Asana

At a glance#

• Maximum payout: $6,500
• Public disclosure: Not allowed
• Managed by the platform: Yes
• Safe harbour: Partial

In scope#

• https://app.asana.com
• https://asana.com
• https://asana.com/apps?category=made-by-asana
• https://asana.com/download
• https://apps.apple.com/us/app/asana-mobile/id489969512
• https://play.google.com/store/apps/details?id=com.asana.app&hl=en
• https://form.asana.com
• *.app.asana.com
• https://*.asana.biz
• Subdomain takeover at *asana.biz

Out of scope#

• Other subdomains of asana.com
• Social engineering against Asana Support or Asana Employees
• jira*.integrations.asana.plus
• asana.okta.com
• assets.asana.biz
• Forms that you do not own

Imported from the public directory. Always confirm scope on the official program page before testing.