Turn your team's monday.com board into a fun, motivating experience with XP, achievements, levels, and leaderboards! 🏆
Achievement Hub reads real board activity and rewards your team for the work they already do — completing items, moving statuses, leaving comments, and receiving likes from teammates.
🎯 How it works:
• Add Achievement Hub as a Board View to any board
• Choose a workflow template that fits your team
• Run sync to calculate XP, levels, and achievements
• Watch your team climb the leaderboard!
📋 Five ready-made templates:
• Sales Team — close deals, move leads through the pipeline 🚀
• Project Management — complete tasks, hit milestones ✅
• Marketing Team — publish content, manage campaigns 📣
• HR & Recruiting — hire candidates, manage pipelines 👥
• Software Development — resolve issues, ship features 💻
⚙️ Admin customization:
• Adjust XP weights for each action type
• Customize achievement names, icons, rewards, and thresholds
• Enable or disable individual achievements per board
• Auto-detects your Status column and done labels
🔒 Privacy first:
Achievement Hub runs entirely inside monday.com. It uses monday-managed storage and does not send data to external servers. No separate account needed.
Does the developer periodically perform penetration testing?
Not answered
Does the developer have a dedicated security and privacy point of contact for such issues or questions?
Yes
Security and privacy issues can be reported to our support email (support@alicornhub.com), which serves as our dedicated point of contact and is monitored for such reports.
Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?
Yes
The app does not perform any HTTP redirects or forwards. All navigation is internal view-switching within the board view, so there is no exposure to untrusted redirect destinations.
Does the app protect against mass parameter assignment attacks?
Yes
The backend does not spread raw request bodies into stored objects. Subscription state is built from explicitly named fields only (e.g., normalizeSubscription), and the entitlement endpoints read only the sessionToken field, preventing mass assignment.
Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?
Yes
The frontend is built with React, which auto-escapes all interpolated values. The app does not use dangerouslySetInnerHTML or raw innerHTML, and the backend returns JSON only (no server-rendered HTML), so user-supplied values are encoded by default.
Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?
Yes
All state-changing backend endpoints (/webhooks/monday, /entitlements, /entitlements/ack-reinstall) authenticate via a monday session JWT passed in the request body or Authorization header, not via cookies. Because authentication is token-based and not cookie-based, the endpoints are not vulnerable to CSRF.
Does the developer have mechanisms to notify monday.com in case of a security breach?
Yes
In the event of a security breach, we will notify monday.com's marketplace/security team promptly via the marketplace partner channel and provide details of affected accounts and remediation steps.
Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?
Yes
The app is hosted on monday code (managed infrastructure). We deploy code updates and dependency patches via versioned mapps code:push deploys, and monday code manages platform-level and database patches on our behalf.
Compliance
Is the app certified with the information security standard ISO/IEC 27001:2022?
Not answered
Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?
Not answered
Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?
Not answered
Is the app compliant with the General Data Protection Regulation (GDPR)?
Not answered
Data
Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).
Not answered
Where does the app store logs data?
Not answered
Where does the app store the app data?
Not answered
Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?
Not answered
Is customer data segregated from the data of other customers (for example logically or physically)?
Not answered
Privacy
Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?
Not answered
Does the developer protect access to customer data based on the principle of least privilege?
Not answered
Reviews
No reviews yet.
Historical data
Installation history
We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.
Total number of installs
Change in total number of installs in last 1 day(s)
Compares the number of installs on each date with 1 days previously:
Max
Min
Current
Change in total number of installs in last 7 day(s)
Compares the number of installs on each date with 7 days previously:
Max
Min
Current
Change in total number of installs in last 30 day(s)
Compares the number of installs on each date with 30 days previously:
Max
Min
Current
Change in total number of installs in last 90 day(s)
Compares the number of installs on each date with 90 days previously:
Max
Min
Current
Change in total number of installs in last 180 day(s)
Compares the number of installs on each date with 180 days previously:
Max
Min
Current
Ratings history
Categories history
Each of the following is a yes/no answer, so the graphs show 1 for yes, and 0 for no.
