Okta

At a glance#

• Maximum payout: $75,000
• Public disclosure: Allowed
• Managed by the platform: Yes
• Safe harbour: Full

In scope#

• bugcrowd-pam-###.oktapreview.com
• bugcrowd-pam-###.pam.oktapreview.com
• https://bugcrowd-pam-###.workflows.oktapreview.com
• Desktop MFA for Windows
• Desktop MFA for macOS
• Password Sync for macOS
• https://support.okta.com
• https://bugcrowd-pam-###.at.oktapreview.com
• https://bugcrowd-pam-###.oktapreview.com
• https://www.okta.com/fastpass/
• https://bugcrowd-pam-###-admin.oktapreview.com
• https://www.okta.com/products/advanced-server-access/
• http://app.scaleft.com/
• https://help.okta.com/asa/en-us/Content/Topics/Adv_Server_Access/docs/client.htm
• https://apps.apple.com/us/app/okta-verify/id490179405
• https://play.google.com/store/apps/details?id=com.okta.android.auth&hl=en_US&gl=US
• Okta Verify (Windows)
• Okta On-Prem Agents ( AD, LDAP, RDP, IWA )
• https://help.okta.com/en/prod/Content/Topics/Adv_Server_Access/docs/sftd-windows.htm
• https://help.okta.com/en/prod/Content/Topics/Settings/download-browser-plugin.htm

Out of scope#

• personal.trexcloud.com
• bugcrowd-%username%-1.oktapreview.com
• bugcrowd-%username%-2.oktapreview.com
• *.okta.com
• *.trexcloud.com
• login.okta.com
• pages.okta.com
• developer.okta.com
• trust.okta.com
• www.okta.com (static site)
• https://scaleft.com
• https://app.scaleft.com/p/signup
• https://github.com/oktadev
• Backend Okta non-app infrastructure
• Network layer issues
• AtSpoke - Okta Workflows actions in access requests
• AtSpoke - Entitlement bundles as a resource in access requests
• Anything not explicitly called out above as in-scope

Imported from the public directory. Always confirm scope on the official program page before testing.