# 1Password - Enterprise Password Manager: bug bounty program on HackerOne

> 1Password - Enterprise Password Manager is a bug bounty program on HackerOne. It received 86 reports in the 90 days to November 8, 2026, about 17 per in-scope asset.

- **Company:** 1Password - Enterprise Password Manager
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/1password
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** December 9, 2024
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/1password

## Payouts and volume

HackerOne's own published figures, captured November 8, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| High | $6,000 | not published |
| Medium | $900 | not published |
| Low | $300 | not published |

- Reports received in the last 90 days: 86 (about 17 per in-scope asset)
- Bounties paid in the last 90 days: $8,900
- Bounties paid in total: $34,250
- Researchers participating: 30
- Response efficiency: 86%
- First-response target: 3 days
- Triage target: 5 days
- Bounty target: 10 days

## Scope

As imported from HackerOne on November 6, 2026: 5 assets in scope (5 bounty-eligible), 4 out of scope. The policy page is the authority.

- `<Your own 1Password account> —> Latest stable, beta, or nightly Browser Extension (Chrome, Brave, Firefox, Edge, and Safari)` (OTHER): in scope, bounty-eligible, max severity critical
- `<Your own 1Password account> —> Latest stable, beta, or nightly Command Line Interface (CLI)` (OTHER): in scope, bounty-eligible, max severity critical
- `http://--your-own-1password-account--.1password.com` (URL): in scope, bounty-eligible, max severity critical
- `https://events.1password.com/` (API): in scope, bounty-eligible, max severity critical
- `https://events.1password.com/api/` (API): in scope, bounty-eligible, max severity critical
- `*.agilebits.com` (WILDCARD): out of scope, max severity none
- `All other domains, subdomains, and 1Password Accounts that are not owned by you, including accounts where you are a user but not the owner, are out of scope.` (OTHER): out of scope, max severity none
- `https://support.1password.com` (URL): out of scope, max severity none
- `https://www.1password.com/` (URL): out of scope, max severity none

---

Generated November 8, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.