# Smartsheet (VDP): vulnerability disclosure program on HackerOne

> Smartsheet (VDP) is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 14 reports in the 90 days to October 29, 2026, about 1.8 per in-scope asset.

- **Company:** Smartsheet (VDP)
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/smartsheet_vdp
- **Pays bounties:** no
- **Submissions:** open
- **Launched:** October 29, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/smartsheet-vdp

## Payouts and volume

HackerOne's own published figures, captured October 29, 2026.

- Reports received in the last 90 days: 14 (about 1.8 per in-scope asset)
- Researchers participating: 3
- Response efficiency: 74%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on October 29, 2026: 8 assets in scope (0 bounty-eligible), 6 out of scope. The policy page is the authority.

- `api.smartsheet.com` (URL): in scope, no bounty, max severity critical
- `app.smartsheet.com` (URL): in scope, no bounty, max severity critical
- `brandfolder.com` (URL): in scope, no bounty, max severity critical
- `com.smartsheet.android` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity high
- `com.smartsheet.smartsheet` (APPLE_STORE_APP_ID): in scope, no bounty, max severity high
- `community.smartsheet.com` (URL): out of scope, max severity none
- `developers.smartsheet.com` (URL): out of scope, max severity none
- `help.smartsheet.com` (URL): out of scope, max severity none
- `pentest2023.outfit.io` (URL): in scope, no bounty, max severity critical
- `Smartsheet Enterprise Features on (app.smartsheet.com and api.smartsheet.com)` (OTHER): in scope, no bounty, max severity critical
- `smartu.smartsheet.com` (URL): out of scope, max severity none
- `status.smartsheet.com` (URL): out of scope, max severity none
- `supportportal.smartsheet.com` (URL): out of scope, max severity none
- `www.smartsheet.com` (URL): in scope, no bounty, max severity medium

---

Generated October 29, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.