Notion MCP Server

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (makenotion GitHub scope, not the $5,000 product row) │ $2,000 │ $2,500 High │ $500 │ $625 Medium │ $100 │ $125 Low │ $50 │ $63 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Auth bypass 25 % Info disclosure 25 % Injection 10 % Latest advisories Loading the feed Overview This is Notion's official MCP server, roughly 4.6k GitHub stars, and the connector most commonly installed to give Claude, Cursor, VS Code and other MCP clients read and write access to a Notion workspace. Its footprint is developer workstations and hosted agent runtimes rather than servers, but the data reachable per install is unusually sensitive: every deployment holds a Notion integration token scoped to a company's internal documentation, so an authorisation bug here is an enterprise-wide document-exfiltration bug, and the write half of that access means a successful attacker can also plant content the next agent will read as instructions. Notion Labs pays for it on HackerOne through an org-level scope covering public repositories owned by makenotion , and that scope is bound to the cheapest row in the program: $50 at Low, $100 at Medium, $500 at High and $2,000 at Critical, rather than the $100 to $5,000 row every product scope sits on. sorona.xyz adds 1.25x on top of whatever Notion awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 3 business days First response 10 business days Triage ~35 days Bounty In scope The program's structured scope is Github Repositories or other public artifacts owned by makenotion , eligible for bounty and submission at up to critical severity. makenotion/notion-mcp-server sits inside it, as does every other public repository and published artifact under that org, all on the one asset The MCP server in full: its transport handling on both stdio and HTTP, request parsing, and the session and client state it keeps Its OAuth flow and token handling: anywhere the Notion integration token can be read by a party that should not have it, persisted somewhere unexpected, or reused outside the grant it was issued for The tool surface it exposes to MCP clients, including parameter validation and any path that lets a caller reach a Notion API operation the server did not intend to expose The boundary between what a workspace grant permits and what the server will actually do, on the write side as much as the read side, since an attacker able to create or edit pages can seed content the next agent to read the workspace will treat as instruction The npm package and container images the org publishes, which the scope's wording about other public artifacts covers alongside the source Notion's product assets, which the same program scopes separately on its $100 to $5,000 row: the Public API, Product API, Notion Authentication, Notion Integrations and Notion AI, where the policy notes that obfuscated or invisible characters used to alter AI responses are in scope if security impact can be demonstrated Out of scope Prompt engineering for inappropriate AI responses, which the policy places out of scope in as many words Use of automated scanning tools, and the output they produce without a demonstrated exploit Self-XSS, and clickjacking without a working exploit behind it CSRF on unauthenticated forms, rate-limiting issues, and banner or version disclosure The presence of robots.txt or .well-known files, which is expected rather than a finding Attacks against Notion's users or against its physical property The MCP clients on the other end. Claude, Cursor, VS Code and the rest are other vendors' software, so a defect that lives in the client rather than in Notion's server belongs with its maintainer Most-valued findings Authorisation failures that let a caller reach pages, databases or workspaces outside what the integration token was granted, the 35% top class here and the finding that reaches the $2,000 Critical figure because it converts one install into an enterprise document leak Authentication and OAuth flaws in the token exchange that let a client act as a workspace it was never granted, or that leave a usable token where another process can read it Leakage of the Notion integration token itself through logs, error paths, tool results or the transport, since every deployment holds one and it is the single most valuable secret on the host Tool-surface flaws where crafted parameters drive a Notion API operation the server never meant to expose, particularly on the write side Injection carried in page content back into the host agent with demonstrated exfiltration or an unauthorised action, including the obfuscated and invisible-character technique Notion explicitly accepts when security impact is shown Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The GitHub scope is bound to the program's cheapest reward row, so a repository finding tops out at $2,000 even though the product scopes reach $5,000 for the same severity Prompt engineering that only elicits an inappropriate AI response is out of scope; the finding needs demonstrable security impact behind it Automated scanning tools are out of scope, so scanner output on its own will not be triaged Do not discuss the vulnerability outside the program, even after it has been resolved, without express consent from Notion: the obligation is indefinite and survives remediation Test against your own workspace and your own integration token; attacks against Notion's users or its physical property are not authorised Notion's published SLAs are first response within 3 business days and triage within 10 business days, so budget for a slower clock than the reward size suggests Program stats 173 Reports resolved $264k Bounties paid 91% Response efficiency Disclosure File this one directly with Notion through HackerOne. The policy asks that vulnerabilities are not discussed outside the program without express consent, and the parenthetical covering even resolved ones makes that obligation indefinite rather than a window that expires at the fix. A sorona.xyz-routed report can be read as breaching it, so the payer's own channel is the safe one and nothing gets published unless Notion agrees. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability