Invitation abuses (to accumulate credits or send spam)
-
API key disclosure for third-party services
-
Changing the Host header to cause redirects
-
Missing subresource integrity
-
Email security: DMARC, DKIM, SPF
-
DNSSEC
-
Session cookie duration
-
Issues related to password policies
-
Disclosure of non-sensitive internal IDs (such as user IDs)
-
Two-factor authentication (2FA) bypass with third-party sign-ins like Google
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Introduction
No technology is perfect, and Insightly believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
Disclosure Policy
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Single vs. Multi-tenant Overview
When you sign up for a free trial, you are creating a new tenant of Insightly. In the real world this translates to a single company purchasing a tenant of Insightly and allowing their entire user base to access it. When you sign up for two different free trials, you are essentially creating two different tenants of Insightly - or what would be used by two different organizations that aren't affiliated.
-
Single-tenant vulnerabilities rely on a malicious user attacking their own organization, which we feel has a much lower liklihood.
-
Multi-tenant vulnerabilities allow a malicious user to attack another organization, which is the threat model we are most concerned about.
Accordingly, we have split up our bounty tables, to reward multi-tenant vulnerabilities at a higher scale.
Out of scope Permission escalations within a single tenant unless security impact can be proven.
Exclusions
While researching, we'd like to ask you to refrain from:
- Denial of service
- Spamming
- Social engineering (including phishing) of Insightly staff or contractors
- Any physical attempts against Insightly property or data centers
Out of scope
We generally do not accept reports that are simply the output from an automated security scanner (even lightly annotated). Feel free to use security scanners, but please don't copy-paste their output into our program without additional insight.
If a report is a duplicate, we won't award a bounty or reputation. A report is a duplicate if we have another HackerOne report for the issue or if our other security review processes have already identified the issue.
A specific vulnerable behavior found in one part of Insightly's platform is not necessarily eligible for a bounty if an identical problem is uncovered in another part of the Insightly platform, though we'll assess this on a case-by-case basis. If the same vulnerability affects multiple parts of the product, please let us know in a single report—we'll take that into consideration when assessing severity (such a vulnerability might be eligible for a higher reward), and when marking reports as resolved. For example, if we fail to sanitize URLs in five parts of the platform, that should probably be one report, not five.
Attacks that are beyond Insightly's control are generally out of scope. These include:
- Man-in-the-middle (MITM) attacks outside of Insightly's control (for example, modifying traffic by controlling a wireless router)
- Attacks requiring access to a user's device (such as physical access or remote access)
- Attacks requiring the user's credentials
- Exported CSV files that can execute commands in Excel, Numbers, Google Sheets, or other CSV programs
- Exploits requiring users to modify code running on their own device (opening up browser developer tools and running commands, for example)
We also ask for an exploit or proof of concept for reports. If you can't produce an attack, even a hypothetical one, we are unlikely to award a bounty. For example, here are some areas we generally consider to be out of scope:
- Mis-adherence to best practices that does not lead to an exploit
- Vulnerabilities in third-party code or services that do not lead to an exploit
- Generic information disclosure, such as the Server or X-Powered-By headers
- Missing HTTP security headers, such as:
- Content-Security-Policy
- Feature-Policy
- HTTP Strict Transport Security
- HTTP Public Key Pinning
- X-Content-Type-Options
- X-XSS-Protection
- Referrer Policy
- P3P
- Certificate Transparency (Expect-CT)
- X-Download-Options
- X-DNS-Prefetch-Control
We also consider the following areas to be out of scope, though there may be some exceptions:
- Social engineering (phishing) of Insightly staff or users
- Username or email enumeration
- Denials of service scoped to a single user or workspace
- Invitation abuses (to accumulate credits or send spam)
- API key disclosure for third-party services
- Changing the Host header to cause redirects
- Missing subresource integrity
- Email security: DMARC, DKIM, SPF
- DNSSEC
- Session cookie duration
- Issues related to password policies
- Disclosure of non-sensitive internal IDs (such as user IDs)
- Two-factor authentication (2FA) bypass with third-party sign-ins like Google
- Submissions on api.insightly.com/v3.0 and older.
If you're not sure whether an issue is in scope, we'd appreciate it if you file a report anyway!
Third party issues
Insightly uses several third party services. If they have vulnerabilities, we'd like to know. We can't guarantee bounty for those but we encourage you to report issues to both us and to them.
If the vulnerability might reasonably affect our users, we'll likely grant a bounty. The bounty amount will be determined on a case-by-case basis due to possible difficulties assessing the true severity of the issue. As such, vulnerabilities in third-party services are not eligible for the default bounty amounts listed in the "Areas in scope" section above, and the bounty amount will be determined on a case-by-case basis.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Insightly and our users safe!