Top Scope FAQ

Top Scope is the public name for The Scope bug bounty operations platform. It gives security researchers and teams one online workspace for program records, in-scope and out-of-scope assets, vulnerability reports, personal notes, private vault items, approvals, exports, and read-only API access.

A spreadsheet stores rows, but Top Scope connects each target to its program, platform, eligibility, maximum severity, report workflow, approval history, and authorized user actions. Live totals, filters, deduplication, downloads, and APIs reduce the manual work required to keep a large collection usable.

Yes. Add GitHub organizations, repositories, and source-code targets to the relevant program. The platform preserves the program and platform context so a repository is not separated from its policy, scope state, or testing notes.

Android package names and mobile application listings can be stored as mobile assets. Each entry can be marked in scope or out of scope, assigned a maximum severity, and linked to the program that defines its testing rules.

Top Scope supports wildcard domains, domains, subdomains, URLs, IPv4 addresses, IPv6 addresses, CIDR ranges, mobile applications, source-code targets, and custom assets. Automatic type detection is available during bulk entry.

Yes. Every asset has an explicit scope state. Dashboard totals and program filters distinguish eligible targets from exclusions, making it easier to build focused testing lists without accidentally dropping the program context.

The report workspace includes fields for the affected target, severity, weakness or CWE, executive summary, reproduction steps, impact, recommendation, external report link, reward, and workflow status. Each report stays connected to its program and affected asset.

Analysts and viewers can propose shared program, scope, and report changes, but those changes enter the approval queue instead of applying immediately. An administrator can inspect the affected program and target before approving or rejecting the request.

Active owners, administrators, analysts, and viewers can create personal notes and encrypted vault entries. Database queries are constrained to the signed-in user ID. Restricted users become read-only until an administrator restores access.

Yes. Authorized users can filter scope and download unique TXT targets, context-rich CSV records, or complete JSON data. Personal read-only API tokens provide program, asset, and report endpoints for approved automation.

Administrators can assign roles, override permissions, restrict an account to read-only access, disable sign-in, revoke tokens, and review all pending shared changes. Personal vault and note records remain isolated between users.

No. Searches such as online ruler camera, mm online ruler, accurate online ruler, and 12 inch online ruler describe tools for measuring physical dimensions. Top Scope measures security-program boundaries and organizes bug bounty assets; it does not measure objects or screen lengths.