{"generated_at":"2026-10-20T17:37:55.835082+00:00","count":221,"stats":{"count":221,"score":{"min":0.0,"median":41.0,"max":68.6},"will_pay":{"green":100,"yellow":101,"red":20,"unknown":0},"high_confidence":217},"programs":[{"id":"hackerone:marriott","platform":"hackerone","slug":"marriott","name":"Marriott Bug Bounty Program","url":"https://hackerone.com/marriott","meta":{"reward_min":100,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-02-03T17:22:40.243Z","age_months":80.52600795338999,"reports_90d":241,"resolved_total":801,"response_efficiency":97,"response_indicator":"ok","paid_total":631455,"paid_90d":55444,"last_resolved_at":"2026-10-13T14:44:37.761Z","days_since_resolved":7.120118030381945,"avg_bounty_low":400,"avg_bounty_high":600,"min_bounty":100,"scope_count":301},"scope":[{"asset":"*.apigatewayc.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.apigwc.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.artifactory.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.dcfgateway.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.gateway.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.mgs.marriott.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*gateway-apc.marriott.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*uat.marriott.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":null},{"asset":"455004730","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"apcgateway.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"app-insiders.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"auth-apc.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"bilt.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"bpa2.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"bsp.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"channel-portal.homes-and-villas.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"ci-propertyconversionportal.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"contentportal.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"contentportalauth.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"cpp.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dcfgateway*.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"device.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"editionhotels.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"eidhelp.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"esupplier.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gateway*.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"help.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"homes-and-villas.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hotshoppeservices.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"https://gatewaydsapprd.marriott.com/v1/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gatewaydsapprd.marriott.com/v2/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"join.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"joinmarriottbonvoy.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"joinrewards.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"lawmanager.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"marrtool.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mds.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"meetmarriottbonvoy.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"mgs.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"moments.marriottbonvoy.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ocijlbex1prd.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"owa.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"passwordchallenge.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":"This app is used for employees all over marriott to reset their passwords, for new employees to set their first password, and set up challenge questions."},{"asset":"prod-mipaasiaasservices.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"reservations.all-inclusive.marriott.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"smetrics.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"splunk-phantom-nlb.marriott.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"sso.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"travelagents.marriott.com/","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"traveler.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"uat.marriott.com","type":"URL","bounty":false,"severity":"high","instruction":null},{"asset":"uber.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"university.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"vacation.marriott.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"wechat.api.marriott.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"www.giving.marriott.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"www.marriott.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.members.marriott.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"www.travel-brilliantly.marriott.com","type":"URL","bounty":true,"severity":"medium","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 7d ago"},"slop":{"risk":0.022,"label":"none","experimental":true}},"derived":{"novelty":0.172,"inverse_crowd":0.8299,"payout_reliability":0.9698,"value_per_competition":0.51,"triage_quality":0.97,"scope_breadth":0.9186,"crowding_per_asset_month":0.2669,"slop_risk":0.022},"score":{"total":68.6,"parts":{"novelty":0.172,"inverse_crowd":0.83,"payout_reliability":0.97,"value_per_competition":0.51,"triage_quality":0.97,"scope_breadth":0.919},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":100.0},"reasons":[{"sign":"good","text":"paid $55k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"241 reports in 90 days across 301 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.7 years"}]},{"id":"hackerone:scopely","platform":"hackerone","slug":"scopely","name":"Scopely","url":"https://hackerone.com/scopely","meta":{"reward_min":150,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-03-03T13:03:27.369Z","age_months":67.5873635218743,"reports_90d":61,"resolved_total":407,"response_efficiency":98,"response_indicator":"ok","paid_total":360000,"paid_90d":30000,"last_resolved_at":"2026-09-02T08:39:22.417Z","days_since_resolved":48.37376784519676,"avg_bounty_low":900,"avg_bounty_high":1000,"min_bounty":150,"scope_count":65},"scope":[{"asset":"*.scopely.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Vulnerabilities reported on Scopely services additional to the games in scope are now eligible for monetary rewards."},{"asset":"*.scopely.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Vulnerabilities reported on Scopely services additional to the games in scope are now eligible for monetary rewards."},{"asset":"*.withbuddies.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Backend API servers included in scope.\nPlease take into account that any kind of DOS is totally forbidden."},{"asset":"Games Tier 1","type":"OTHER","bounty":true,"severity":"critical","instruction":"This asset was added for bounty table purposes."},{"asset":"Games Tier 2","type":"OTHER","bounty":true,"severity":"critical","instruction":"This asset was added for bounty table purposes."},{"asset":"Games Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":"This asset was added for bounty table purposes."},{"asset":"air.com.bitrhymes.bingo","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Bingo Bash: Live Bingo Games](https://play.google.com/store/apps/details?id=air.com.bitrhymes.bingo)\nOver a decade of daubing & over 70 million online players: Bingo Bash featuring Monopoly is the be"},{"asset":"com.foxnextgames.m3","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.foxnextgames.m3","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.gsn.android.casino","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[GSN Casino: Slot Machine Games](https://play.google.com/store/apps/details?id=com.gsn.android.casino)\nYou're in the best place to play free online slots! Enjoy fun casino games online where you can f"},{"asset":"com.gsn.android.tripeaks","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Tiki Solitaire TriPeaks](https://play.google.com/store/apps/details?id=com.gsn.android.tripeaks)\nTiki Solitaire TriPeaks: the classic Solitaire TriPeaks card game! With over 3000 levels to wander and"},{"asset":"com.gsn.grandcasino","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Grand Casino: Slots & Bingo](https://play.google.com/store/apps/details?id=com.gsn.grandcasino)\nHey Spinner - what’s your favourite casino game of 2022? Slots, Video Poker, Video bingo? HERE & NOW mo"},{"asset":"com.kitkagames.fallbuddies","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Stumbleguys](https://play.google.com/store/apps/details?id=com.kitkagames.fallbuddies)\nStumble Guys is a massive multiplayer party knockout game with up to 32 players online. Join millions of players"},{"asset":"com.pieyel.scrabble","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"[Scrabble GO](https://apps.apple.com/nz/app/scrabble-go-new-word-game/id1215933788)\nThe world’s greatest word game, is all new and reimagined as a free to play mobile game!\n\n**Status:** Available worl"},{"asset":"com.pieyel.scrabble","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Scrabble GO](https://play.google.com/store/apps/details?id=com.pieyel.scrabble)\nThe world’s greatest word game, is all new and reimagined as a free to play mobile game!\n\n**Status:** Available worldwi"},{"asset":"com.scopely.monopolygo","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Monopoly GO! ](https://play.google.com/store/apps/details?id=com.scopely.monopolygo)\nHit GO! Roll the dice! Earn MONOPOLY money, interact with your friends, family members and fellow Tycoons from aro"},{"asset":"com.scopely.startrek","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Star Trek Fleet Command ](https://play.google.com/store/apps/details?id=com.scopely.startrek)\nYou have the conn! Summon your skills in strategy, combat, diplomacy, and leadership to master the danger"},{"asset":"com.scopely.yux","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"[Yahtzee with Buddies Dice Game](https://apps.apple.com/us/app/yahtzee-with-buddies-dice/id1206967173)\nRoll dice to play YAHTZEE® With Buddies! It is the fun, classic board game with a new look. Play "},{"asset":"com.scopely.yux","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Yahtzee with Buddies Dice Game](https://play.google.com/store/apps/details?id=com.scopely.yux)\nRoll dice to play YAHTZEE® With Buddies! It is the fun, classic board game with a new look. Play dice wi"},{"asset":"com.withbuddies.dice.free","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"[Dice With Buddies: Social Game](https://apps.apple.com/us/app/dice-with-buddies-social-game/id432750508)\nDice With Buddies is a fun, new spin on your favorite classic dice game! Enjoyed by millions o"},{"asset":"com.withbuddies.dice.free","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"[Dice With Buddies: Social Game](https://play.google.com/store/apps/details?id=com.withbuddies.dice.free)\nDice With Buddies is a fun, new spin on your favorite classic dice game! Enjoyed by millions o"},{"asset":"id1427744264","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Star Trek Fleet Command](https://apps.apple.com/us/app/star-trek-fleet-command/id1427744264)\nYou have the conn! Summon your skills in strategy, combat, diplomacy, and leadership to master the dangero"},{"asset":"id1541153375","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"[StumbleGuys](https://apps.apple.com/es/app/stumble-guys/id1541153375)\nStumble Guys is a massive multiplayer party knockout game with up to 32 players online. Join millions of players and stumble to v"},{"asset":"id1621328561","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Monopoly GO!](https://apps.apple.com/us/app/monopoly-go/id1621328561)\nHit GO! Roll the dice! Earn MONOPOLY money, interact with your friends, family members and fellow Tycoons from around the world a"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"98% response, pays, last resolved 48d ago"},"slop":{"risk":0.017,"label":"none","experimental":true}},"derived":{"novelty":0.1843,"inverse_crowd":0.8013,"payout_reliability":0.9068,"value_per_competition":0.5314,"triage_quality":0.98,"scope_breadth":0.6739,"crowding_per_asset_month":0.3128,"slop_risk":0.017},"score":{"total":65.6,"parts":{"novelty":0.184,"inverse_crowd":0.801,"payout_reliability":0.907,"value_per_competition":0.531,"triage_quality":0.98,"scope_breadth":0.674},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":99.5},"reasons":[{"sign":"good","text":"paid $30k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"61 reports in 90 days across 65 assets"},{"sign":"neutral","text":"running 5.6 years"}]},{"id":"hackerone:oppo_bbp","platform":"hackerone","slug":"oppo_bbp","name":"OPPO","url":"https://hackerone.com/oppo_bbp","meta":{"reward_min":10,"reward_max":60,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-02-14T06:52:19.619Z","age_months":20.154352551458285,"reports_90d":251,"resolved_total":176,"response_efficiency":83,"response_indicator":"ok","paid_total":49926,"paid_90d":10215,"last_resolved_at":"2026-10-20T10:49:16.108Z","days_since_resolved":0.28356308825231485,"avg_bounty_low":40,"avg_bounty_high":60,"min_bounty":10,"scope_count":206},"scope":[{"asset":"A16k","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"A76","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"A96","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"ColorOS","type":"OTHER","bounty":true,"severity":"critical","instruction":"It's an inner application of OPPO mobile."},{"asset":"F 21 Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindN2","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindN2Flip","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindN3","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindN3Flip","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindX6","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindX6Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindX7","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"FindX7Ultra","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"K10","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"K105G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"K9","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"K9Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"K9s","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Low Level Properties and Test environment","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"NARZO 80 Lite 4G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"NARZO 80 Pro 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"NARZO 80x 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Narzo 80 lite 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Porsche-B","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno 9 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno105G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno10Pro+5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno10Pro5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno115G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno11Pro5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno12","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno12Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno8Pro5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno9Pro+5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Reno9Pro5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"com.coloros.assistantscreen","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.coloros.findmyphone","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.coloros.pictorial","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.coloros.video","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.coloros.wallet","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.finshell.finance","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.finshell.wallet","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.fintech.life","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.book","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.browser","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.cloud","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.databaseengine","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.health.international","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.health.quickapp","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.heymelody","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.mall","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.market","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.miniapp.sports","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.music","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.ocsp.client","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.pictorial","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.reader","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.research","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.store","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.tas","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.themestore","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wallet","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.breeno","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.browser","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.elves","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.healthassessment","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.market","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.research","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.wearable.themestore","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.heytap.xgame","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.katanlabs.bubblepop","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.katanlabs.matchballgame","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.katanlabs.worm.ioeatemall","type":"WINDOWS_APP_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.nearme.gamecenter","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.netease.my.nearme.gamecenter","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.accesscard","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.account","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.aimemory","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.games","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.melody","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.play","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.studycenter","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oplus.themestore","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oppo.market","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oppo.quicksearchbox","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oppo.speechassist","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.oppo.store","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.qpon.merchant","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.qpon.platform","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.shopai.apps","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"http://open.oppomobile.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://c.realme.com/eg/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://c.realme.com/global/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://c.realme.com/id/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://c.realme.com/in/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://c.realme.com/ru/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://cloud.oppo.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://community.oppo.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://communityin.oppo.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://developers.oppomobile.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://drp.myoppo.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://e-global.heytap.com/marketing/login","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://e.oppo.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gcsm.oppoit.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://safe.heytap.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://u.oppomobile.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.coloros.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.oppo.com/id/store","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.oppo.com/in/store","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.oppo.com/my/store","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.oppo.com/th/store","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.opposhop.cn/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.opposhop.cn/m/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://zhongbao-ear.heytap.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://zhongbao.heytap.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id.heytap.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id.oppo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"opposhop.cn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"realme 15 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme 15 Pro 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme 15T","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme C71","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme C75 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme GT6","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme GT6T","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme GT7","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme GT7Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme GT7T","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme Note 70","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme P1 speed","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme P3 Lite 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme P4 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"realme P4 Pro 5G","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"83% response, paid recently, resolved 0d ago"},"slop":{"risk":0.072,"label":"none","experimental":true}},"derived":{"novelty":0.295,"inverse_crowd":0.7467,"payout_reliability":0.9144,"value_per_competition":0.2952,"triage_quality":0.83,"scope_breadth":0.8578,"crowding_per_asset_month":0.4061,"slop_risk":0.072},"score":{"total":62.9,"parts":{"novelty":0.295,"inverse_crowd":0.747,"payout_reliability":0.914,"value_per_competition":0.295,"triage_quality":0.83,"scope_breadth":0.858},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":99.1},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"83% response efficiency"},{"sign":"neutral","text":"251 reports in 90 days across 206 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.7 years"}]},{"id":"hackerone:exness","platform":"hackerone","slug":"exness","name":"EXNESS","url":"https://hackerone.com/exness","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-03-16T16:02:27.122Z","age_months":55.1643884846091,"reports_90d":110,"resolved_total":531,"response_efficiency":93,"response_indicator":"ok","paid_total":555432,"paid_90d":52400,"last_resolved_at":"2026-10-14T09:27:37.209Z","days_since_resolved":6.340263308159722,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":50,"scope_count":79},"scope":[{"asset":"Any subdomain application issue","type":"OTHER","bounty":false,"severity":"critical","instruction":"Exness subdomains of exness.(tld)"},{"asset":"Any subdomain infrastructure issue","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"Exness Investor","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/id/app/exness-investor/id1579331769"},{"asset":"Exness Trade: Online Trading","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/id/app/exness-trader-trade-on-the-go/id1359763701"},{"asset":"External service data leakage ","type":"OTHER","bounty":false,"severity":"critical","instruction":"Feel free to search secrets on github/pastebin and other services, but keep in mind, that such issues could be posted earlier and are ineligible for a bounty for now"},{"asset":"api.excalls.mobi","type":"URL","bounty":true,"severity":"critical","instruction":"Mobile API"},{"asset":"com.exness.android.pa","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Exness Trade: Online Trading\nhttps://play.google.com/store/apps/details?id=com.exness.android.pa"},{"asset":"exness.com","type":"URL","bounty":true,"severity":"medium","instruction":"Public Area for Web Trading"},{"asset":"exnessaffiliates.com","type":"URL","bounty":true,"severity":"critical","instruction":"Partnership programs"},{"asset":"https://my.exness.com/pa/pim/manager","type":"URL","bounty":true,"severity":"high","instruction":"Portfolio Management"},{"asset":"https://my.exness.com/webtrading/","type":"URL","bounty":true,"severity":"critical","instruction":"Web Terminal For Trading"},{"asset":"my.exness.com","type":"URL","bounty":true,"severity":"critical","instruction":"Personal Area for Web Trading"},{"asset":"pay.ibex.exchange","type":"URL","bounty":true,"severity":"critical","instruction":"Payments Services"},{"asset":"pwapi.ex2b.com","type":"URL","bounty":true,"severity":"critical","instruction":"Public Web API"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 6d ago"},"slop":{"risk":0.025,"label":"none","experimental":true}},"derived":{"novelty":0.1996,"inverse_crowd":0.7153,"payout_reliability":0.9514,"value_per_competition":0.3936,"triage_quality":0.93,"scope_breadth":0.7049,"crowding_per_asset_month":0.4641,"slop_risk":0.025},"score":{"total":62.5,"parts":{"novelty":0.2,"inverse_crowd":0.715,"payout_reliability":0.951,"value_per_competition":0.394,"triage_quality":0.93,"scope_breadth":0.705},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":98.6},"reasons":[{"sign":"good","text":"paid $52k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"neutral","text":"110 reports in 90 days across 79 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.6 years"}]},{"id":"hackerone:indrive","platform":"hackerone","slug":"indrive","name":"inDrive","url":"https://hackerone.com/indrive","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-02-27T15:58:27.590Z","age_months":43.73121468127805,"reports_90d":638,"resolved_total":459,"response_efficiency":100,"response_indicator":"ok","paid_total":201430,"paid_90d":34600,"last_resolved_at":"2026-10-14T08:00:41.604Z","days_since_resolved":6.400629106770834,"avg_bounty_low":100,"avg_bounty_high":200,"min_bounty":50,"scope_count":309},"scope":[{"asset":"*.indrive.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.indriver.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.indriverapp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"ab-api-gw-cf.global.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: global"},{"asset":"ab-api-gw-scf.global.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: global"},{"asset":"alternativa.film","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"api-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: sa.apse1"},{"asset":"api.ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":"Ryadom API"},{"asset":"arsentomsky.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"ath-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ath-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ath-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"auroratechaward.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"av.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"baf-gw-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, latam.saea1, mena.euso1, mena.meso1, sa.apse1, sea.apse3, euce1 (no .aws)"},{"asset":"baf-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"balance-api-front.eu-east-1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: eu-east-1"},{"asset":"balance-api.eu-east-1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: eu-east-1"},{"asset":"bc-cf.latam-co.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: latam-co.saea1, latam-pe.saea1"},{"asset":"bc-gw-cf.latam-pe.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: latam-pe.saea1"},{"asset":"bdu-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"bdu-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"bdu-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"bf-cf.latam-co.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: latam-co.saea1, latam-pe.saea1"},{"asset":"bf-gw-cf.latam-pe.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: latam-pe.saea1"},{"asset":"bid-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, mena-eg.meso1, sa.apse1, sa-in.apso1, se"},{"asset":"bid-gw-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, mena-eg.meso1, sa.apse1, sa-in.apso1, se"},{"asset":"bid-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"blog.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ca-gw-cf.latam-mx.usea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: latam-mx.usea1, euce1 (no .aws)"},{"asset":"careers.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cargo.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cas-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cas-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cas-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cas.eu-east-1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: eu-east-1"},{"asset":"cca-cf.latam-mx.usea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: latam-mx.usea1"},{"asset":"chat.eu-east-1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: eu-east-1"},{"asset":"cht-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cht-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cht-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cm-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"cmf-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"co-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"co-in-cf.mena.meso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: mena.meso1, mena-eg.meso1"},{"asset":"co-in-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"company.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"coms.ryadom.kz","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"courier-gw-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: cis.euce1"},{"asset":"couriers.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"daw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"debug.clairvoyance.indrive.tech","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"delivery-webview.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dh-cf.mena.meso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: mena.meso1, mena-eg.meso1"},{"asset":"dh-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"dr-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"es-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"exs-dtu-gw-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, latam.saea1, mena.euso1, mena.meso1, sa.apse1, sea.apse3, euce1 (no .aws)"},{"asset":"exs-dtu-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"external.indrive.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fch-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"fch-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"fch-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"fch-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"fe-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"fic-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"file-storage-front.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fp-cf.global.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: global, latam-br.saea1, latam-mx.usea1, latam-pe.saea1"},{"asset":"fsf-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"fsf-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"g2-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"gt-gw-cf-0.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: cis.euce1"},{"asset":"gt-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"gvt-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"gvt-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"https://*.indriver.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"ic3-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ic3-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ic3-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"icl-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"icl-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"icl-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"icl-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"idc-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: cis.euce1, latam.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1"},{"asset":"idc-gw-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: cis.euce1, latam.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, euce1 (no .aws)"},{"asset":"idp-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"idp-gw-cf.latam-mx.usea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: latam-mx.usea1, euce1 (no .aws)"},{"asset":"idp-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"in-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"inc-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ingest.clairvoyance.indrive.tech","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"intercity.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"invisionu.education","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"is-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"isa-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"isa-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"jlml-wf.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"jlml.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"job.ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"juntasllegamos.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"landing.ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"media.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"movie.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"msg-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"msg-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"msg-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"nb-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ncc-cf.latam-br.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: latam-br.saea1, latam-mx.usea1, sa.apse1, sea.apse3"},{"asset":"ncc-gw-cf.latam-pe.saea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: latam-pe.saea1"},{"asset":"nf-cf.latam-mx.usea1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: latam-mx.usea1"},{"asset":"nf-of-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"nha-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"nha-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"nha-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"no-gw-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, mena-eg.meso1, sa.apse1, sa-in.apso1, se"},{"asset":"no-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"oymyakon.indriver.io","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"pa-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"pages.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pc-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"pf-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"pf-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"pm-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"pot-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"pp-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"pp-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ppw-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ppw.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"pristegnimechty.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"ps-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ps-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ra-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ra-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"ra-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"rc-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, mena-eg.meso1, sa.apse1, sa-in.apso1, se"},{"asset":"rc-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"referral-program.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"rp-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"rs-gw-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, sa.apse1, sa-in.apso1, sea.apse3"},{"asset":"rs-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sc-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"sc-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"sc-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"sfc-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"sn-api-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"ssn-lb-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, latam.saea1, mena.euso1, mena.meso1, sa.apse1, sea.apse3, euce1 (no .aws)"},{"asset":"ssn-lb-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"sso.ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sur-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"sur-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"teammate.indriver.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"tr-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"tr-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"tr-gw-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"tr-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"trv-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"txd-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: cis.euce1"},{"asset":"txf-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: cis.euce1"},{"asset":"txm-gw-cf.cis.euce1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: cis.euce1"},{"asset":"url-checker.indrive.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vm-cf.mena.meso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: mena.meso1, mena-eg.meso1"},{"asset":"vm-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"volans.tech","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"was-cf.africa.afso1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Regions: africa.afso1, cis.euce1, eu.euce1, latam.saea1, latam-br.saea1, latam-co.saea1, latam-mx.usea1, latam-pe.saea1, mena.euso1, mena.meso1, mena-eg.euso1, mena-eg.meso1, sa.apse1, sa-in.apso1, se"},{"asset":"was-gw-scf.sa.apse1.aws.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: sa.apse1"},{"asset":"wd1-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"wd1-gw-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"web.ryadom.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wga.volans.tech","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wlr-cf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"wlr-scf.euce1.indriverapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Region: euce1"},{"asset":"www.juntasllegamos.indrive.com","type":"URL","bounty":true,"severity":"high","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 6d ago"},"slop":{"risk":0.08,"label":"none","experimental":true}},"derived":{"novelty":0.2187,"inverse_crowd":0.6102,"payout_reliability":0.9863,"value_per_competition":0.3172,"triage_quality":1.0,"scope_breadth":0.9228,"crowding_per_asset_month":0.6882,"slop_risk":0.08},"score":{"total":62.5,"parts":{"novelty":0.219,"inverse_crowd":0.61,"payout_reliability":0.986,"value_per_competition":0.317,"triage_quality":1.0,"scope_breadth":0.923},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":98.2},"reasons":[{"sign":"good","text":"paid $35k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"638 reports in 90 days across 309 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.6 years"}]},{"id":"hackerone:nba-public","platform":"hackerone","slug":"nba-public","name":"NBA Public Bug Bounty","url":"https://hackerone.com/nba-public","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-07-31T15:44:53.306Z","age_months":26.6473354068085,"reports_90d":954,"resolved_total":67,"response_efficiency":84,"response_indicator":"ok","paid_total":98150,"paid_90d":55600,"last_resolved_at":"2026-10-19T18:55:27.044Z","days_since_resolved":0.9459365141782408,"avg_bounty_low":400,"avg_bounty_high":500,"min_bounty":50,"scope_count":489},"scope":[{"asset":"aces-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aces-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aces-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aces.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"adb.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aguacaliente-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aguacaliente-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aguacaliente.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ak-static-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"allstar-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"amp-nba-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"amp-nba-stage.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"amp-nba.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"austin-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"austin-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"austin.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-dev-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-qa-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-uat-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth-identity.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bakersfield-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bakersfield.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bal-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bal-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bal-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bal.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bealegend.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"birmingham-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"birmingham-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"birmingham.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bluecoats-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bluecoats.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"br.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"canton-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"canton-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"canton.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitalcity-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitalcity-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitalcity.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitanes-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitanes-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capitanes.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cares-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cares-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cares.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-bal-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-bal-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-bal-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-bal.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-gleague-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-gleague-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-uat.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cl-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cl.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cleveland-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cleveland-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cleveland.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coachellavalley-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coachellavalley-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coachellavalley.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coalition-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coalition-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.nbaimd.gametime.nba2011","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.nbaimd.gametime.universal","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"comets-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"comets-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"comets-uat.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"comets.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"communityassist.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"contact-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"contact-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"contact.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-nextgen-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-nextgen-prod.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-nextgen-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-nextgen-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-prod.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-sandbox.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-api-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-aws-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-aws-prod-east1.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-aws-prod.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-aws-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-aws-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-devint.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-sandbox.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-uat-uc.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api-uc.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coronavirus.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"corp-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"corp.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"courtside.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cpskyhawks-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cpskyhawks-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cpskyhawks.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-aws-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-aws-uat-uw2.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-aws-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-dev-aws.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-dev-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-devint.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-qa-aws.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-qa-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uat-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uat-uc-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uat-uc.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uc-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-uc.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-wnba-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-wnba-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott-wnba.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-ott.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-qa-aws-preview.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot1-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot2-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot3-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot4-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot5-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot6-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cweb-slot6-preview-ott-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"data-test.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"delaware-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"delaware-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"delaware.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"detroit-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"detroit-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"detroit.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev.courtside.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev.stats.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev.stats.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev.stats.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dream-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dream-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dream-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dream.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dwhreports.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ec2-redirect-west.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ec2redirect-west.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"elm.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"erie-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"erie-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"erie.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fever-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fever-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fever-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fever.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fire-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fire-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fire.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fit.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fortwayne-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fortwayne-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fortwayne.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gamenotes.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gatoradetrainingcenter.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gldatacenter.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gleague-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gleague-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"globalstores-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"globalstores-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"globalstores.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gms-prev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gms.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grae.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grandrapids-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grandrapids-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grandrapids.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"green.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"greensboro-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"greensboro-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"greensboro.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hoop.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hoopsfortroops.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"huddle.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-ng.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-ping-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-ping-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-ping-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-ping.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-server.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ignite-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ignite-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ignite.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"inclusion-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"inclusion-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"inclusion.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"indiaontrack.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iowa-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iowa-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iowa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"jrnbaworldchampionship-QA.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"jrnbaworldchampionship-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"jrnbaworldchampionship.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lakeland-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lakeland-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lakeland.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"laketown-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"laketown-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"laketown.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"liberty-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"liberty-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"liberty-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"liberty.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lineemup-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lineemup.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lockervision.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lockervisionteam.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-uat.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"longisland-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"longisland-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"longisland.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lynx-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lynx-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lynx-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"lynx.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"maine-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"maine-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"maine.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-teams-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-teams-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-teams-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-teams.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"manage.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd-devint.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd-perf.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcd.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts-devint.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts-perf.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mcdalerts.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mediaavail.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mediaday.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"meetings.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"memphis-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"memphis-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"memphis.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mercury-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mercury-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mercury-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mercury.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mexicogames.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"motorcity.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mystics-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mystics-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mystics-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mystics.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nba-ar-app.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaacademy-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaacademy-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaacademy.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbabroadcastmanuals.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbafedsvc-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbafedsvc-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbafedsvc.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaholidaycard-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaholidaycard-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaholidaycard.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbaintl.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbameeting.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbatickets-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbatickets-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbatickets.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nbavideo.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"northernarizona-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"northernarizona-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"northernarizona.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nycbasketball.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"official-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"official-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"official.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"oklahomacity-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"oklahomacity-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"oklahomacity.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ontario.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"osceola-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"osceola.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pata.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pdfroster-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pdfroster-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pdfroster.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"peopleanalyticsportal.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"playbook.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"playerhealthvideo.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portland-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portland-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portland.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pr-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pr-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pr.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ptiw.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"qa.stats.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"raptors905-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"raptors905-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"raptors905.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"reno-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"reno.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"riograndevalley-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"riograndevalley-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"riograndevalley.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ripcity-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ripcity-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ripcity.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"saltlakecity-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"saltlakecity-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"saltlakecity.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sandiego.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"santacruz-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"santacruz-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"santacruz.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sems.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"siouxfalls-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"siouxfalls-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"siouxfalls.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sky-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sky-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sky-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sky.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"socialimpact.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"southbay-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"southbay-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"southbay.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sparks-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sparks-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sparks-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sparks.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-querytoolapi.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-aws-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-aws-prod-east1.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-aws-prod.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-aws-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-aws-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-dev.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-prod.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-qa.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats-trafficcop-uat.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stats.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stockton-dev.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stockton-qa.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"stockton.gleague.nba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"storm-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"storm-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"storm-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"storm.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sun-dev.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sun-qa.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sun-qa2.wnba.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"84% response, paid recently, resolved 1d ago"},"slop":{"risk":0.423,"label":"watch","experimental":true}},"derived":{"novelty":0.2651,"inverse_crowd":0.6263,"payout_reliability":0.9179,"value_per_competition":0.3804,"triage_quality":0.84,"scope_breadth":0.9964,"crowding_per_asset_month":0.6503,"slop_risk":0.423},"score":{"total":62.1,"parts":{"novelty":0.265,"inverse_crowd":0.626,"payout_reliability":0.918,"value_per_competition":0.38,"triage_quality":0.84,"scope_breadth":0.996},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":97.7},"reasons":[{"sign":"good","text":"paid $56k in the last 90 days"},{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"954 reports in 90 days across 489 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.2 years"}]},{"id":"hackerone:remitly","platform":"hackerone","slug":"remitly","name":"Remitly","url":"https://hackerone.com/remitly","meta":{"reward_min":50,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-03-06T18:01:49.761Z","age_months":31.47377983033881,"reports_90d":154,"resolved_total":202,"response_efficiency":100,"response_indicator":"ok","paid_total":183080,"paid_90d":51401,"last_resolved_at":"2026-10-08T18:51:12.914Z","days_since_resolved":11.948877833622685,"avg_bounty_low":250,"avg_bounty_high":400,"min_bounty":50,"scope_count":75},"scope":[{"asset":"*.dev.remitly.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.int.remitly.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"674258465","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"ablink.info.remitly.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"access-sandbox.remitly.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"access.remitly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.remitly.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.rewire.to","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app3.rewire.to","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"auth.remitly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"beamitmobile.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"blog.remitly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cardpayments.remitly.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cards.remitly.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"careers.remitly.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"com.remitly.androidapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"funding-webhooks.remitly.io","type":"API","bounty":true,"severity":"high","instruction":null},{"asset":"getorigen.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"getsurenow.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"hub-api-sandbox.remitly.io","type":"API","bounty":true,"severity":"medium","instruction":null},{"asset":"insuritly.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"ir.remitly.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"login.remitly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"media.remitly.io","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"metrics.int.remitly.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"news.remitly.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"origenapp.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"origenbanking.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"origencard.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"origendebit.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"origenfinance.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"partner-webhook.remitly.io","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"rates.rewire.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remilty.net","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remilty.org","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitir.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitiy.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly-3pjs.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly-vendor.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.ca","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.cash","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.co","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.co.uk","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"remitly.com.au","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.com.mx","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.de","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.es","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.eu","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.fr","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.io","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.jp","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.me","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.mx","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.net","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.org","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.uk","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitly.xyz","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlyapi.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlycard.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlycredit.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlydata.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlyit.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlypay.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlypayments.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlytest.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitlywallet.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"remitresearch.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"rewire.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"site.rewire.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"travelcash.money","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"whyisend.com","type":"URL","bounty":true,"severity":"medium","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 12d ago"},"slop":{"risk":0.055,"label":"none","experimental":true}},"derived":{"novelty":0.2485,"inverse_crowd":0.6118,"payout_reliability":0.9751,"value_per_competition":0.3593,"triage_quality":1.0,"scope_breadth":0.6966,"crowding_per_asset_month":0.6844,"slop_risk":0.055},"score":{"total":62.0,"parts":{"novelty":0.249,"inverse_crowd":0.612,"payout_reliability":0.975,"value_per_competition":0.359,"triage_quality":1.0,"scope_breadth":0.697},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":97.3},"reasons":[{"sign":"good","text":"paid $51k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"154 reports in 90 days across 75 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.6 years"}]},{"id":"hackerone:hyatt","platform":"hackerone","slug":"hyatt","name":"Hyatt Hotels","url":"https://hackerone.com/hyatt","meta":{"reward_min":0,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-01-09T13:30:43.333Z","age_months":93.34444164036238,"reports_90d":187,"resolved_total":768,"response_efficiency":97,"response_indicator":"ok","paid_total":1115110,"paid_90d":83780,"last_resolved_at":"2026-10-20T12:37:42.393Z","days_since_resolved":0.2082588637152778,"avg_bounty_low":400,"avg_bounty_high":600,"min_bounty":0,"scope_count":101},"scope":[{"asset":"140.95.0.0/16","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"199.66.248.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"213.139.133.32/28","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"476639005","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"assets.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":"We are adding this subdomain to our program as our main domain pulls images and other assets from this site."},{"asset":"blueskytours.globalbookingsolutions.com","type":"URL","bounty":true,"severity":"critical","instruction":"Does not include additional subdomains."},{"asset":"book.applevacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"book.beachbound.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"book.cheapcaribbean.com","type":"URL","bounty":true,"severity":"critical","instruction":"Do not target additional subdomains."},{"asset":"booking.applevacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"booking.beachbound.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"booking.cheapcaribbean.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.Hyatt","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"confluence.hyattdev.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ebsext.oft.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.www.vaxvacationaccess.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"meetings.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mobileapp.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"new.www.vaxvacationaccess.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"newsroom.images.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only test newsroom.images.hyatt.com; newsroom.hyatt.com is not hosted by Hyatt (do not test)."},{"asset":"plannerrequest.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"public.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.blueskytours.globalbookingsolutions.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.funjet.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.hyattinclusivecollection.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.secretsresorts.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.universalorlandovacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.buschgardens.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.discoverycove.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.seaworld.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.sesameplace.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.united.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"res.vacations.universalstudioshollywood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"reservations.wynnvacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rezagent.triseptsolutions.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"roominglist.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"salesportal.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"scapegoat.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"shop.wyndhamvacationownership.trisept.travel","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"soaext.oft.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sso.oft.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"upsell.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vacations.travelimpressions.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vacations.united.com","type":"URL","bounty":true,"severity":"critical","instruction":"Does not include additional subdomains."},{"asset":"vacations.universalstudioshollywood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"world.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.applevacations.com","type":"URL","bounty":true,"severity":"critical","instruction":"Does not include additional subdomains."},{"asset":"www.beachbound.com","type":"URL","bounty":true,"severity":"critical","instruction":"Does not include additional subdomains."},{"asset":"www.blueskytours.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.cheapcaribbean.com","type":"URL","bounty":true,"severity":"critical","instruction":"Do not target additional subdomains."},{"asset":"www.funjet.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.hyatt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.hyattconnect.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.hyattinclusivecollection.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.triseptapi.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.triseptdemo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.triseptsolutions.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.universalorlandovacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.wynnvacations.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 0d ago"},"slop":{"risk":0.032,"label":"none","experimental":true}},"derived":{"novelty":0.1622,"inverse_crowd":0.6409,"payout_reliability":0.9845,"value_per_competition":0.3995,"triage_quality":0.97,"scope_breadth":0.744,"crowding_per_asset_month":0.6172,"slop_risk":0.032},"score":{"total":61.6,"parts":{"novelty":0.162,"inverse_crowd":0.641,"payout_reliability":0.985,"value_per_competition":0.4,"triage_quality":0.97,"scope_breadth":0.744},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":96.8},"reasons":[{"sign":"good","text":"paid $84k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"187 reports in 90 days across 101 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 7.8 years"}]},{"id":"hackerone:goldmansachs","platform":"hackerone","slug":"goldmansachs","name":"Goldman Sachs","url":"https://hackerone.com/goldmansachs","meta":{"reward_min":0,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-05-08T17:09:53.758Z","age_months":101.42157662211005,"reports_90d":131,"resolved_total":522,"response_efficiency":98,"response_indicator":"ok","paid_total":865661,"paid_90d":68180,"last_resolved_at":"2026-10-14T21:51:31.264Z","days_since_resolved":5.823665449363426,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":0,"scope_count":79},"scope":[{"asset":"*.advisorsolutions.gs.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ayco.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.claritymoney.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"*.folioclient.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"This site is in the process of being retired. Only Critical, High issues will be considered for bounty"},{"asset":"*.foliofn.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"This site is in the process of being retired. Only Critical, High issues will be considered for bounty"},{"asset":"*.folioidentity.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"This site is in the process of being retired. Only Critical, High issues will be considered for bounty"},{"asset":"*.folioinstitutional.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"This site is in the process of being retired. Only Critical, High issues will be considered for bounty"},{"asset":"*.global-liquidity.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.goldman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.goldmanpfm.com","type":"URL","bounty":true,"severity":"critical","instruction":"Avoid all active testing on contact and registration forms, such as \"Contact us\", \"Register for a Demo\", and \"Speak With a Financial Advisor\". These forms may generate emails that will affect the busi"},{"asset":"*.goldmansachs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Goldman Sachs' main website."},{"asset":"*.gs-mosaic.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gs-mosaic.qa.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gs.de","type":"URL","bounty":true,"severity":"critical","instruction":"Includes:\n*.gs.de\n*.gsmarkets.de\n*.gsmarkets.nl\n*.gsmarkets.at\n*.gsmarkets.be\n\nExcludes the 3rd party hosted site:\nclassic.gs.de\n\nIn scope sites may display a page overlay to US visitors which can be "},{"asset":"*.gsam.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gspublishing.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gsselect.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.honestdollar.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.marcus.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.marcus.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.nextcapital.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any domain pointing to a third party service that is not a cloud provider is out of scope for testing. If unsure whether an asset is in scope, please reach out to bugbounty@gs.com before testing."},{"asset":"*.nnip.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"Note that NNIP was acquired by Goldman Sachs from NN Group. Please ensure that the asset you're testing is indeed owned and managed by Goldman Sachs and isn't in fact an NN Group asset.  When in doubt"},{"asset":"*.qaglobal-liquidity.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"GS Select iOS app","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[GS Select iOS app](https://apps.apple.com/us/app/gs-select/id1634151697)"},{"asset":"apigw.foliofn.com","type":"URL","bounty":true,"severity":"critical","instruction":"This site is in the process of being retired. Only Critical, High issues will be considered for bounty"},{"asset":"com.gs.gsnow.external","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[GS Now iOS](https://apps.apple.com/us/app/gs-now/id1473474041)"},{"asset":"com.gs.gstrader.external","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Marquee Trader Mobile](https://apps.apple.com/us/app/marquee-trader-mobile/id1518269915)"},{"asset":"com.gs.mobile.gsnow","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[GS Now Android](https://play.google.com/store/apps/details?id=com.gs.mobile.gsnow)"},{"asset":"com.gs.mobile.trader","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Marquee Trader Android](https://play.google.com/store/apps/details?id=com.gs.mobile.trader&hl=en_IN&gl=US)"},{"asset":"com.gs.pfmg.wellness","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Goldman Sachs Wellness Android](https://play.google.com/store/apps/details?id=com.gs.pfmg.wellness&hl=en_IN&gl=US)"},{"asset":"com.gs.pwmdigital.external","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[GS PWM iOS](https://apps.apple.com/us/app/gs-pwm/id1440077444)"},{"asset":"com.gs.pwmdigital.external.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[GS PWM Android](https://play.google.com/store/apps/details?id=com.gs.pwmdigital.external.android)"},{"asset":"com.marcus.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Marcus US Android](https://play.google.com/store/apps/details?id=com.marcus.android&hl=en_IN&gl=US)"},{"asset":"com.marcus.android.uk","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Marcus UK: Online Savings Bank Android](https://play.google.com/store/apps/details?id=com.marcus.android.uk)"},{"asset":"com.marcus.ios-uk","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Marcus UK: Online savings bank](https://apps.apple.com/gb/app/marcus-uk-online-savings-bank/id1489511701)"},{"asset":"com.marcus.ios-us","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Marcus by Goldman Sachs](https://apps.apple.com/us/app/marcus-save-borrow-invest/id1489511701)"},{"asset":"developer.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"goldmansachsindices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"marquee.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"research.gs.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 6d ago"},"slop":{"risk":0.03,"label":"none","experimental":true}},"derived":{"novelty":0.157,"inverse_crowd":0.6707,"payout_reliability":0.9775,"value_per_competition":0.3593,"triage_quality":0.98,"scope_breadth":0.7049,"crowding_per_asset_month":0.5527,"slop_risk":0.03},"score":{"total":61.2,"parts":{"novelty":0.157,"inverse_crowd":0.671,"payout_reliability":0.977,"value_per_competition":0.359,"triage_quality":0.98,"scope_breadth":0.705},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":96.4},"reasons":[{"sign":"good","text":"paid $68k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"131 reports in 90 days across 79 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.5 years"}]},{"id":"hackerone:ridewithvia","platform":"hackerone","slug":"ridewithvia","name":"Via","url":"https://hackerone.com/ridewithvia","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-03-31T08:22:15.364Z","age_months":66.67386135631037,"reports_90d":25,"resolved_total":107,"response_efficiency":88,"response_indicator":"ok","paid_total":42600,"paid_90d":850,"last_resolved_at":"2026-10-19T13:28:12.113Z","days_since_resolved":1.173192660011574,"avg_bounty_low":150,"avg_bounty_high":200,"min_bounty":50,"scope_count":23},"scope":[{"asset":" com.citymapper.app.release","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"469463298","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"6449737830","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"6464473474","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"657777015","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"eu.remix.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"global-api.citymapper.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://metroconnect.app.ridewithvia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://pt-runner.app.ridewithvia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"platform.remix.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ridewithvia.neoridelittlerock","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"ridewithvia.par.piercetransit","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"via.rider","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 1d ago"},"slop":{"risk":0.022,"label":"none","experimental":true}},"derived":{"novelty":0.1853,"inverse_crowd":0.7718,"payout_reliability":0.9374,"value_per_competition":0.3931,"triage_quality":0.88,"scope_breadth":0.5112,"crowding_per_asset_month":0.3623,"slop_risk":0.022},"score":{"total":61.2,"parts":{"novelty":0.185,"inverse_crowd":0.772,"payout_reliability":0.937,"value_per_competition":0.393,"triage_quality":0.88,"scope_breadth":0.511},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":95.9},"reasons":[{"sign":"good","text":"paid $850 in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"25 reports in 90 days across 23 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.6 years"}]},{"id":"hackerone:nextcloud","platform":"hackerone","slug":"nextcloud","name":"Nextcloud","url":"https://hackerone.com/nextcloud","meta":{"reward_min":100,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-06-17T09:59:17.510Z","age_months":124.10080555510875,"reports_90d":217,"resolved_total":1128,"response_efficiency":100,"response_indicator":"ok","paid_total":151613,"paid_90d":23995,"last_resolved_at":"2026-10-20T07:22:11.908Z","days_since_resolved":0.4273616993634259,"avg_bounty_low":150,"avg_bounty_high":150,"min_bounty":100,"scope_count":117},"scope":[{"asset":"Desktop Client","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"critical","instruction":"Issues affecting the Desktop Client available from [https://nextcloud.com/install/#install-clients](https://nextcloud.com/install/#install-clients \"https://nextcloud.com/install/#install-clients\")"},{"asset":"apps.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Part of the Nextcloud app store which source code is available from [https://github.com/nextcloud/appstore](https://github.com/nextcloud/appstore \"https://github.com/nextcloud/appstore\"). Note that al"},{"asset":"auth.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"com.nextcloud.Talk","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"medium","instruction":"Our official iOS Talk client from [https://itunes.apple.com/app/id1296825574](https://itunes.apple.com/app/id1296825574)"},{"asset":"com.nextcloud.client","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"medium","instruction":"Our official Android client from [https://play.google.com/store/apps/details?id=com.nextcloud.client](https://play.google.com/store/apps/details?id=com.nextcloud.client \"https://play.google.com/store/"},{"asset":"com.nextcloud.talk2","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"medium","instruction":"Our official Android Talk client from [https://play.google.com/store/apps/details?id=com.nextcloud.talk2](https://play.google.com/store/apps/details?id=com.nextcloud.talk2)"},{"asset":"com.peterandlinda.iOCNotes","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"Our official iOS Nextcloud Notes client from [https://itunes.apple.com/app/id813973264](https://itunes.apple.com/app/id813973264)"},{"asset":"crm.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"customerupdates.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"This domain serves updates to Nextcloud server and the Nextcloud desktop client.\n\n- Client updater server:[https://github.com/nextcloud/client\\_updater\\_server](https://github.com/nextcloud/client_upd"},{"asset":"docs.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Static web server serving the generated documentation from [https://github.com/nextcloud/documentation](https://github.com/nextcloud/documentation \"https://github.com/nextcloud/documentation\")"},{"asset":"download.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"While updates and downloads are cryptographically signed this is still a core part of Nextcloud. We thus pay out monetary rewards for issues affecting the integrity of the system. (e.g. allowing an at"},{"asset":"help.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"This asset is running Discourse, and as such reports of newly discovered vulnerabilities should be submitted to their program instead: [https://hackerone.com/discourse](https://hackerone.com/discourse"},{"asset":"https://github.com/nextcloud/collectives","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/collectives](https://github.com/nextcloud/collectives) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenc"},{"asset":"https://github.com/nextcloud/files_confidential","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files_confidential](https://github.com/nextcloud/files_confidential) – Note that some folders such as tests and so on will not be packaged. Please make sure tha"},{"asset":"https://github.com/nextcloud/tables","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/tables](https://github.com/nextcloud/tables) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is"},{"asset":"https://github.com/roundcube/roundcubemail","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/roundcube/roundcubemail](https://github.com/roundcube/roundcubemail) – Note that some folders such as tests and so on will not be packaged. Please make sure that the refe"},{"asset":"it.niedermann.owncloud.notes","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"medium","instruction":"Our official Android Notes client from [https://play.google.com/store/apps/details?id=it.niedermann.owncloud.notes](https://play.google.com/store/apps/details?id=it.niedermann.owncloud.notes \"https://"},{"asset":"it.twsweb.Nextcloud","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"medium","instruction":"Our official iOS client from [https://itunes.apple.com/app/nextcloud/id1125420102](https://itunes.apple.com/app/nextcloud/id1125420102 \"https://itunes.apple.com/app/nextcloud/id1125420102\")"},{"asset":"knowledge.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"lists.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"logs.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"lookup.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"The Nextcloud lookup server source code can be found at [https://github.com/nextcloud/lookup-server/](https://github.com/nextcloud/lookup-server/ \"https://github.com/nextcloud/lookup-server/\")"},{"asset":"newsletter.nextcloud.com","type":"URL","bounty":false,"severity":"low","instruction":null},{"asset":"nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"The nextcloud.com website is running Wordpress and the source code of our theme and adjustments can be found at [https://github.com/nextcloud/nextcloud.com](https://github.com/nextcloud/nextcloud.com "},{"asset":"nextcloud/3rdparty","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/3rdparty](https://github.com/nextcloud/3rdparty \"https://github.com/nextcloud/3rdparty\") – Note that some folders such as tests and so on will not be packaged. "},{"asset":"nextcloud/activity","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/activity](https://github.com/nextcloud/activity \"https://github.com/nextcloud/activity\") – Note that some folders such as tests and so on will not be packaged. "},{"asset":"nextcloud/approval","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/approval](https://github.com/nextcloud/approval) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced fil"},{"asset":"nextcloud/bruteforcesettings","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/bruteforcesettings](https://github.com/nextcloud/bruteforcesettings) – Note that some folders such as tests and so on will not be packaged. Please make sure tha"},{"asset":"nextcloud/calendar","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/calendar](https://github.com/nextcloud/calendar) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced fil"},{"asset":"nextcloud/calendar_resource_management","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/calendar_resource_management](https://github.com/nextcloud/calendar_resource_management) – Note that some folders such as tests and so on will not be packaged. "},{"asset":"nextcloud/circles","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/circles](https://github.com/nextcloud/circles \"https://github.com/nextcloud/circles\") – Note that some folders such as tests and so on will not be packaged. Ple"},{"asset":"nextcloud/contacts","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/contacts](https://github.com/nextcloud/contacts) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced fil"},{"asset":"nextcloud/data_request","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/data_request](https://github.com/nextcloud/data_request) – Note that some folders such as tests and so on will not be packaged. Please make sure that the refere"},{"asset":"nextcloud/deck","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/deck](https://github.com/nextcloud/deck \"https://github.com/nextcloud/deck\") – Note that some folders such as tests and so on will not be packaged. Please make "},{"asset":"nextcloud/end_to_end_encryption","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/end_to_end_encryption](https://github.com/nextcloud/end_to_end_encryption \"https://github.com/nextcloud/end_to_end_encryption\") – Note that some folders such as"},{"asset":"nextcloud/external","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/external](https://github.com/nextcloud/external) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced fil"},{"asset":"nextcloud/files_accesscontrol","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files\\_accesscontrol](https://github.com/nextcloud/files_accesscontrol \"https://github.com/nextcloud/files\\_accesscontrol\") – Note that some folders such as tes"},{"asset":"nextcloud/files_antivirus","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files_antivirus](https://github.com/nextcloud/files_antivirus) – Note that some folders such as tests and so on will not be packaged. Please make sure that the "},{"asset":"nextcloud/files_automatedtagging","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files\\_automatedtagging](https://github.com/nextcloud/files_automatedtagging \"https://github.com/nextcloud/files\\_automatedtagging\") – Note that some folders su"},{"asset":"nextcloud/files_fulltextsearch","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files_fulltextsearch](https://github.com/nextcloud/files_fulltextsearch) – Note that some folders such as tests and so on will not be packaged. Please make sure"},{"asset":"nextcloud/files_fulltextsearch_tesseract","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from https://github.com/nextcloud/files_fulltextsearch_tesseract\nNote that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is thus also existe"},{"asset":"nextcloud/files_lock","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files_lock](https://github.com/nextcloud/files_lock) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced"},{"asset":"nextcloud/files_pdfviewer","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files\\_pdfviewer](https://github.com/nextcloud/files_pdfviewer \"https://github.com/nextcloud/files\\_pdfviewer\") – Note that some folders such as tests and so on"},{"asset":"nextcloud/files_retention","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files\\_retention](https://github.com/nextcloud/files_retention \"https://github.com/nextcloud/files\\_retention\") – Note that some folders such as tests and so on"},{"asset":"nextcloud/files_rightclick","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files_rightclick](https://github.com/nextcloud/files_rightclick \"https://github.com/nextcloud/files_rightclick\") – Note that some folders such as tests and so o"},{"asset":"nextcloud/files_texteditor","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/files\\_texteditor](https://github.com/nextcloud/files_texteditor \"https://github.com/nextcloud/files\\_texteditor\") – Note that some folders such as tests and so"},{"asset":"nextcloud/firstrunwizard","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/firstrunwizard](https://github.com/nextcloud/firstrunwizard \"https://github.com/nextcloud/firstrunwizard\") – Note that some folders such as tests and so on will"},{"asset":"nextcloud/flow_notifications","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/flow_notifications](https://github.com/nextcloud/flow_notifications) – Note that some folders such as tests and so on will not be packaged. Please make sure tha"},{"asset":"nextcloud/fulltextsearch","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/fulltextsearch](https://github.com/nextcloud/fulltextsearch) – Note that some folders such as tests and so on will not be packaged. Please make sure that the re"},{"asset":"nextcloud/fulltextsearch_elasticsearch","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/fulltextsearch_elasticsearch](https://github.com/nextcloud/fulltextsearch_elasticsearch) – Note that some folders such as tests and so on will not be packaged. "},{"asset":"nextcloud/globalsiteselector","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/globalsiteselector](https://github.com/nextcloud/globalsiteselector) – Note that some folders such as tests and so on will not be packaged. Please make sure tha"},{"asset":"nextcloud/groupfolders","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/groupfolders](https://github.com/nextcloud/groupfolders) – Note that some folders such as tests and so on will not be packaged. Please make sure that the refere"},{"asset":"nextcloud/guests","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/guests](https://github.com/nextcloud/guests) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is"},{"asset":"nextcloud/logreader","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/logreader](https://github.com/nextcloud/logreader \"https://github.com/nextcloud/logreader\") – Note that some folders such as tests and so on will not be package"},{"asset":"nextcloud/mail","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/mail](https://github.com/nextcloud/mail \"https://github.com/nextcloud/mail\") – Note that some folders such as tests and so on will not be packaged. Please make "},{"asset":"nextcloud/nextcloud_announcements","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/nextcloud\\_announcements](https://github.com/nextcloud/nextcloud_announcements \"https://github.com/nextcloud/nextcloud\\_announcements\") – Note that some folders"},{"asset":"nextcloud/notes","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/notes](https://github.com/nextcloud/notes \"https://github.com/nextcloud/notes\") – Note that some folders such as tests and so on will not be packaged. Please ma"},{"asset":"nextcloud/notifications","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/notifications](https://github.com/nextcloud/notifications \"https://github.com/nextcloud/notifications\") – Note that some folders such as tests and so on will no"},{"asset":"nextcloud/notify_push","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/notify_push](https://github.com/nextcloud/notify_push) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenc"},{"asset":"nextcloud/password_policy","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/password\\_policy](https://github.com/nextcloud/password_policy \"https://github.com/nextcloud/password\\_policy\") – Note that some folders such as tests and so on"},{"asset":"nextcloud/photos","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/photos](https://github.com/nextcloud/photos \"https://github.com/nextcloud/photos\") – Note that some folders such as tests and so on will not be packaged. Please"},{"asset":"nextcloud/preferred_providers","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/preferred_providers](https://github.com/nextcloud/preferred_providers) – Note that some folders such as tests and so on will not be packaged. Please make sure t"},{"asset":"nextcloud/privacy","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/privacy](https://github.com/nextcloud/privacy \"https://github.com/nextcloud/privacy\") – Note that some folders such as tests and so on will not be packaged. Ple"},{"asset":"nextcloud/recommendations","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/recommendations](https://github.com/nextcloud/recommendations \"https://github.com/nextcloud/recommendations\") – Note that some folders such as tests and so on w"},{"asset":"nextcloud/related_resources","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/related_resources](https://github.com/nextcloud/related_resources) – Note that some folders such as tests and so on will not be packaged. Please make sure that "},{"asset":"nextcloud/richdocuments","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/richdocuments](https://github.com/nextcloud/richdocuments) – Note that some folders such as tests and so on will not be packaged. Please make sure that the refe"},{"asset":"nextcloud/server","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/server](https://github.com/nextcloud/server \"https://github.com/nextcloud/server\") – Note that some folders such as tests and so on will not be packaged. Please"},{"asset":"nextcloud/serverinfo","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/serverinfo](https://github.com/nextcloud/serverinfo \"https://github.com/nextcloud/serverinfo\") – Note that some folders such as tests and so on will not be pack"},{"asset":"nextcloud/sharepoint","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/sharepoint](https://github.com/nextcloud/sharepoint) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced"},{"asset":"nextcloud/socialsharing","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/socialsharing](https://github.com/nextcloud/socialsharing) – Note that some folders such as tests and so on will not be packaged. Please make sure that the refe"},{"asset":"nextcloud/spreed","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/spreed](https://github.com/nextcloud/spreed) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced file is"},{"asset":"nextcloud/survey_client","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/survey\\_client](https://github.com/nextcloud/survey_client \"https://github.com/nextcloud/survey\\_client\") – Note that some folders such as tests and so on will "},{"asset":"nextcloud/suspicious_login","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/suspicious_login](https://github.com/nextcloud/suspicious_login) – Note that some folders such as tests and so on will not be packaged. Please make sure that th"},{"asset":"nextcloud/terms_of_service","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/terms_of_service](https://github.com/nextcloud/terms_of_service) – Note that some folders such as tests and so on will not be packaged. Please make sure that th"},{"asset":"nextcloud/text","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/text](https://github.com/nextcloud/text \"https://github.com/nextcloud/text\") – Note that some folders such as tests and so on will not be packaged. Please make "},{"asset":"nextcloud/twofactor_totp","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/twofactor_totp](https://github.com/nextcloud/twofactor_totp) – Note that some folders such as tests and so on will not be packaged. Please make sure that the re"},{"asset":"nextcloud/twofactor_webauthn","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/twofactor_webauthn](https://github.com/nextcloud/twofactor_webauthn) – Note that some folders such as tests and so on will not be packaged. Please make sure tha"},{"asset":"nextcloud/updater","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/updater](https://github.com/nextcloud/updater \"https://github.com/nextcloud/updater\") – Note that some folders such as tests and so on will not be packaged. Ple"},{"asset":"nextcloud/user_migration","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/user_migration](https://github.com/nextcloud/user_migration) – Note that some folders such as tests and so on will not be packaged. Please make sure that the re"},{"asset":"nextcloud/user_oidc","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/user_oidc](https://github.com/nextcloud/user_oidc) – Note that some folders such as tests and so on will not be packaged. Please make sure that the referenced f"},{"asset":"nextcloud/user_saml","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/user\\_saml](https://github.com/nextcloud/user_saml \"https://github.com/nextcloud/user\\_saml\") – Note that some folders such as tests and so on will not be packa"},{"asset":"nextcloud/viewer","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/viewer](https://github.com/nextcloud/viewer \"https://github.com/nextcloud/viewer\") – Note that some folders such as tests and so on will not be packaged. Please"},{"asset":"nextcloud/workflow_script","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Code from [https://github.com/nextcloud/workflow_script](https://github.com/nextcloud/workflow_script) – Note that some folders such as tests and so on will not be packaged. Please make sure that the "},{"asset":"portal.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Portal with support answers by the Nextcloud support team.\n\nPlease be extremely careful when testing this server as it is used by our customers as well."},{"asset":"projects.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"push-notifications.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Backend behind the push notification proxy for our mobile apps. Our push notifications are End-To-End encrypted and thus an attacker would not be able to gain access to the content of push notificatio"},{"asset":"pushfeed.nextcloud.com","type":"URL","bounty":false,"severity":"low","instruction":"pushfeed.nextcloud.com is used to push cryptographically signed announcements to administrators of all Nextcloud instances. The source code for the generation of said announcement feeds can be found a"},{"asset":"scan.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Runs the web interface for the software used by the Nextcloud security scanner."},{"asset":"static.apps.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Part of the Nextcloud app store which source code is available from [https://github.com/nextcloud/appstore](https://github.com/nextcloud/appstore \"https://github.com/nextcloud/appstore\"). Note that al"},{"asset":"stats.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Internally used system behind SSO. We'd like to ask you to not actively test against our production SSO server. You can find the used software at [http://www.keycloak.org/](http://www.keycloak.org/ \"h"},{"asset":"support.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"This asset is running Zammad, and as such reports of newly discovered vulnerabilities should be submitted to them: [https://zammad.com/contact](https://zammad.com/contact \"https://zammad.com/contact\")"},{"asset":"surveyserver.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"The survey server data processes and stores anonymous statistics about deployed Nextcloud instances. Source code of the server can be found at [https://github.com/nextcloud/survey\\_server](https://git"},{"asset":"updates.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"This domain serves updates to Nextcloud server and the Nextcloud desktop client.\n\n- Client updater server:[https://github.com/nextcloud/client\\_updater\\_server](https://github.com/nextcloud/client_upd"},{"asset":"usercontent.apps.nextcloud.com","type":"URL","bounty":false,"severity":"critical","instruction":"Note that usercontent.apps.nextcloud.com serves potentially untrusted user content and is always setting a Content-Type of attachment. The source code for the software can be found at [https://github."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 0d ago"},"slop":{"risk":0.03,"label":"none","experimental":true}},"derived":{"novelty":0.1449,"inverse_crowd":0.6404,"payout_reliability":0.9991,"value_per_competition":0.3131,"triage_quality":1.0,"scope_breadth":0.7674,"crowding_per_asset_month":0.6182,"slop_risk":0.03},"score":{"total":60.6,"parts":{"novelty":0.145,"inverse_crowd":0.64,"payout_reliability":0.999,"value_per_competition":0.313,"triage_quality":1.0,"scope_breadth":0.767},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":95.5},"reasons":[{"sign":"good","text":"paid $24k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"217 reports in 90 days across 117 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.3 years"}]},{"id":"hackerone:flutteruki","platform":"hackerone","slug":"flutteruki","name":"Flutter UK&I","url":"https://hackerone.com/flutteruki","meta":{"reward_min":250,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-05-18T10:13:10.329Z","age_months":77.08611515317705,"reports_90d":296,"resolved_total":576,"response_efficiency":90,"response_indicator":"ok","paid_total":430000,"paid_90d":40000,"last_resolved_at":"2026-10-16T14:03:51.578Z","days_since_resolved":4.148430333622685,"avg_bounty_low":250,"avg_bounty_high":300,"min_bounty":250,"scope_count":167},"scope":[{"asset":"*.betfair.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betfair.es","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betfair.it","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betfair.ro","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betfair.se","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betsharedservices.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.betviewapi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.dibz.co.uk","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.msgsvc.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.operationstechnology.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paddypartners.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paddypower.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paddypower.it","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.platformservices.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ppb.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ppbdev.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sbgcdn.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sbgcore.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sbgorigin.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sbgservices.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sbgtest.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.securityservices.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybet.co.uk","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybet.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybet.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybetservices.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybettest.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybettingandgaming.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybettingandgaming.design","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybettingandgaming.info","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skybingo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skycasino.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skygamingcontent.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skypoker.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.skyvegas.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sportinglife.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/dev?id=5503565801970655430&gl=gb","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/dev?id=8912907283039023448&gl=GB","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/dev?id=9151483005769461618&gl=GB","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/developer?id=Sky+Betting+and+Gaming+Apps&gl=uk","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"itv7.itv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"metrocompetitions.com","type":"URL","bounty":true,"severity":"critical","instruction":"Product similar to Rafflee (rafflee.co.uk); vulnerabilities affecting both products will be awarded with only one bounty."},{"asset":"rafflee.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"super6.skysports.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"90% response, paid recently, resolved 4d ago"},"slop":{"risk":0.042,"label":"none","experimental":true}},"derived":{"novelty":0.175,"inverse_crowd":0.6528,"payout_reliability":0.941,"value_per_competition":0.3622,"triage_quality":0.9,"scope_breadth":0.8242,"crowding_per_asset_month":0.5908,"slop_risk":0.042},"score":{"total":60.4,"parts":{"novelty":0.175,"inverse_crowd":0.653,"payout_reliability":0.941,"value_per_competition":0.362,"triage_quality":0.9,"scope_breadth":0.824},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":95.0},"reasons":[{"sign":"good","text":"paid $40k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"296 reports in 90 days across 167 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.4 years"}]},{"id":"hackerone:fanduel","platform":"hackerone","slug":"fanduel","name":"FanDuel","url":"https://hackerone.com/fanduel","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-11-08T16:02:18.920Z","age_months":95.37794396487375,"reports_90d":112,"resolved_total":null,"response_efficiency":98,"response_indicator":"ok","paid_total":231725,"paid_90d":11650,"last_resolved_at":"2026-10-19T22:34:23.555Z","days_since_resolved":0.7938935627893519,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":54},"scope":[{"asset":"*.fanduel.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Any testing, development, or perf environments are out of scope for this asset class unless the finding can reasonably impact production.\n\nFor any support assets such as `support.fanduel.com` please d"},{"asset":"*.mgmt.fndlsb.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.prd.fndlsb.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tvg.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Any testing, development, or perf environments are out of scope for this asset class unless the finding can reasonably impact production.\n\nFor any support assets such as `support.tvg.com` please do no"},{"asset":"*inf.fndlsb.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1413721906","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1485539253","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1506229470","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"4njbets.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"4njbets.us.betfair.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"599664106","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"6740879082","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.fanduel.android.self","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.fanduel.casino","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.fanduel.racing","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.fanduel.sportsbook","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"login-4ngbets.us.betfair.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login-4njbets.us.betfair.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.4njbets.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 1d ago"},"slop":{"risk":0.425,"label":"watch","experimental":true}},"derived":{"novelty":0.1608,"inverse_crowd":0.609,"payout_reliability":0.9882,"value_per_competition":0.3711,"triage_quality":0.98,"scope_breadth":0.6446,"crowding_per_asset_month":0.6914,"slop_risk":0.425},"score":{"total":59.9,"parts":{"novelty":0.161,"inverse_crowd":0.609,"payout_reliability":0.988,"value_per_competition":0.371,"triage_quality":0.98,"scope_breadth":0.645},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":94.6},"reasons":[{"sign":"good","text":"paid $12k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"112 reports in 90 days across 54 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 7.9 years"}]},{"id":"hackerone:six-group","platform":"hackerone","slug":"six-group","name":"SIX Group","url":"https://hackerone.com/six-group","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-04-19T13:55:33.861Z","age_months":42.058453912018024,"reports_90d":117,"resolved_total":null,"response_efficiency":82,"response_indicator":"ok","paid_total":114288,"paid_90d":20500,"last_resolved_at":"2026-09-17T07:33:08.033Z","days_since_resolved":33.41976766001157,"avg_bounty_low":900,"avg_bounty_high":1000,"min_bounty":50,"scope_count":74},"scope":[{"asset":"146.109.1.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.140.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.141.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.142.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.143.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.148.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.149.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.150.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.151.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.161.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.2.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.3.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.4.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.64.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.65.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.66.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.67.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.68.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.8.0/21","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"146.109.8.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.0.0/16","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.104.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.108.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.111.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.162.0/23","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.176.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.240.0/20","type":"CIDR","bounty":true,"severity":"critical","instruction":"## Known Issues\n\nThe following vulnerabilities have been identified and are currently being addressed. Reports of these issues will be closed as duplicates:\n\n- Cross-Site Scripting (XSS) vulnerabiliti"},{"asset":"153.46.30.0/23","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.32.0/23","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.34.0/23","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.48.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"153.46.96.0/20","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"174.44.253.152/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"185.210.32.0/22","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"193.109.229.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":"## Known Issues\nThe following vulnerabilities have been identified and are currently being addressed. Reports of these issues will be closed as duplicates:\n- Cross-Site Scripting (XSS) vulnerabilities"},{"asset":"193.110.154.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"193.5.66.0/23","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"193.8.251.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"194.209.121.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"194.35.79.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"212.95.227.64/26","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"62.192.20.16/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"http://ibt-test.six-group.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/ch/app/debix/id1581440132?l=en-GB","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/mx/app/debix/id1581440132","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/mx/app/six-id/id1620496931","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/bme-conecta/id6443938949","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://disclosure-test.six-exchange-regulation.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://fx-qa.np.bolsasymercados.es/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.sixgroup.debixplus","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.sixgroup.id&hl=en_US&pli=1","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=es.grupobme.bmeconecta","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://secure-test.six-swiss-exchange.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://web3.sdx.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"https://www.sdx.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.bolsasymercados.es","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.six-group.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"82% response, pays, last resolved 33d ago"},"slop":{"risk":0.419,"label":"watch","experimental":true}},"derived":{"novelty":0.222,"inverse_crowd":0.6832,"payout_reliability":0.848,"value_per_competition":0.4568,"triage_quality":0.82,"scope_breadth":0.6945,"crowding_per_asset_month":0.527,"slop_risk":0.419},"score":{"total":59.8,"parts":{"novelty":0.222,"inverse_crowd":0.683,"payout_reliability":0.848,"value_per_competition":0.457,"triage_quality":0.82,"scope_breadth":0.695},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":94.1},"reasons":[{"sign":"good","text":"paid $20k in the last 90 days"},{"sign":"good","text":"82% response efficiency"},{"sign":"neutral","text":"117 reports in 90 days across 74 assets"},{"sign":"neutral","text":"running 3.5 years"}]},{"id":"hackerone:early_warning","platform":"hackerone","slug":"early_warning","name":"Early Warning","url":"https://hackerone.com/early_warning","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-21T14:29:00.633Z","age_months":28.981715463466806,"reports_90d":115,"resolved_total":205,"response_efficiency":98,"response_indicator":"ok","paid_total":119654,"paid_90d":4200,"last_resolved_at":"2026-09-22T16:34:40.117Z","days_since_resolved":28.043701872974538,"avg_bounty_low":250,"avg_bounty_high":300,"min_bounty":50,"scope_count":50},"scope":[{"asset":"*.earlywarning.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.zelle.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.zellepay.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"developer*.earlywarning.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"ews-fusion.my.site.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"support*.earlywarning.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"www.certos.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"zelleservice.my.salesforce.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"zelleservice.my.site.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 28d ago"},"slop":{"risk":0.05,"label":"none","experimental":true}},"derived":{"novelty":0.2566,"inverse_crowd":0.579,"payout_reliability":0.9365,"value_per_competition":0.3262,"triage_quality":0.98,"scope_breadth":0.6325,"crowding_per_asset_month":0.7667,"slop_risk":0.05},"score":{"total":59.4,"parts":{"novelty":0.257,"inverse_crowd":0.579,"payout_reliability":0.936,"value_per_competition":0.326,"triage_quality":0.98,"scope_breadth":0.632},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":93.7},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"115 reports in 90 days across 50 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.4 years"}]},{"id":"hackerone:8x8-bounty","platform":"hackerone","slug":"8x8-bounty","name":"8x8","url":"https://hackerone.com/8x8-bounty","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-01-09T04:23:04.527Z","age_months":45.35693643312229,"reports_90d":548,"resolved_total":1318,"response_efficiency":100,"response_indicator":"ok","paid_total":492935,"paid_90d":18950,"last_resolved_at":"2026-10-17T15:55:09.675Z","days_since_resolved":3.071137544270833,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":180},"scope":[{"asset":"*-vpn.8x8.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"**VPN Infrastructure (Palo Alto GlobalProtect)**\n▶︎ RDP: If You See Something, Say Something\n\nTesting Guidelines:\n⚠️ No attempts to exploit vulnerabilities to access internal 8x8 networks\n⚠️ No brute "},{"asset":"*.8x8.cloud","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.co.uk","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.engineering","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.id","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.studio","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents"},{"asset":"*.8x8.uk","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8.vc","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Professional Meetings and Jitsi as a Service. At this time 8x8  does not provide credentials and researchers are responsible for any fees occurred if signing up for the service."},{"asset":"*.8x8cloud.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.8x8e2e.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8hosts.internal","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8hosts.pilot","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8pilot.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8staging.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8testa.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.8x8testb.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.acceptance.cloud.8x8.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.ai.8x8.vc","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents"},{"asset":"*.call-control.ie","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.cceng.8x8.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.chalet.8x8.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"8x8 Chat provides comprehensive team messaging capabilities including 1:1 instant messaging, public and private chat rooms, file sharing, and seamless integration with voice and video calling - all de"},{"asset":"*.fuze.com","type":"WILDCARD","bounty":false,"severity":"low","instruction":"The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"},{"asset":"*.fuze.site","type":"WILDCARD","bounty":false,"severity":"low","instruction":"The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"},{"asset":"*.in2tel.ie","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.jit.si","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Jitsi is a set of open-source projects that allows you to easily build and deploy secure videoconferencing solutions. We are best known for our Jitsi Meet video conferencing platform, [meet.jit.si](ht"},{"asset":"*.jitsi.net","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Jitsi is a set of open-source projects that allows you to easily build and deploy secure videoconferencing solutions. We are best known for our Jitsi Meet video conferencing platform.\n\n**Out of Scope:"},{"asset":"*.labs.8x8.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8's Vibe Platform"},{"asset":"*.mavenlab.com","type":"WILDCARD","bounty":false,"severity":"none","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.moobicast.com","type":"WILDCARD","bounty":false,"severity":"none","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.moobidesk.com","type":"WILDCARD","bounty":false,"severity":"none","instruction":"▶︎ RDP: If You See Something, Say Something\n\naka: moobidesk-main.vercel.app"},{"asset":"*.ociadmin.cloud.8x8.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.p8t.us","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.packet8-pilot.net","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.preview.8x8.vc","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents"},{"asset":"*.prod.cloud.8x8.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.rekap.8x8.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Insights"},{"asset":"*.staging.cloud.8x8.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.thinkingphones.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.thinkingphones.net","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.ucverse.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"*.unreal-agents.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents"},{"asset":"*.unreal-agents.jitsi.net","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents (Development Environment)"},{"asset":"*.wavecell.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"8x8 Communication APIs","type":"API","bounty":false,"severity":"critical","instruction":"Transform customer interactions with our seamless SMS, messaging, video, and voice solutions.\n⚠️ Self Sign-up is available: https://connect.8x8.com/\n⚠️  [8x8 CPaaS developer portal](https://developer."},{"asset":"8x8 Partner Portal","type":"OTHER","bounty":false,"severity":"high","instruction":"▶︎ https://partnerxchange.8x8.com/\n▶︎ https://8x8.my.site.com/partnerxchange/\n▶︎ https://8x8.force.com/partnerxchange/\n⚠️ out of scope: Disclosure of non-sensitive information, such as `Name`, `City`,"},{"asset":"8x8-work","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":"https://apps.apple.com/us/app/8x8-work/id348177448\n\nThe 8x8 Work app for iPhone puts your business communications in your pocket—secure voice calls, HD video meetings, and team chat, all in one beauti"},{"asset":"8x8.my.site.com","type":"URL","bounty":false,"severity":"high","instruction":"Portal for management of your 8x8 account, billing, orders, and support cases\n⚠️ when testing support functionality please add \"HackerOne\" in your subject line and limit the number of requests to an a"},{"asset":"ASN: AS10976","type":"OTHER","bounty":false,"severity":"low","instruction":"**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS133144","type":"OTHER","bounty":false,"severity":"critical","instruction":"**M8X8INC-AS-AP 8x8, Inc., US**\n▶︎ RDP: If You See Something, Say Something\n\n* 103.252.162.0/24\n* 103.239.164.0/24\n* 66.81.216.0/24\n* 66.81.217.0/24"},{"asset":"ASN: AS13896","type":"OTHER","bounty":false,"severity":"low","instruction":"**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something\n\n* 170.76.190.0/23\n* 206.81.181.0/24\n* 103.197.98.0/23\n* 206.81.184.0/24\n* 206.81.176."},{"asset":"ASN: AS14294","type":"OTHER","bounty":false,"severity":"low","instruction":"**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS198554","type":"OTHER","bounty":false,"severity":"critical","instruction":"**DXI-AS, GB**\n▶︎ RDP: If You See Something, Say Something\n\n* 109.70.59.0/24\n* 185.173.49.0/24\n* 185.173.48.0/22\n* 109.70.58.0/24\n* 185.173.48.0/24"},{"asset":"ASN: AS199687","type":"OTHER","bounty":false,"severity":"critical","instruction":"**IN2TEL-DB3, IE**\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS206422","type":"OTHER","bounty":false,"severity":"critical","instruction":"**IN2TEL-BT, IE**\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS32308","type":"OTHER","bounty":false,"severity":"critical","instruction":"**8X8-AS, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 192.84.17.0/24\n* 216.59.140.0/24\n* 8.28.3.0/24\n* 8.28.0.0/24\n* 63.209.12.0/24\n* 8.28.2.0/24\n* 216.59.142.0/24\n* 216.59.141.0/24\n* 8.28.1.0"},{"asset":"ASN: AS395362","type":"OTHER","bounty":false,"severity":"critical","instruction":"**8X8-AS-1, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 8.25.218.0/24\n* 38.99.96.0/24"},{"asset":"ASN: AS398067","type":"OTHER","bounty":false,"severity":"critical","instruction":"**8X8-AS-SJC01, US**\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS44965","type":"OTHER","bounty":false,"severity":"critical","instruction":"**CONTACTUAL, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 109.70.61.0/24\n* 217.163.57.0/24\n* 66.81.220.0/24"},{"asset":"ASN: AS46680","type":"OTHER","bounty":false,"severity":"critical","instruction":"**CONTACTUAL, US**\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS49856","type":"OTHER","bounty":false,"severity":"critical","instruction":"**EIGHT-AS, GB**\n▶︎ RDP: If You See Something, Say Something"},{"asset":"ASN: AS62306","type":"OTHER","bounty":false,"severity":"critical","instruction":"**RO-8X8-AS, RO**\n▶︎ RDP: If You See Something, Say Something\n\n* 185.221.220.0/24"},{"asset":"ASN: AS62876","type":"OTHER","bounty":false,"severity":"critical","instruction":"**8X8-AS-CORP, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 209.94.72.0/24"},{"asset":"Cloud Misconfigurations","type":"OTHER","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something\n\nAny Cloud asset & configuration owned by 8x8 is in-scope, across various Cloud providers."},{"asset":"Discovered Leaked Credentials","type":"OTHER","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n🚨 Testing of customer/consumer credentials is strictly prohibited\n⚠️ Researchers should submit the leaked credentials to us  and must NOT test their validit"},{"asset":"Intellectual Property on Public Domains","type":"OTHER","bounty":true,"severity":"critical","instruction":"Leaks identified in public domains are in scope, provided they contain sensitive or proprietary information that could impact our organization’s confidentiality, integrity, or availability."},{"asset":"Third Party Application","type":"OTHER","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n⚠️ Evaluation on case-by-case basis"},{"asset":"Virtual Office Desktop","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"critical","instruction":"Download 8x8 Work for Desktop: https://support-portal.8x8.com/helpcenter/viewArticle.html?d=8bff4970-6fbf-4daf-842d-8ae9b533153d"},{"asset":"admin-resolve.8x8.com","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Resolve, a mobile-first critical communications and incident management solution purpose-built to reach deskless and distributed workers."},{"asset":"admin.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":"Administration portal for managing your 8x8 service including users and telephony features"},{"asset":"analytics-*.8x8.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Analytics for Contact Center\n⚠️ shareable Wallboard links are out of scope"},{"asset":"api.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"apps.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":"8x8 Application Panel"},{"asset":"bridge.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Community Feature Hub\n\nProduction: bridge.8x8.com\nStaging: bridge.8x8staging.com"},{"asset":"callroute.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"callroute.io","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"cloud8.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"community.8x8.com","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\nPowered by [Higher Logic](https://support.higherlogic.com/hc/en-us/articles/12907719279380-Security-related-Support)."},{"asset":"connect.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"⚠️ **Temporary Scope Exclusion**: campaign.wavecell.com, contacts.8x8.com (and equivalents in other regions)\n---\n⚠️ out of scope: IDORs in form of unguessable/non-enumerable identifier (UUID)\n⚠️ out o"},{"asset":"converse.8x8.com","type":"URL","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Converse. Simplify your customer service stream by unifying every messaging app conversation into a single interface."},{"asset":"dashboard.qa.ai.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"Analytics for 8x8 Work"},{"asset":"debug.8x8.com","type":"URL","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"developer.8x8.com","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\nPowered by GitHub Pages."},{"asset":"eg.ht","type":"URL","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 URL Shortener"},{"asset":"fuze.me","type":"URL","bounty":false,"severity":"low","instruction":"The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"},{"asset":"http://*.packet8.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.chalet.8x8.com/ws/v1","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"8x8 Chat provides comprehensive team messaging capabilities including 1:1 instant messaging, public and private chat rooms, file sharing, and seamless integration with voice and video calling - all de"},{"asset":"https://8x8.vc/xmpp-websocket","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"https://github.com/jitsi","type":"SOURCE_CODE","bounty":false,"severity":"low","instruction":"Open source repositories that support [Jitsi](https://github.com/jitsi/).\nJitsi Meet offers free, secure and open-source video conferencing.\n⚠️ Good faith review of source that a reporter must have no"},{"asset":"https://webrtc.8x8.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@8x8/pui-partner-comm","type":"OTHER","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 platform-ui package for partner integration"},{"asset":"maestro.8x8.cloud","type":"URL","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something\n\nA CTI (Computer Telephony Integration) bridge via the Maestro SDK."},{"asset":"map.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something\n\n(CPaaS) Admin Back Office Application.\n\nStaging: map.8x8staging.com\nDevelopment: map.8x8pilot.com"},{"asset":"mcp.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8's MCP Catalog"},{"asset":"org.vom8x8.sipua","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":"8x8 Work - https://play.google.com/store/apps/details?id=org.vom8x8.sipua"},{"asset":"pay.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"platform.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"platform.8x8pilot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pubtools.private.8x8cloud.net","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\nGlobal Technical Support Enablement"},{"asset":"qm-*.8x8.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Quality Management & Speech Analytics"},{"asset":"resolve.8x8.com","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Resolve, a mobile-first critical communications and incident management solution purpose-built to reach deskless and distributed workers."},{"asset":"sipsynergy.co.uk","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"sso.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":"8x8 Single Sign-On (SSO) is a session and user authentication service that permits a user to use one set of login credentials, such as name and password, to access multiple 8x8 applications.\n⚠️ MFA-by"},{"asset":"sso.8x8pilot.com","type":"URL","bounty":true,"severity":"critical","instruction":"8x8 Single Sign-On (SSO) is a session and user authentication service that permits a user to use one set of login credentials, such as name and password, to access multiple 8x8 applications.\n⚠️ MFA-by"},{"asset":"support-portal.8x8.com","type":"URL","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something"},{"asset":"uc.8x8pilot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"unreal-agents.8x8pilot.com","type":"URL","bounty":false,"severity":"medium","instruction":"▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents (Staging Environment)\n(*incl. `unreal-agents-tools.8x8pilot.com` & `unreal-agents-sys.8x8pilot.com`*)"},{"asset":"user-profile-staging.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"user-profile.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vap.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"(CPaaS) Admin Back Office Application for managing voice services.\n▶︎ RDP: If You See Something, Say Something"},{"asset":"vcc-*.8x8.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"► Contact Center Agent Workspace:\n`./AGUI/login.php`\n► Configuration Manager:\n`./CM/login.php`\n\n⚠️ Latest version of software usually available on https://vcc-na30.8x8.com/\n⚠️ shareable Wallboard link"},{"asset":"vcc-ce.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"Customer Experience and Post-Call Survey Analytics\nfront-end, e.g.: https://vcc-ce.8x8.com/analytix/rt-dashboard.htm"},{"asset":"video-agent.8x8.com","type":"URL","bounty":false,"severity":"high","instruction":"▶︎ RDP: If You See Something, Say Something\n\n8x8 Video Interaction revolutionizes customer engagement by enabling one-to-one video calls with our easy-to-use solution. Launch live video chats instantl"},{"asset":"voapi.8x8.com","type":"URL","bounty":false,"severity":"critical","instruction":"VOAPI is a backend application responsible to process phone calls (like InboundCall, OutboundCall, Click2Dial, CallTransfer, CallMerge, Start/Stop CallRecording).\n\n▶︎ AU Region: voapi-au.8x8.com\n▶︎ UK"},{"asset":"work-staging.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"work.8x8.com","type":"URL","bounty":true,"severity":"critical","instruction":"8x8 Work for Web, the browser-based counterpart of 8x8 Work for Desktop, enables you to collaborate efficiently with your colleagues and business contacts.\n\n⚠️ 8x8 does not provide test credentials."},{"asset":"www.fuzemeeting.com","type":"URL","bounty":false,"severity":"low","instruction":"The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 3d ago"},"slop":{"risk":0.053,"label":"none","experimental":true}},"derived":{"novelty":0.2156,"inverse_crowd":0.4956,"payout_reliability":0.9933,"value_per_competition":0.3116,"triage_quality":1.0,"scope_breadth":0.8362,"crowding_per_asset_month":1.0148,"slop_risk":0.053},"score":{"total":59.3,"parts":{"novelty":0.216,"inverse_crowd":0.496,"payout_reliability":0.993,"value_per_competition":0.312,"triage_quality":1.0,"scope_breadth":0.836},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":93.2},"reasons":[{"sign":"good","text":"paid $19k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"548 reports in 90 days across 180 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.8 years"}]},{"id":"hackerone:khealth","platform":"hackerone","slug":"khealth","name":"KHealth","url":"https://hackerone.com/khealth","meta":{"reward_min":100,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-09-10T09:31:28.608Z","age_months":25.308832363991556,"reports_90d":108,"resolved_total":109,"response_efficiency":82,"response_indicator":"ok","paid_total":100000,"paid_90d":35000,"last_resolved_at":"2026-10-15T19:29:39.939Z","days_since_resolved":4.922176155381945,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":100,"scope_count":59},"scope":[{"asset":"*.csconnect.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hhc247.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hmh247.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.khealth-test.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Vulnerabilities found against assets in the environment will receive a lower payout."},{"asset":"*.mgbcareconnect.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.northwellprimarycarenow.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.novanthealthvirtualprimarycare.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.pennmedicine.connect-visit.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.primarycareondemand.mayoclinic.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"6741442288","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"HHC 24/7 iOS app ([App Store link](https://apps.apple.com/us/app/hhc-24-7/id6741442288))."},{"asset":"https://*.khealth.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All assets within this scope item containing the strings \"dev\" and / or \"staging\" are excluded from the scope."},{"asset":"https://apps.apple.com/us/app/hhc-24-7/id6741442288","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"org.hartfordhealthcare.hhc247","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"HHC 24/7 Android app ([Play Store link](https://play.google.com/store/apps/details?id=org.hartfordhealthcare.hhc247))."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"82% response, paid recently, resolved 5d ago"},"slop":{"risk":0.062,"label":"none","experimental":true}},"derived":{"novelty":0.2704,"inverse_crowd":0.644,"payout_reliability":0.8994,"value_per_competition":0.3326,"triage_quality":0.82,"scope_breadth":0.6586,"crowding_per_asset_month":0.6102,"slop_risk":0.062},"score":{"total":58.9,"parts":{"novelty":0.27,"inverse_crowd":0.644,"payout_reliability":0.899,"value_per_competition":0.333,"triage_quality":0.82,"scope_breadth":0.659},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":92.8},"reasons":[{"sign":"good","text":"paid $35k in the last 90 days"},{"sign":"good","text":"82% response efficiency"},{"sign":"neutral","text":"108 reports in 90 days across 59 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.1 years"}]},{"id":"hackerone:enjin","platform":"hackerone","slug":"enjin","name":"Enjin","url":"https://hackerone.com/enjin","meta":{"reward_min":60,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-10-05T13:35:57.778Z","age_months":72.4818990724865,"reports_90d":82,"resolved_total":99,"response_efficiency":100,"response_indicator":"ok","paid_total":30753,"paid_90d":3610,"last_resolved_at":"2026-10-05T08:56:14.462Z","days_since_resolved":15.362054361400464,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":60,"scope_count":39},"scope":[{"asset":"*.enjinusercontent.com","type":"WILDCARD","bounty":false,"severity":"low","instruction":"This asset is out-of-scope as a third-party service is responsible for the running and maintenance of this website."},{"asset":"Enjin Blockchain","type":"OTHER","bounty":true,"severity":"critical","instruction":"The Enjin Blockchain refers to either the Enjin Relaychain or the Enjin Matrixchain. It does not refer to other (community-operated) Matrixchains.\n\nIssues originating from Substrate are notifiable but"},{"asset":"com.enjin.mobile.wallet","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/enjin-cryptocurrency-wallet/id1349078375\n\n**Background**\nThe Enjin Wallet is a secure, feature-packed, and convenient blockchain asset wallet built for traders, gamers, a"},{"asset":"com.enjin.mobile.wallet","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.enjin.mobile.wallet\n\n**Background**\nThe Enjin Wallet is a secure, feature-packed, and convenient blockchain asset wallet built for traders, gamers, an"},{"asset":"nft.io","type":"URL","bounty":true,"severity":"critical","instruction":"You can also test, for free, on [canary.nft.io](https://canary.nft.io)."},{"asset":"platform.enjin.io","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 15d ago"},"slop":{"risk":0.058,"label":"none","experimental":true}},"derived":{"novelty":0.1793,"inverse_crowd":0.605,"payout_reliability":0.9686,"value_per_competition":0.3148,"triage_quality":1.0,"scope_breadth":0.5934,"crowding_per_asset_month":0.7009,"slop_risk":0.058},"score":{"total":58.8,"parts":{"novelty":0.179,"inverse_crowd":0.605,"payout_reliability":0.969,"value_per_competition":0.315,"triage_quality":1.0,"scope_breadth":0.593},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":92.3},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"82 reports in 90 days across 39 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:23andme_bbp","platform":"hackerone","slug":"23andme_bbp","name":"23andMe Bug Bounty","url":"https://hackerone.com/23andme_bbp","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-12-12T17:11:16.082Z","age_months":34.267541211052176,"reports_90d":64,"resolved_total":77,"response_efficiency":92,"response_indicator":"ok","paid_total":21911,"paid_90d":1053,"last_resolved_at":"2026-10-07T18:38:08.720Z","days_since_resolved":12.957954153067128,"avg_bounty_low":150,"avg_bounty_high":250,"min_bounty":50,"scope_count":30},"scope":[{"asset":"23andme.org/ancestry/last-names","type":"URL","bounty":true,"severity":"critical","instruction":"Surname discovery domain that allows customers to browse different surname information."},{"asset":"23andme.org/blog","type":"URL","bounty":true,"severity":"critical","instruction":"Official blog of 23andMe, sharing insightful articles, updates, and stories on genetics, health, and personal genomics."},{"asset":"23andme.org/clinicians","type":"URL","bounty":true,"severity":"critical","instruction":"Medical and therapeutics site containing information about 23andMe's medical research."},{"asset":"23andme.org/education","type":"URL","bounty":true,"severity":"critical","instruction":"23andMe's dedicated education site, offering resources and insights to enhance genetic literacy through informative content and educational materials"},{"asset":"23andme.org/media-center","type":"URL","bounty":true,"severity":"critical","instruction":"Media center for 23andMe, providing press releases, media assets, and comprehensive information for journalists and media professionals"},{"asset":"23andme.org/research","type":"URL","bounty":true,"severity":"medium","instruction":"research.23andMe.com is the official research domain of 23andMe"},{"asset":"23andmeresearchinstitute.org","type":"URL","bounty":true,"severity":"critical","instruction":"Public-facing website for the 23andMe Research Institute. Provides information about ongoing genetic research initiatives, published studies, member contribution programs, and partnership opportunitie"},{"asset":"api.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"First API from original codebase, responsible for less services at the moment but still integrated into the product."},{"asset":"auth.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Responsible for all authenticated services throughout the product."},{"asset":"fulfillment.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"23andMe Fulfillment API"},{"asset":"merch.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"E-commerce storefront for 23andMe merchandise."},{"asset":"portal.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Clinical trials site portal for 23andMe collaborator-sponsored studies."},{"asset":"refer.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Customer referral program portal for 23andMe. Handles referral link generation, tracking, and reward redemption for existing customers referring new kit purchases."},{"asset":"store.23andme.org","type":"URL","bounty":true,"severity":"critical","instruction":"Online store for 23andMe products, offering DNA testing kits, genetic insights, and personalized merchandise."},{"asset":"style.23andme.org","type":"URL","bounty":true,"severity":"critical","instruction":"This is a documentation site for the 23andMe design system. Its purpose is to organize, streamline, and document the usage of re-usable components within the 23andMe eco-system."},{"asset":"trust.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Smart Trust Center to learn about our security posture and request access to our security documentation."},{"asset":"www.23andme.org","type":"URL","bounty":true,"severity":"critical","instruction":"The primary public-facing gateway and core application entry point."},{"asset":"you.23andme.com","type":"URL","bounty":true,"severity":"critical","instruction":"you.23andme.com is our main consumer site which contains users DNA kit results, dna relatives, and more. Users can interact with relatives and perform profile related features such as downloading data"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"92% response, paid recently, resolved 13d ago"},"slop":{"risk":0.059,"label":"none","experimental":true}},"derived":{"novelty":0.2405,"inverse_crowd":0.6009,"payout_reliability":0.9332,"value_per_competition":0.3261,"triage_quality":0.92,"scope_breadth":0.5524,"crowding_per_asset_month":0.7111,"slop_risk":0.059},"score":{"total":58.2,"parts":{"novelty":0.24,"inverse_crowd":0.601,"payout_reliability":0.933,"value_per_competition":0.326,"triage_quality":0.92,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":91.9},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"good","text":"92% response efficiency"},{"sign":"neutral","text":"64 reports in 90 days across 30 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.9 years"}]},{"id":"hackerone:creditkarma","platform":"hackerone","slug":"creditkarma","name":"Credit Karma","url":"https://hackerone.com/creditkarma","meta":{"reward_min":100,"reward_max":700,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-03-14T23:24:51.920Z","age_months":91.2282166091813,"reports_90d":45,"resolved_total":138,"response_efficiency":91,"response_indicator":"ok","paid_total":111550,"paid_90d":1500,"last_resolved_at":"2026-06-12T16:16:29.878Z","days_since_resolved":130.05632037991896,"avg_bounty_low":250,"avg_bounty_high":700,"min_bounty":100,"scope_count":32},"scope":[{"asset":"accounts.creditkarma.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.creditkarma.com","type":"URL","bounty":true,"severity":"critical","instruction":"Our Native apps make use of our API to talk to our servers."},{"asset":"blog.creditkarma.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.creditkarma.mobile","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.creditkarma.mobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.creditkarma.mobile.international","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.creditkarma.mobile.international","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"http://*.creditkarma.co.uk","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.creditkarma.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.creditkarma.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.creditkarma.com/reviews/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.creditkarma.com/savings","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"support.creditkarma.ca","type":"URL","bounty":true,"severity":"critical","instruction":"SalesForce owned Endpoint. Manual review only - No Automated Scans.\n•\tNo automated scanning on this endpoint.\n•\tOvernight hours only (10PM - 2AM PT)\n•\tPlease note during any cases and/or chat session "},{"asset":"www.creditkarma.ca","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"91% response, pays, last resolved 130d ago"},"slop":{"risk":0.03,"label":"none","experimental":true}},"derived":{"novelty":0.1637,"inverse_crowd":0.7128,"payout_reliability":0.8021,"value_per_competition":0.4505,"triage_quality":0.91,"scope_breadth":0.5624,"crowding_per_asset_month":0.4688,"slop_risk":0.03},"score":{"total":58.1,"parts":{"novelty":0.164,"inverse_crowd":0.713,"payout_reliability":0.802,"value_per_competition":0.45,"triage_quality":0.91,"scope_breadth":0.562},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":91.4},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"45 reports in 90 days across 32 assets"},{"sign":"neutral","text":"running 7.6 years"}]},{"id":"hackerone:fetlife","platform":"hackerone","slug":"fetlife","name":"FetLife","url":"https://hackerone.com/fetlife","meta":{"reward_min":100,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-01-07T14:45:13.202Z","age_months":69.39202325531409,"reports_90d":20,"resolved_total":294,"response_efficiency":91,"response_indicator":"ok","paid_total":64852,"paid_90d":200,"last_resolved_at":"2026-09-29T09:17:08.652Z","days_since_resolved":21.3475382734375,"avg_bounty_low":100,"avg_bounty_high":100,"min_bounty":100,"scope_count":14},"scope":[{"asset":"*.fetlife.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"fetlife.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fetlifemail.com","type":"URL","bounty":true,"severity":"critical","instruction":"In particular, the notification emails from this domain and the links in them are in scope"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 21d ago"},"slop":{"risk":0.02,"label":"none","experimental":true}},"derived":{"novelty":0.1824,"inverse_crowd":0.709,"payout_reliability":0.9128,"value_per_competition":0.3157,"triage_quality":0.91,"scope_breadth":0.4356,"crowding_per_asset_month":0.4762,"slop_risk":0.02},"score":{"total":57.8,"parts":{"novelty":0.182,"inverse_crowd":0.709,"payout_reliability":0.913,"value_per_competition":0.316,"triage_quality":0.91,"scope_breadth":0.436},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":91.0},"reasons":[{"sign":"good","text":"paid $200 in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"20 reports in 90 days across 14 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.8 years"}]},{"id":"hackerone:polygon-technology","platform":"hackerone","slug":"polygon-technology","name":"Polygon Technology","url":"https://hackerone.com/polygon-technology","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-06-01T02:08:06.381Z","age_months":76.63722320245837,"reports_90d":93,"resolved_total":108,"response_efficiency":94,"response_indicator":"ok","paid_total":89858,"paid_90d":11250,"last_resolved_at":"2026-10-15T09:39:31.944Z","days_since_resolved":5.331990912326389,"avg_bounty_low":300,"avg_bounty_high":300,"min_bounty":50,"scope_count":41},"scope":[{"asset":"api-gateway.polygon.technology","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api-polygon-tokens.polygon.technology/","type":"API","bounty":true,"severity":"high","instruction":null},{"asset":"faucet-api.polygon.technology/","type":"API","bounty":true,"severity":"high","instruction":null},{"asset":"faucet.polygon.technology","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gasstation.polygon.technology/","type":"API","bounty":true,"severity":"high","instruction":null},{"asset":"portal.polygon.technology","type":"URL","bounty":true,"severity":"critical","instruction":"Here are just some of things you will be able to to do with Polygon Portal: \n\nBridge your assets via Socket bridge and a range of third-party bridges; \nManage your assets and token lists; \nUse the Ref"},{"asset":"staking-api.polygon.technology","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"staking.polygon.technology","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"94% response, paid recently, resolved 5d ago"},"slop":{"risk":0.062,"label":"none","experimental":true}},"derived":{"novelty":0.1754,"inverse_crowd":0.5831,"payout_reliability":0.9585,"value_per_competition":0.3282,"triage_quality":0.94,"scope_breadth":0.6012,"crowding_per_asset_month":0.7561,"slop_risk":0.062},"score":{"total":57.6,"parts":{"novelty":0.175,"inverse_crowd":0.583,"payout_reliability":0.958,"value_per_competition":0.328,"triage_quality":0.94,"scope_breadth":0.601},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":90.5},"reasons":[{"sign":"good","text":"paid $11k in the last 90 days"},{"sign":"good","text":"94% response efficiency"},{"sign":"neutral","text":"93 reports in 90 days across 41 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.4 years"}]},{"id":"hackerone:vimeo","platform":"hackerone","slug":"vimeo","name":"Vimeo","url":"https://hackerone.com/vimeo","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-01-05T15:25:10.402Z","age_months":141.47324722671877,"reports_90d":311,"resolved_total":1714,"response_efficiency":98,"response_indicator":"ok","paid_total":1120000,"paid_90d":20000,"last_resolved_at":"2026-10-15T04:22:45.116Z","days_since_resolved":5.551977347511574,"avg_bounty_low":350,"avg_bounty_high":500,"min_bounty":100,"scope_count":113},"scope":[{"asset":"*.cloud.vimeo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Upload endpoints such as \\ *.cloud.vimeo.com"},{"asset":"*.magisto.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**EXCEPTION** - Subdomains owned/controlled/managed/etc by a 3rd party."},{"asset":"*.vhx.tv","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**EXCEPT for community.vhx.tv, 3rd party sites and EXCEPT a single-customer configured site**\n\nThe vulnerability must affect every site in order to be valid."},{"asset":"*.vimeo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"See scope/program for more definitive information. Does not include 3rd parties under vimeo.com domain names. Subject to realization we missed one."},{"asset":"1491791513","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"425194759","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"486781045","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"493086499","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"VHX Branded Customer Android Apps","type":"OTHER","bounty":true,"severity":"critical","instruction":"**Vulnerabilities must affect ANY/ALL VHX branded Android apps and not just a single VHX customer app**"},{"asset":"VHX Branded Customer Roku Apps","type":"OTHER","bounty":true,"severity":"critical","instruction":"**Vulnerabilities must affect ANY/ALL VHX branded Roku apps and not just a single VHX customer app**"},{"asset":"VHX Branded Customer iOS Apps","type":"OTHER","bounty":true,"severity":"critical","instruction":"**Vulnerabilities must affect ANY/ALL VHX branded iOS apps and not just a single VHX customer app**"},{"asset":"api.vhx.tv","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.vimeo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"applause1.magisto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"channelstore.roku.com/details/48061/vhx","type":"OTHER","bounty":true,"severity":"critical","instruction":"Roku App"},{"asset":"checkout.vimeo.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is an S3 bucket behind a CDN. We will be responsible for things WE can control about this (Content, S3 permissions, CDN headers, etc). For items beyond our control, those are not in scope."},{"asset":"com.magisto","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.vimeo.android.videoapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.vimeocreate.videoeditor.moviemaker","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"embed.vhx.tv","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://vimeo.com/api","type":"URL","bounty":true,"severity":"critical","instruction":"Legacy API endpoints such as vimeo.com/api"},{"asset":"http://vimeo.com/create","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://vimeo.com/ondemand","type":"URL","bounty":true,"severity":"critical","instruction":"Vimeo On Demand hosted sites: https://vimeo.com/ondemand"},{"asset":"magisto.com,www.magisto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"player.vimeo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"staging.magisto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vhx.tv","type":"URL","bounty":true,"severity":"critical","instruction":"The VHX homepage at vhx.tv redirects to a login page at ott.vimeo.com. Please submit these reports to the VHX program."},{"asset":"vimeo.magisto.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only as it integrates with Vimeo. For anything about it itself, please report on the Magisto program"},{"asset":"vimeopro.com","type":"URL","bounty":true,"severity":"critical","instruction":"Vimeo Pro portfolios hosted on vimeopro.com"},{"asset":"www.vimeo.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 6d ago"},"slop":{"risk":0.04,"label":"none","experimental":true}},"derived":{"novelty":0.1376,"inverse_crowd":0.5258,"payout_reliability":0.978,"value_per_competition":0.3274,"triage_quality":0.98,"scope_breadth":0.7619,"crowding_per_asset_month":0.9174,"slop_risk":0.04},"score":{"total":57.5,"parts":{"novelty":0.138,"inverse_crowd":0.526,"payout_reliability":0.978,"value_per_competition":0.327,"triage_quality":0.98,"scope_breadth":0.762},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":90.0},"reasons":[{"sign":"good","text":"paid $20k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"311 reports in 90 days across 113 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.8 years"}]},{"id":"hackerone:wealthsimple","platform":"hackerone","slug":"wealthsimple","name":"Wealthsimple","url":"https://hackerone.com/wealthsimple","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-05-17T14:36:53.206Z","age_months":53.129379706755266,"reports_90d":119,"resolved_total":263,"response_efficiency":79,"response_indicator":"ok","paid_total":380000,"paid_90d":60000,"last_resolved_at":"2026-10-13T23:06:59.759Z","days_since_resolved":6.771252312789352,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":64},"scope":[{"asset":"*.simpletax.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Please avoid testing tax products during peak tax filing season from **beginning of February to end of April**"},{"asset":"*.wealthsimple.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Please avoid testing tax products during peak tax filing season from **beginning of February to end of April**"},{"asset":"com.wealthsimple","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wealthsimple.predict","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Wealthsimple Predict is a separate app. If you are an existing Wealthsimple client, you can use the same credentials to log in. Please abide by all account identification and network request limits."},{"asset":"com.wealthsimple.predict","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Wealthsimple Predict is a separate app. If you are an existing Wealthsimple client, you can use the same credentials to log in. Please abide by all account identification and network request limits."},{"asset":"com.wealthsimple.wealthsimple","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"79% response, pays"},"slop":{"risk":0.04,"label":"none","experimental":true}},"derived":{"novelty":0.2026,"inverse_crowd":0.6397,"payout_reliability":0.8805,"value_per_competition":0.3875,"triage_quality":0.79,"scope_breadth":0.6715,"crowding_per_asset_month":0.6198,"slop_risk":0.04},"score":{"total":57.5,"parts":{"novelty":0.203,"inverse_crowd":0.64,"payout_reliability":0.881,"value_per_competition":0.388,"triage_quality":0.79,"scope_breadth":0.671},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":89.6},"reasons":[{"sign":"good","text":"paid $60k in the last 90 days"},{"sign":"neutral","text":"119 reports in 90 days across 64 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.4 years"}]},{"id":"hackerone:dyson","platform":"hackerone","slug":"dyson","name":"Dyson","url":"https://hackerone.com/dyson","meta":{"reward_min":100,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-07-02T04:51:11.424Z","age_months":15.623235430384439,"reports_90d":268,"resolved_total":863,"response_efficiency":null,"response_indicator":null,"paid_total":477560,"paid_90d":31750,"last_resolved_at":"2026-09-07T13:37:14.175Z","days_since_resolved":43.16691879427083,"avg_bounty_low":200,"avg_bounty_high":400,"min_bounty":100,"scope_count":220},"scope":[{"asset":"*.cp.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":"This namespace is used to publish API's relating to the registration and control of Dyson connected products."},{"asset":"993135524","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"(Dyson Link App - https://itunes.apple.com/gb/app/dyson-link/id993135524)"},{"asset":"Dyson Connected Products (IoT Hardware)","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Github findings","type":"OTHER","bounty":true,"severity":"high","instruction":"Any issues found on Github that could pose a risk for Dyson such as leaked credentials.\nThese reports will be evaluated on a case-by-case basis"},{"asset":"Other Dyson Assets","type":"OTHER","bounty":true,"severity":"high","instruction":"We welcome reports for all other assets that are owned or managed by Dyson. If you are unsure if something you have found is a Dyson asset, then please contact us first for clarification."},{"asset":"api.dyson.at","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.be","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.ch","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.de","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.dk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.es","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.fr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.ie","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.it","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.nl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.no","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.pt","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dyson.se","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.dysoncanada.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.fi.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.dyson.mobile.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"(Dyson Link App - https://play.google.com/store/apps/details?id=com.dyson.mobile.android)"},{"asset":"shop.dyson.co.za","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"shop.dyson.tw","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.ae","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.at","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.be","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.ch","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.cn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.il","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.kr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.nz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.th","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.au","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.ee","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.ro","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.sg","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.tr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.com.ua","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.cz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.de","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.dk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.es","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.fr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.hk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.hu","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.ie","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.in","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.it","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.my","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.nl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.no","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.pl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.pt","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.se","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.tw","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dyson.vn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dysoncanada.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.fi.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.gr.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.sa.dyson.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"medium","signals_present":8,"signals_expected":10,"missing":["response_efficiency","response_indicator"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"pays, last resolved 43d ago"},"slop":{"risk":0.027,"label":"none","experimental":true}},"derived":{"novelty":0.3249,"inverse_crowd":0.7468,"payout_reliability":0.6738,"value_per_competition":0.4304,"triage_quality":0.5,"scope_breadth":0.8683,"crowding_per_asset_month":0.4061,"slop_risk":0.027},"score":{"total":56.9,"parts":{"novelty":0.325,"inverse_crowd":0.747,"payout_reliability":0.674,"value_per_competition":0.43,"triage_quality":0.5,"scope_breadth":0.868},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":89.1},"reasons":[{"sign":"good","text":"paid $32k in the last 90 days"},{"sign":"neutral","text":"268 reports in 90 days across 220 assets"},{"sign":"neutral","text":"running 1.3 years"}]},{"id":"hackerone:grindr","platform":"hackerone","slug":"grindr","name":"Grindr","url":"https://hackerone.com/grindr","meta":{"reward_min":50,"reward_max":350,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-02-23T15:12:35.421Z","age_months":43.8636780507358,"reports_90d":73,"resolved_total":128,"response_efficiency":86,"response_indicator":"ok","paid_total":67113,"paid_90d":17094,"last_resolved_at":"2026-10-07T21:12:25.879Z","days_since_resolved":12.850811109085647,"avg_bounty_low":250,"avg_bounty_high":350,"min_bounty":50,"scope_count":34},"scope":[{"asset":"*.dev.grindr.io","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"Assets under *.dev.grindr.io are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments."},{"asset":"*.dev2.grindr.io","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"Assets under *.dev2.grindr.io are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments."},{"asset":"*.grindr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This domain includes the following subdomains:\n* Website (grindr.com).  Note the Grindr website does not provide services found in the mobile application or any sort of user login.\n* Chat server (chat"},{"asset":"*.grindr.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This domain is used for development purposes."},{"asset":"*.grindr.mobi","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This domain is used for backend API's."},{"asset":"319881193","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Vulnerabilities that require physical, jailbroken, or device root OS access of another user's device will typically be considered out-of-scope."},{"asset":"com.grindrapp.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Vulnerabilities that require physical, jailbroken, or device root OS access of another user's device will typically be considered out-of-scope."},{"asset":"preprod1.grindr.com","type":"URL","bounty":false,"severity":"medium","instruction":"Assets under *.preprod1.grindr.com are development and test systems; feel free to evaluate them, but severity levels will be reduced because we do not host customer data in these environments."},{"asset":"web.grindr.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the Web version of the Grindr app. Only paid subscriptions have access to Grindr Web."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 13d ago"},"slop":{"risk":0.049,"label":"none","experimental":true}},"derived":{"novelty":0.2184,"inverse_crowd":0.599,"payout_reliability":0.9034,"value_per_competition":0.3449,"triage_quality":0.86,"scope_breadth":0.5719,"crowding_per_asset_month":0.7157,"slop_risk":0.049},"score":{"total":56.8,"parts":{"novelty":0.218,"inverse_crowd":0.599,"payout_reliability":0.903,"value_per_competition":0.345,"triage_quality":0.86,"scope_breadth":0.572},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":88.7},"reasons":[{"sign":"good","text":"paid $17k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"73 reports in 90 days across 34 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.7 years"}]},{"id":"hackerone:superbet","platform":"hackerone","slug":"superbet","name":"Superbet","url":"https://hackerone.com/superbet","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-12-22T08:58:48.830Z","age_months":45.94202111522739,"reports_90d":131,"resolved_total":153,"response_efficiency":91,"response_indicator":"ok","paid_total":220000,"paid_90d":30000,"last_resolved_at":"2026-10-07T08:02:05.499Z","days_since_resolved":13.39965809982639,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":100,"scope_count":50},"scope":[{"asset":"*.happening.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.luckydays.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com."},{"asset":"*.luckydays.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com."},{"asset":"*.napoleoncasino.be","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution"},{"asset":"*.napoleondice.be","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution"},{"asset":"*.napoleongames.be","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution"},{"asset":"*.napoleonsports.be","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution"},{"asset":"*.spinaway.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com."},{"asset":"*.super.xyz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.superbet.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.superbet.gr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Websites only available from Greece use VPN\nTest Accounts: \n26hackeronegreece01 - qPW2R%jnniYn4hrP\n 26hackeronegreece02 - jjqAW@l34KsXbXJJ \n26hackeronegreece03 - 8tjK%tv&Pp%pUbcM \n26hackeronegreece04 "},{"asset":"*.superbet.pl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Website available only from Poland use VPN\n Test Accounts: \n26hackeronepoland02 - ZIzUxh@D1FWrb@yF \n26hackeronepoland03 - 6J@K%IU9fVbMhCe9 \n26hackeronepoland04 - a%TlmhYhTxaMA%@8 \n26hackeronepoland05 "},{"asset":"*.superbet.ro","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using"},{"asset":"*.superbet.rs","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This is our new betting platform, available only in serbia. We only allow connection from Serbian Ip's, so please use a VPN.\nTest Accounts:\n26hackeroneserbia06 - YAJ6chCI9ra3fX%s\n26hackeroneserbia07 -"},{"asset":"WGP Slot Games","type":"OTHER","bounty":true,"severity":"critical","instruction":"All games from WGP provider are in scope for testing. \nYou can find them by filtering for WGP provider on Napoleon platform. Make sure you use VPN for BE.\nhttps://napoleoncasino.be/en-be/games/search?"},{"asset":"https://napoleoncasino.be","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Belgium\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-gene"},{"asset":"https://napoleoncasino.be/en-be/game/hogamba-crash?demo=false","type":"URL","bounty":true,"severity":"critical","instruction":"slot game available on be/ro platforms and on BR in the future."},{"asset":"https://napoleoncasino.be/nl-be/game/plinko-napoleon?demo=false","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://napoleondice.be","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Belgium.\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-gen"},{"asset":"https://napoleongames.be","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Belgium\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-gene"},{"asset":"https://napoleonsports.be","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Belgium. You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-gen"},{"asset":"https://super.xyz","type":"URL","bounty":true,"severity":"low","instruction":"low impact asset (3rd party managed service) with no sensitive data/functionality on it."},{"asset":"https://superbet.pl","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Poland use VPN\nTest Accounts:\n26hackeronepoland02 - ZIzUxh@D1FWrb@yF\n26hackeronepoland03 - 6J@K%IU9fVbMhCe9\n26hackeronepoland04 - a%TlmhYhTxaMA%@8\n26hackeronepoland05 - hCR"},{"asset":"https://superbet.ro","type":"URL","bounty":true,"severity":"critical","instruction":"For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using"},{"asset":"https://superbet.rs","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only from Serbia use VPN\nTest Account:\n26hackeroneserbia06 - YAJ6chCI9ra3fX%s\n26hackeroneserbia07 - 3hoPBI2sQRuIxDJ#\n26hackeroneserbia08 - Wqs!C7b8LLURfgbH\n26hackeroneserbia09 - @p0f"},{"asset":"ro.superbet.games","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Make sure you change your google play country to Romania so you can access the app.\nhttps://play.google.com/store/apps/details?id=ro.superbet.games&hl=ro&gl=RO"},{"asset":"ro.superbet.sport","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Make sure you set the location to your google play account to Romania so you can access the app\nhttps://play.google.com/store/apps/details?id=ro.superbet.sport&hl=ro&gl=RO"},{"asset":"superbet.bet.br","type":"URL","bounty":true,"severity":"critical","instruction":"Website available only for Brazil use VPN.\nTest Accounts:\n26hackeronebrazil02 - NyX#xTsIz8@8mku0\n26hackeronebrazil03 - LQg@9wyRk#7Xj!wX\n26hackeronebrazil04 - 1p99kdS1PeD&PZaf\n26hackeronebrazil05 - 4lz"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 13d ago"},"slop":{"risk":0.066,"label":"none","experimental":true}},"derived":{"novelty":0.2145,"inverse_crowd":0.5405,"payout_reliability":0.9273,"value_per_competition":0.3351,"triage_quality":0.91,"scope_breadth":0.6325,"crowding_per_asset_month":0.8733,"slop_risk":0.066},"score":{"total":56.8,"parts":{"novelty":0.214,"inverse_crowd":0.541,"payout_reliability":0.927,"value_per_competition":0.335,"triage_quality":0.91,"scope_breadth":0.632},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":88.2},"reasons":[{"sign":"good","text":"paid $30k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"131 reports in 90 days across 50 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.8 years"}]},{"id":"hackerone:coupang_tw","platform":"hackerone","slug":"coupang_tw","name":"Coupang Taiwan","url":"https://hackerone.com/coupang_tw","meta":{"reward_min":50,"reward_max":448,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-05-06T00:01:24.699Z","age_months":5.510750345967375,"reports_90d":256,"resolved_total":23,"response_efficiency":93,"response_indicator":"ok","paid_total":23662,"paid_90d":9079,"last_resolved_at":"2026-10-12T07:25:17.919Z","days_since_resolved":8.425208794270834,"avg_bounty_low":421,"avg_bounty_high":448,"min_bounty":50,"scope_count":48},"scope":[{"asset":"SUPERAPP (AOS)","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.coupang.mobile.lightspeed"},{"asset":"SUPERAPP (IOS)","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/tw/app/coupang/id1567026344"},{"asset":"ads-partners.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cart-front-api.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cart.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cash.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"checkout.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cmapi.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dco.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developers.tw.coupangcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"feed-web.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fileupload-video.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fileupload.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fintech-aml-kyc-tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"go-cms.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"helpcenter-tw.coupangcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"helpseller.tw.coupangcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"influencers.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"link.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ljc-test.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ljc.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"logs-partners.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"loyalty.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"m.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"marketplace.tw.coupangcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mauth.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mc.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"member.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"my.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"myself.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"notification-front-web.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pages.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"partners.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pay.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"payment.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"promo.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"reco.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"review.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rs-open-api.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"shop.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"store-display.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"syndication.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"tw.coupangcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"tw.coupangls.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.tw.coupang.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 8d ago"},"slop":{"risk":0.464,"label":"watch","experimental":true}},"derived":{"novelty":0.4727,"inverse_crowd":0.3339,"payout_reliability":0.9471,"value_per_competition":0.222,"triage_quality":0.93,"scope_breadth":0.626,"crowding_per_asset_month":1.7778,"slop_risk":0.464},"score":{"total":56.7,"parts":{"novelty":0.473,"inverse_crowd":0.334,"payout_reliability":0.947,"value_per_competition":0.222,"triage_quality":0.93,"scope_breadth":0.626},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":87.8},"reasons":[{"sign":"good","text":"paid $9k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"neutral","text":"256 reports in 90 days across 48 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 6 months ago"}]},{"id":"hackerone:playtika","platform":"hackerone","slug":"playtika","name":"Playtika","url":"https://hackerone.com/playtika","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-09-02T14:02:03.272Z","age_months":25.565492694054683,"reports_90d":254,"resolved_total":330,"response_efficiency":91,"response_indicator":"ok","paid_total":194375,"paid_90d":14850,"last_resolved_at":"2026-09-27T08:48:43.903Z","days_since_resolved":23.367269164641204,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":90},"scope":[{"asset":"*.bingoblitz.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.boardkingsgame.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.caesarsgames.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.gop3.nl","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This asset belongs to our Tier 3 category of rewards system."},{"asset":"*.governorofpoker.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This asset belongs to our Tier 3 category of rewards system."},{"asset":"*.houseoffun.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.monopoly-poker.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This App belongs to our Tier 3 category of rewards system."},{"asset":"*.playticorp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Playtika's internal assets"},{"asset":"*.playtika.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Reports on any domain/app not specifically included are excluded from the scope."},{"asset":"*.playwsop.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.redecor.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.serious.li","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.seriously.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.slotomania.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.wooga.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1116488672","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1200391796","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1215220850","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1223338261","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1413287364","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1438744533","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1448884851","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This App belongs to our Tier 3 category of rewards system."},{"asset":"1474700 (Steam app id)","type":"OTHER","bounty":true,"severity":"critical","instruction":"This App belongs to our Tier 3 category of rewards system."},{"asset":"1508620125","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1510325826","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"447553564","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"480523695","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"529996768","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"586634331","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"594802437","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"603097018","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"645949180","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"654671575","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"719525810","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"868013618","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"975035622","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"9nqwjwnqjj5n","type":"WINDOWS_APP_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This App belongs to our Tier 3 category of rewards system."},{"asset":"Tier 1","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 1 Studios","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 2","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"air.com.buffalo_studios.newflashbingo","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"air.com.playtika.cvs","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"air.com.playtika.slotomania","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"bestfiends.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.Seriously.BestFiends","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.Seriously.Phoenix","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.bigblueparrot.pokerfriends","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.jellybtn.boardkings","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.jellybtn.cashkingmobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.pacificinteractive.HouseOfFun","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.playtika.caesarscasino","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.playtika.wsop.gp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wooga.pearlsperil","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.youdagames.monopolypoker","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This App belongs to our Tier 3 category of rewards system."},{"asset":"fi.reworks.redecor","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"gnocchi-www.buffalo-ggn.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.facebook.com/pearls-peril","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.facebook.com/pokerheat","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.facebook.com/vegas_downtown_slots","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"lol.onevone","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"net.supertreat.solitaire","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"net.wooga.junes_journey_hidden_object_mystery_game","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"net.wooga.switchcraft.googleplay","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"net.wooga.tropicats_tropical_cats_puzzle_paradise","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 23d ago"},"slop":{"risk":0.065,"label":"none","experimental":true}},"derived":{"novelty":0.2693,"inverse_crowd":0.5183,"payout_reliability":0.9093,"value_per_competition":0.261,"triage_quality":0.91,"scope_breadth":0.7256,"crowding_per_asset_month":0.9407,"slop_risk":0.065},"score":{"total":56.6,"parts":{"novelty":0.269,"inverse_crowd":0.518,"payout_reliability":0.909,"value_per_competition":0.261,"triage_quality":0.91,"scope_breadth":0.726},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":87.3},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"254 reports in 90 days across 90 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.1 years"}]},{"id":"hackerone:bookingcom","platform":"hackerone","slug":"bookingcom","name":"Booking.com","url":"https://hackerone.com/bookingcom","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-11-15T08:07:27.946Z","age_months":35.167011944948285,"reports_90d":328,"resolved_total":1537,"response_efficiency":94,"response_indicator":"ok","paid_total":780000,"paid_90d":45000,"last_resolved_at":"2026-10-19T06:46:49.032Z","days_since_resolved":1.4519320234375,"avg_bounty_low":450,"avg_bounty_high":500,"min_bounty":100,"scope_count":91},"scope":[{"asset":"*.booking.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"if there's any vulnerabilities raised on this asset that are owned by a third party we will not be accepting those reports"},{"asset":"*.fareharbor.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.fareharbor.engineering","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.rentalcars.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"if there's any vulnerabilities raised on this asset that are owned by a third party we will not be accepting those reports"},{"asset":"accommodations.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"account.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"admin.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":"Incorrect permission check for different roles is out of scope.\n\nWe have recently run an internal pen-test on this asset, and we are working through the vulnerabilities found. There may be duplicates "},{"asset":"autocomplete.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"careers.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cars.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"chat.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"compass.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"demo.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"distribution-xml.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"experiences.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fareharborsites.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fhdn.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"flights.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://secure-iphone-xml.booking.com/json/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/booking-com-hotels-travel/id367003839","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/pulse-for-booking-com-partners/id992795726","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://iphone-xml.booking.com/json/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.booking&hl=en","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.booking.hotelmanager&hl=en","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://secure-iphone-xml.booking.com/json/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"indicative-pricing.taxi.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"kyc-onboarding.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"marketing.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"metasearch-api.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"paybridge.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"paymentcomponent.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"paynotifications.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"phone-validation.taxi.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portal.taxi.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"readonly.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"secure-supply-xml.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"secure.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sites.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"spark.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"supplier.auth.toag.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"supply-xml.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"tableau.fareharbor.engineering","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"taxi.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"taxis.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"teleport.fareharbor.engineering","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"webhooks.booking.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"widget.rentalcars.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.fareharbor.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"94% response, paid recently, resolved 1d ago"},"slop":{"risk":0.052,"label":"none","experimental":true}},"derived":{"novelty":0.2381,"inverse_crowd":0.4452,"payout_reliability":0.9668,"value_per_competition":0.2851,"triage_quality":0.94,"scope_breadth":0.7274,"crowding_per_asset_month":1.2015,"slop_risk":0.052},"score":{"total":56.3,"parts":{"novelty":0.238,"inverse_crowd":0.445,"payout_reliability":0.967,"value_per_competition":0.285,"triage_quality":0.94,"scope_breadth":0.727},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":86.9},"reasons":[{"sign":"good","text":"paid $45k in the last 90 days"},{"sign":"good","text":"94% response efficiency"},{"sign":"neutral","text":"328 reports in 90 days across 91 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.9 years"}]},{"id":"hackerone:audible","platform":"hackerone","slug":"audible","name":"Audible","url":"https://hackerone.com/audible","meta":{"reward_min":50,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-04-29T16:15:00.463Z","age_months":17.710303253412807,"reports_90d":70,"resolved_total":80,"response_efficiency":86,"response_indicator":"ok","paid_total":151600,"paid_90d":2000,"last_resolved_at":"2026-10-07T23:48:01.681Z","days_since_resolved":12.74275784519676,"avg_bounty_low":400,"avg_bounty_high":600,"min_bounty":50,"scope_count":22},"scope":[{"asset":"*.audible.(TLD)","type":"OTHER","bounty":true,"severity":"critical","instruction":"This scope item encompasses the following domains:\n\n- \\*.audible.com\n- \\*.audible.ca\n- \\*.audible.com.au\n- \\*.audible.co.uk\n- \\*.audible.com.br\n- \\*.audible.ca\n- \\*.audible.in\n- \\*.audible.fr\n- \\*.aud"},{"asset":"379693831","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"(https://apps.apple.com/us/app/audible-audiobooks-podcasts/id379693831)"},{"asset":"com.audible.application","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"(https://play.google.com/store/apps/details?id=com.audible.application)"},{"asset":"tax.audible.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 13d ago"},"slop":{"risk":0.073,"label":"none","experimental":true}},"derived":{"novelty":0.3099,"inverse_crowd":0.4824,"payout_reliability":0.9036,"value_per_competition":0.3135,"triage_quality":0.86,"scope_breadth":0.5044,"crowding_per_asset_month":1.0606,"slop_risk":0.073},"score":{"total":55.3,"parts":{"novelty":0.31,"inverse_crowd":0.482,"payout_reliability":0.904,"value_per_competition":0.314,"triage_quality":0.86,"scope_breadth":0.504},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":86.4},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"70 reports in 90 days across 22 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.5 years"}]},{"id":"hackerone:compass-bbp","platform":"hackerone","slug":"compass-bbp","name":"Compass","url":"https://hackerone.com/compass-bbp","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-10T12:34:13.355Z","age_months":36.34367731531866,"reports_90d":129,"resolved_total":null,"response_efficiency":88,"response_indicator":"ok","paid_total":156415,"paid_90d":14000,"last_resolved_at":"2026-10-12T20:33:45.776Z","days_since_resolved":7.87766415306713,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":50,"scope_count":40},"scope":[{"asset":"com.compass.compass","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/compass-real-estate-homes/id692766504","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"www.compass.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 8d ago"},"slop":{"risk":0.439,"label":"watch","experimental":true}},"derived":{"novelty":0.235,"inverse_crowd":0.4783,"payout_reliability":0.9232,"value_per_competition":0.3025,"triage_quality":0.88,"scope_breadth":0.5974,"crowding_per_asset_month":1.075,"slop_risk":0.439},"score":{"total":54.7,"parts":{"novelty":0.235,"inverse_crowd":0.478,"payout_reliability":0.923,"value_per_competition":0.303,"triage_quality":0.88,"scope_breadth":0.597},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":86.0},"reasons":[{"sign":"good","text":"paid $14k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"129 reports in 90 days across 40 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:bumble","platform":"hackerone","slug":"bumble","name":"Bumble","url":"https://hackerone.com/bumble","meta":{"reward_min":130,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-06-08T08:58:44.905Z","age_months":112.40608831615523,"reports_90d":152,"resolved_total":369,"response_efficiency":78,"response_indicator":"ok","paid_total":146983,"paid_90d":5870,"last_resolved_at":"2026-09-30T08:31:32.332Z","days_since_resolved":20.37920864380787,"avg_bounty_low":250,"avg_bounty_high":300,"min_bounty":130,"scope_count":75},"scope":[{"asset":"351331194","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Badoo - iOS Application\n\nhttps://apps.apple.com/gb/app/badoo-dating-chat-friends/id351331194"},{"asset":"403684733","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Badoo Premium - iOS\n\nhttps://apps.apple.com/gb/app/badoo-premium/id403684733"},{"asset":"6444040977","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"BFF 1.0 - iOS Application\n\nhttps://apps.apple.com/ph/app/bumble-for-friends-meet-irl/id6444040977"},{"asset":"930441707","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/bumble-dating-meet-people/id930441707"},{"asset":"api.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"badoocdn.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bma.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bma.bumble.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ccardseu1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ccardsus1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"chatdate.app","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.badoo.mobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.badoo.mobile"},{"asset":"com.badoo.twa","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Badoo Lite Android App\n\nhttps://play.google.com/store/apps/details?id=com.badoo.twa"},{"asset":"com.bumble.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.bumble.app"},{"asset":"com.bumblebff.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.genevachat.staging","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":"BFF 2.0 - Android Application (staging)\n\nAvailable at: https://appdistribution.firebase.google.com/pub/i/505927432f64f04a\n\n*If the distribution is full please do ask for the latest staging build and w"},{"asset":"com.hotornot.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"corp.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"deeplinks.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"deeplinks.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"eu1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gateway.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gateway.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"go.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hotornot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://testflight.apple.com/join/Y4cHu289","type":"TESTFLIGHT","bounty":true,"severity":"critical","instruction":"BFF Staging - iOS App\n\n*If the distribution is full please do ask for the latest staging build and we ll try to accommodate. The easiest way is to file an informational report requesting access*"},{"asset":"links.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"links.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"m.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"meu1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mus1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"payments.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"payments.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"presence.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"presence.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"router.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"social.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"social.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sockets.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sockets.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"translate.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"us1.badoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"web.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.bumble.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"www.geneva-staging.chat","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.geneva-staging.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"78% response, pays"},"slop":{"risk":0.041,"label":"none","experimental":true}},"derived":{"novelty":0.1507,"inverse_crowd":0.6155,"payout_reliability":0.8495,"value_per_competition":0.3439,"triage_quality":0.78,"scope_breadth":0.6966,"crowding_per_asset_month":0.6756,"slop_risk":0.041},"score":{"total":54.5,"parts":{"novelty":0.151,"inverse_crowd":0.616,"payout_reliability":0.849,"value_per_competition":0.344,"triage_quality":0.78,"scope_breadth":0.697},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":85.5},"reasons":[{"sign":"good","text":"paid $6k in the last 90 days"},{"sign":"neutral","text":"152 reports in 90 days across 75 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.4 years"}]},{"id":"hackerone:zooplus","platform":"hackerone","slug":"zooplus","name":"Zooplus","url":"https://hackerone.com/zooplus","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-03-24T09:04:58.468Z","age_months":18.90286618405392,"reports_90d":159,"resolved_total":417,"response_efficiency":85,"response_indicator":"ok","paid_total":631050,"paid_90d":49700,"last_resolved_at":"2026-10-19T05:09:24.516Z","days_since_resolved":1.5195768845486113,"avg_bounty_low":1000,"avg_bounty_high":1000,"min_bounty":50,"scope_count":39},"scope":[{"asset":"www.zooplus.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":"Hello,\nAs a lot of our domains share the same endpoints in the backend, we kindly ask you to also try to reproduce the error in www.zooplus.com\nIf you are able to reproduce it, please submit it with t"},{"asset":"www.zooplus.com","type":"URL","bounty":true,"severity":"critical","instruction":"Hello,\nAs a lot of our domains share the same endpoints in the backend, we kindly ask you to also try to reproduce the error in www.zooplus.com\nIf you are able to reproduce it, please submit it with t"},{"asset":"www.zooplus.de","type":"URL","bounty":true,"severity":"critical","instruction":"Hello,\nAs a lot of our domains share the same endpoints in the backend, we kindly ask you to also try to reproduce the error in www.zooplus.com\nIf you are able to reproduce it, please submit it with t"},{"asset":"zooplus.net","type":"URL","bounty":true,"severity":"critical","instruction":"Hello,\nAs a lot of our domains share the same endpoints in the backend, we kindly ask you to also try to reproduce the error in www.zooplus.com\nIf you are able to reproduce it, please submit it with t"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"85% response, paid recently, resolved 2d ago"},"slop":{"risk":0.064,"label":"none","experimental":true}},"derived":{"novelty":0.3023,"inverse_crowd":0.409,"payout_reliability":0.9217,"value_per_competition":0.2957,"triage_quality":0.85,"scope_breadth":0.5934,"crowding_per_asset_month":1.359,"slop_risk":0.064},"score":{"total":54.2,"parts":{"novelty":0.302,"inverse_crowd":0.409,"payout_reliability":0.922,"value_per_competition":0.296,"triage_quality":0.85,"scope_breadth":0.593},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":85.1},"reasons":[{"sign":"good","text":"paid $50k in the last 90 days"},{"sign":"good","text":"85% response efficiency"},{"sign":"neutral","text":"159 reports in 90 days across 39 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.6 years"}]},{"id":"hackerone:wellsfargo-bbp","platform":"hackerone","slug":"wellsfargo-bbp","name":"Wells Fargo Bounty","url":"https://hackerone.com/wellsfargo-bbp","meta":{"reward_min":150,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-10-21T18:22:40.380Z","age_months":23.949690310603465,"reports_90d":61,"resolved_total":215,"response_efficiency":87,"response_indicator":"ok","paid_total":290700,"paid_90d":15100,"last_resolved_at":"2026-10-20T14:13:20.056Z","days_since_resolved":0.1418507271412037,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":150,"scope_count":16},"scope":[{"asset":"*.advisor-connection.com","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"*.mworld.com","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"*.wellsfargo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.wellsfargoadvisors.com","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"*.wf.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"accountoffers.wellsfargo.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"com.wellsfargo.ceomobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wf.ceomobile","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wf.mobilebanking","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wf.wellsfargomobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"connect.secure.wellsfargo.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is our retail banking experience, and a priority domain."},{"asset":"homeloans.wellsfargo.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"http://wellsfargo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://wf.com","type":"URL","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 0d ago"},"slop":{"risk":0.057,"label":"none","experimental":true}},"derived":{"novelty":0.2762,"inverse_crowd":0.4286,"payout_reliability":0.9347,"value_per_competition":0.2764,"triage_quality":0.87,"scope_breadth":0.4557,"crowding_per_asset_month":1.2708,"slop_risk":0.057},"score":{"total":53.3,"parts":{"novelty":0.276,"inverse_crowd":0.429,"payout_reliability":0.935,"value_per_competition":0.276,"triage_quality":0.87,"scope_breadth":0.456},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":84.6},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"neutral","text":"61 reports in 90 days across 16 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.0 years"}]},{"id":"hackerone:priceline","platform":"hackerone","slug":"priceline","name":"Priceline","url":"https://hackerone.com/priceline","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-04-23T16:10:13.645Z","age_months":89.92396467937677,"reports_90d":155,"resolved_total":643,"response_efficiency":83,"response_indicator":"ok","paid_total":300000,"paid_90d":10000,"last_resolved_at":"2026-09-12T13:36:49.843Z","days_since_resolved":38.16720041464121,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":100,"scope_count":61},"scope":[{"asset":"336381998","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Priceline iOS App](https://apps.apple.com/us/app/priceline-hotel-travel-deals/id336381998)"},{"asset":"Penny","type":"AI_MODEL","bounty":true,"severity":"critical","instruction":"https://www.priceline.com/penny"},{"asset":"bookingholdings-coe.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.priceline.android.negotiator","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"cruises.priceline.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"flyiin.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.priceline.com/pwd/v0/pcln-graphql/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ir.bookingholdings.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"press.priceline.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"priceline.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.bookingholdings.com","type":"URL","bounty":true,"severity":"none","instruction":null},{"asset":"www.getaroom.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.priceline.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"83% response, pays, last resolved 38d ago"},"slop":{"risk":0.04,"label":"none","experimental":true}},"derived":{"novelty":0.1646,"inverse_crowd":0.5497,"payout_reliability":0.8459,"value_per_competition":0.3021,"triage_quality":0.83,"scope_breadth":0.6639,"crowding_per_asset_month":0.847,"slop_risk":0.04},"score":{"total":52.9,"parts":{"novelty":0.165,"inverse_crowd":0.55,"payout_reliability":0.846,"value_per_competition":0.302,"triage_quality":0.83,"scope_breadth":0.664},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":84.2},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"83% response efficiency"},{"sign":"neutral","text":"155 reports in 90 days across 61 assets"},{"sign":"neutral","text":"running 7.5 years"}]},{"id":"hackerone:faraday_inc","platform":"hackerone","slug":"faraday_inc","name":"Faraday, Inc.","url":"https://hackerone.com/faraday_inc","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-09-04T14:08:45.512Z","age_months":73.4996313205662,"reports_90d":89,"resolved_total":57,"response_efficiency":99,"response_indicator":"ok","paid_total":23785,"paid_90d":8350,"last_resolved_at":"2026-10-13T19:26:58.043Z","days_since_resolved":6.924049951678241,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":22},"scope":[{"asset":"BigQuery","type":"OTHER","bounty":true,"severity":"critical","instruction":"Faraday-managed datasets. Unauthenticated or cross-account access to Faraday or other customers' data is in scope. Access to a project you were granted is not a finding."},{"asset":"api.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"JWT is the user, not the account. Switching accounts changes what the JWT can do. API keys are shared by every member and appear in GraphQL, REST, and the UI; seeing your own key is intended. Cross-ac"},{"asset":"api.pro.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Catalog histograms and Faraday-provided consumer attributes are public (https://faraday.ai/catalog). Cross-account requires two unrelated users and curl from both sides. Copy a fresh token after the s"},{"asset":"api.row.pro","type":"URL","bounty":true,"severity":"critical","instruction":"Catalog histograms and Faraday-provided consumer attributes are public (https://faraday.ai/catalog). Cross-account requires two unrelated users and curl from both sides. Copy a fresh token after the s"},{"asset":"app.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Same auth model as api.faraday.ai. Frontend \"enabled\" flags and hidden consoles are intended; access control is at the API. Non-secret tokens in /api/environment.js and public third-party client token"},{"asset":"gs://faraday-secret","type":"OTHER","bounty":true,"severity":"critical","instruction":"Unauthenticated or cross-account read/write of Faraday secrets. Listing or reading under a prefix you own is not a finding."},{"asset":"gs://fdy-production-sdk-uploads","type":"OTHER","bounty":true,"severity":"critical","instruction":"Customer upload bucket. Unauthenticated or cross-account read/write is in scope. Listing is prefix-scoped to the caller account; seeing your own prefix is not a finding."},{"asset":"mcp.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Unauthenticated tool execution or customer data without a valid Faraday API key is in scope. Listing tools is out. Running tools with a valid key is the product."},{"asset":"pro.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Catalog histograms and Faraday-provided consumer attributes are public (https://faraday.ai/catalog). Cross-account requires two unrelated users and curl from both sides. Copy a fresh token after the s"},{"asset":"row.pro","type":"URL","bounty":true,"severity":"critical","instruction":"Catalog histograms and Faraday-provided consumer attributes are public (https://faraday.ai/catalog). Cross-account requires two unrelated users and curl from both sides. Copy a fresh token after the s"},{"asset":"s3://faraday-secret","type":"OTHER","bounty":true,"severity":"critical","instruction":"Unauthenticated or cross-account read/write of Faraday secrets. Listing or reading under a prefix you own is not a finding."},{"asset":"vault2.faraday.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Reachable from the public internet (no IP allowlist) is intended. Do not report that. Unauthenticated access to secrets is in scope. DoS, including resource exhaustion, is out."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"99% response, paid recently, resolved 7d ago"},"slop":{"risk":0.111,"label":"none","experimental":true}},"derived":{"novelty":0.1783,"inverse_crowd":0.4113,"payout_reliability":0.9802,"value_per_competition":0.2376,"triage_quality":0.99,"scope_breadth":0.5044,"crowding_per_asset_month":1.3485,"slop_risk":0.111},"score":{"total":52.8,"parts":{"novelty":0.178,"inverse_crowd":0.411,"payout_reliability":0.98,"value_per_competition":0.238,"triage_quality":0.99,"scope_breadth":0.504},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":83.7},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"89 reports in 90 days across 22 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.1 years"}]},{"id":"hackerone:gocardless_bbp","platform":"hackerone","slug":"gocardless_bbp","name":"GoCardless Bug Bounty Program","url":"https://hackerone.com/gocardless_bbp","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-09-12T15:14:12.000Z","age_months":37.25994522732718,"reports_90d":205,"resolved_total":134,"response_efficiency":87,"response_indicator":"ok","paid_total":42705,"paid_90d":1000,"last_resolved_at":"2026-10-16T11:30:12.921Z","days_since_resolved":4.255127752604166,"avg_bounty_low":150,"avg_bounty_high":150,"min_bounty":50,"scope_count":53},"scope":[{"asset":"*.gocardless-cicd.io","type":"WILDCARD","bounty":false,"severity":"medium","instruction":"Non-production environment for infrastructure services."},{"asset":"*.gocardless-lab.io","type":"WILDCARD","bounty":false,"severity":"low","instruction":"Testing and experimentation environment for internal tools with no live data."},{"asset":"*.gocardless.dev","type":"WILDCARD","bounty":false,"severity":"none","instruction":"Playground area for engineers in an isolated environment"},{"asset":"*.gocardless.io,*.gocardless-banking.io","type":"WILDCARD","bounty":false,"severity":"high","instruction":"Internal infrastructure and tools (e.g., performance dashboards)."},{"asset":"api-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"critical","instruction":"Sandbox version of the Merchant Dashboard API component - used to power the Merchant Dashboard (manage.gocardless) and to provide functionality for customers who wish to integrate their services with "},{"asset":"auth0.gocardless.com","type":"URL","bounty":false,"severity":"medium","instruction":"The auth0 authentication endpoint for `bankaccountdata.gocardless.com` - redirected automatically upon visiting. The criticality is capped at `Medium`, because Auth0 is a third-party service and confi"},{"asset":"bankaccountdata.gocardless.com","type":"OTHER","bounty":false,"severity":"high","instruction":"!Note that this is a production instance, so you must avoid denial of service, data corruption, and any other destructive or disruptive actions. No automated scanning allowed - manual testing only!\nTh"},{"asset":"connect-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"high","instruction":"Sandbox version of the Merchant Dashboard OpenID authentication component."},{"asset":"docs.gocardless.com","type":"URL","bounty":true,"severity":"low","instruction":"Contains only public information, has low business criticality, and has next to no functionality, hence the maximum severity of findings is capped at Low"},{"asset":"http://sso-demo.gocardless-staging.io","type":"URL","bounty":false,"severity":"low","instruction":"This is a non-production demo app, which does not contain or have access to any production data or services, and hence has no security impact."},{"asset":"https://github.com/gocardless","type":"SOURCE_CODE","bounty":true,"severity":"low","instruction":"We require a practical demonstration of exploitability rather than just a code snippet that seems incorrect, because it may be countered by other code operations or integrations."},{"asset":"https://ob-sandbox.gocardless.io","type":"API","bounty":false,"severity":"medium","instruction":"This is a sandbox instance for testing the Open Banking (and AIS) flow. Allows to connect to a test institution."},{"asset":"manage-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"high","instruction":"Sandbox version of the Merchant Dashboard application's front-end."},{"asset":"oauth-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"high","instruction":"The authentication component for GoCardless for Xero (GC4X)."},{"asset":"ob.gocardless.com","type":"URL","bounty":true,"severity":"medium","instruction":"This is the PRODUCTION endpoint for Account Information Services (AIS) user-facing flow (Bank Account Data (BAcD) and Instant Bank Payments (IBP)). Only gentle manual testing of the workflow can be pe"},{"asset":"pay-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"critical","instruction":"Sandbox for the API used to process billing requests, related to the Merchant Dashboard application."},{"asset":"payer-details-sandbox.gocardless.com","type":"URL","bounty":true,"severity":"high","instruction":"This is our new `payer-details` service that allows Payers to update their bank details. It is part of a workflow that is initiated from the Merchant Dashboard (`manage-sandbox.gocardless.com`) by the"},{"asset":"www.gocardless.com","type":"URL","bounty":true,"severity":"low","instruction":"Our public-facing content, without authenticated access to sensitive information related to merchants or payers."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 4d ago"},"slop":{"risk":0.108,"label":"none","experimental":true}},"derived":{"novelty":0.2328,"inverse_crowd":0.4244,"payout_reliability":0.9258,"value_per_competition":0.2213,"triage_quality":0.87,"scope_breadth":0.6417,"crowding_per_asset_month":1.2893,"slop_risk":0.108},"score":{"total":52.4,"parts":{"novelty":0.233,"inverse_crowd":0.424,"payout_reliability":0.926,"value_per_competition":0.221,"triage_quality":0.87,"scope_breadth":0.642},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":83.3},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"neutral","text":"205 reports in 90 days across 53 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.1 years"}]},{"id":"hackerone:walt_io","platform":"hackerone","slug":"walt_io","name":"Walt.io","url":"https://hackerone.com/walt_io","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-05-01T08:44:14.320Z","age_months":17.654879321174615,"reports_90d":161,"resolved_total":30,"response_efficiency":98,"response_indicator":"ok","paid_total":34475,"paid_90d":5225,"last_resolved_at":"2026-10-08T20:25:43.199Z","days_since_resolved":11.883249535011574,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":50,"scope_count":27},"scope":[{"asset":"Crypto infrastructure for cold and hot wallets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"http://t.me/wallet","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://t.me/walt","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"p2p.walletbot.me","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pay.wallet.tg","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"wallet.tg","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"walletbot.me","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wallettg.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wallettg.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"walt.io","type":"URL","bounty":true,"severity":"low","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 12d ago"},"slop":{"risk":0.286,"label":"none","experimental":true}},"derived":{"novelty":0.3102,"inverse_crowd":0.3048,"payout_reliability":0.9653,"value_per_competition":0.1867,"triage_quality":0.98,"scope_breadth":0.536,"crowding_per_asset_month":1.9877,"slop_risk":0.286},"score":{"total":52.3,"parts":{"novelty":0.31,"inverse_crowd":0.305,"payout_reliability":0.965,"value_per_competition":0.187,"triage_quality":0.98,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":82.8},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"161 reports in 90 days across 27 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.5 years"}]},{"id":"hackerone:greenhouse","platform":"hackerone","slug":"greenhouse","name":"Greenhouse.io","url":"https://hackerone.com/greenhouse","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-08-16T16:06:50.563Z","age_months":146.13759426413606,"reports_90d":73,"resolved_total":250,"response_efficiency":99,"response_indicator":"ok","paid_total":88990,"paid_90d":4250,"last_resolved_at":"2026-09-25T14:21:40.371Z","days_since_resolved":25.13606004427083,"avg_bounty_low":100,"avg_bounty_high":250,"min_bounty":100,"scope_count":20},"scope":[{"asset":"Tier 1 Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 2 Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 3 Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":"Documentation:\n\nhttps://developers.greenhouse.io/harvest.html\nhttps://developers.greenhouse.io/job-board.html#retrieve-a-department"},{"asset":"app.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.interseller.io","type":"URL","bounty":true,"severity":"critical","instruction":"Please do not spam the payment form as this is manage by a third party and is out of scope for testing. Vulnerabilities related to paywall bypass are out of scope."},{"asset":"boards.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"interseller.io","type":"URL","bounty":true,"severity":"critical","instruction":"This is a Marketing website and will produce less bounties than the actual product application"},{"asset":"jss.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"onboarding.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"support.greenhouse.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.greenhouse.io","type":"URL","bounty":true,"severity":"high","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"99% response, paid recently, resolved 25d ago"},"slop":{"risk":0.055,"label":"none","experimental":true}},"derived":{"novelty":0.1358,"inverse_crowd":0.4414,"payout_reliability":0.9463,"value_per_competition":0.2517,"triage_quality":0.99,"scope_breadth":0.4897,"crowding_per_asset_month":1.2167,"slop_risk":0.055},"score":{"total":51.9,"parts":{"novelty":0.136,"inverse_crowd":0.441,"payout_reliability":0.946,"value_per_competition":0.252,"triage_quality":0.99,"scope_breadth":0.49},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":82.4},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"73 reports in 90 days across 20 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.2 years"}]},{"id":"hackerone:koho","platform":"hackerone","slug":"koho","name":"KOHO","url":"https://hackerone.com/koho","meta":{"reward_min":50,"reward_max":388,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-01T17:04:23.516Z","age_months":29.6352545603563,"reports_90d":109,"resolved_total":104,"response_efficiency":99,"response_indicator":"ok","paid_total":83120,"paid_90d":7875,"last_resolved_at":"2026-10-19T13:46:30.291Z","days_since_resolved":1.1604822664930554,"avg_bounty_low":300,"avg_bounty_high":388,"min_bounty":50,"scope_count":19},"scope":[{"asset":"1091010942","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"iOS Mobile app"},{"asset":"app.koho.ca","type":"URL","bounty":true,"severity":"critical","instruction":"Our app API gateway."},{"asset":"assets.koho.ca","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"ca.koho","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Android Mobile app"},{"asset":"clicks.koho.ca","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"http://api.koho.ca/1.0","type":"URL","bounty":true,"severity":"critical","instruction":"Our main API gateway"},{"asset":"http://api.koho.ca/partner","type":"URL","bounty":true,"severity":"critical","instruction":"Used for API calls to/for our partners"},{"asset":"login.koho.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"usercontent.koho.ca","type":"URL","bounty":true,"severity":"medium","instruction":"Used for our assets to be delivered to customers (i.e. logo, stylesheets, etc.)."},{"asset":"web.koho.ca","type":"URL","bounty":true,"severity":"critical","instruction":"Customer-facing Web application"},{"asset":"www.koho.ca","type":"URL","bounty":true,"severity":"medium","instruction":"Marketing website"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"99% response, paid recently, resolved 1d ago"},"slop":{"risk":0.111,"label":"none","experimental":true}},"derived":{"novelty":0.2544,"inverse_crowd":0.3148,"payout_reliability":0.9924,"value_per_competition":0.2068,"triage_quality":0.99,"scope_breadth":0.4819,"crowding_per_asset_month":1.9123,"slop_risk":0.111},"score":{"total":51.9,"parts":{"novelty":0.254,"inverse_crowd":0.315,"payout_reliability":0.992,"value_per_competition":0.207,"triage_quality":0.99,"scope_breadth":0.482},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":81.9},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"109 reports in 90 days across 19 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.5 years"}]},{"id":"hackerone:clear","platform":"hackerone","slug":"clear","name":"CLEAR","url":"https://hackerone.com/clear","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-03-02T16:43:22.017Z","age_months":7.623413925707277,"reports_90d":153,"resolved_total":101,"response_efficiency":82,"response_indicator":"ok","paid_total":75414,"paid_90d":17450,"last_resolved_at":"2026-09-17T20:26:20.607Z","days_since_resolved":32.88281657204861,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":100,"scope_count":30},"scope":[{"asset":"authentication.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"clearme.atlassian.net","type":"URL","bounty":true,"severity":"high","instruction":"Clear Service Support Platform.\nRegistration & Login using arbitrary domains is out of scope. \nPlease only report misconfigurations that result in vulnerabilities. Any vulnerabilities in the Atlassian"},{"asset":"clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”."},{"asset":"com.clearme.Clear","type":"OTHER_IPA","bounty":true,"severity":"critical","instruction":"You must install the app using [this link](https://clear.app.link/hackerone-mobile).\n\nYou can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. There are also free me"},{"asset":"com.clearme.clearapp","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":"You must install the app using [this link](https://clear.app.link/hackerone-mobile).\n\nYou can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”."},{"asset":"concierge.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"enroll.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://verified.clearme.com/dashboard","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identity.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ir.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Public Investor Relations Site"},{"asset":"mobile.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the backend that supports our flagship iOS and Android apps. Please read the \"Mobile App\" section under our program's policy to see the best way to test as well as the eligibility requirements"},{"asset":"my.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Clear Member Portal"},{"asset":"scan.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Must only referencing physical location parameter \"CLR\". Attempts to scan or attack other production locations ( Barclays Center, JFK, LAX, Madison Square Garden, SoFi Stadium, etc) is not authorized "},{"asset":"verified.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"verified.clearme.com/v1/verification_sessions","type":"API","bounty":true,"severity":"critical","instruction":"Public facing API for starting a session in C1."},{"asset":"web-edge.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.clearme.com","type":"URL","bounty":true,"severity":"critical","instruction":"Primary Marketing Site"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"82% response, pays, last resolved 33d ago"},"slop":{"risk":0.122,"label":"none","experimental":true}},"derived":{"novelty":0.4224,"inverse_crowd":0.346,"payout_reliability":0.8488,"value_per_competition":0.2066,"triage_quality":0.82,"scope_breadth":0.5524,"crowding_per_asset_month":1.7,"slop_risk":0.122},"score":{"total":51.8,"parts":{"novelty":0.422,"inverse_crowd":0.346,"payout_reliability":0.849,"value_per_competition":0.207,"triage_quality":0.82,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":81.4},"reasons":[{"sign":"good","text":"paid $17k in the last 90 days"},{"sign":"good","text":"82% response efficiency"},{"sign":"neutral","text":"153 reports in 90 days across 30 assets"},{"sign":"neutral","text":"launched 8 months ago"}]},{"id":"hackerone:visa","platform":"hackerone","slug":"visa","name":"Visa","url":"https://hackerone.com/visa","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-07-10T17:14:32.915Z","age_months":39.35986882798122,"reports_90d":170,"resolved_total":113,"response_efficiency":67,"response_indicator":"missed","paid_total":87900,"paid_90d":15500,"last_resolved_at":"2026-10-19T02:47:26.098Z","days_since_resolved":1.618169685474537,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":216},"scope":[{"asset":"*.prod.innovexperiments.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.visamiddleeast.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"admin-portal.api-xperience.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"africa.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"askpeopleteam.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bd.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"by.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capability.prod.innovexperiments.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cis.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"codeofconduct.visa.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"console.tink.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.authorize.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.currencycloud.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"developer.cybersource.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.plus.authorize.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developers.pismo.io","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"direct-demo.currencycloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dwy.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ebctest.cybersource.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"forms.cybersource.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"http://myvisainfinite.com/suntrust/en_us/home.html","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/CGK2","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/bin","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/boarding/v1/registrations","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/boarding/v1/templates","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/bos","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/casemanagement","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/cds/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/dmconfigapi","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/epcapi","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/identity","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/invoicing","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/jobs","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/kms/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/listmanager","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/merchant-mgmt/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/merchantvelocity","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/mms","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/notification-subscriptions","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/oms","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/partner","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/payerauthentication","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/payment","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/pbl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/prcs","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/prefs","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/processorconfigapi","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/products/virtual-terminal","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/pts/v1/transaction-batch-upload","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/pts/v2","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/reporting","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/riskui","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/saconfig","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/sms","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/tech-partner-integration","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/tms","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/tss","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/ums","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/underwriting","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/varm","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/vdm","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/vroom","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ebctest.cybersource.com/vts","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://usa.visa.com/gateway/api","type":"URL","bounty":true,"severity":"critical","instruction":"Includes regional variations of Visa Marketing sites, such as: \nhttps://www.visabg.com/gateway/api\nhttps://www.visa.co.nz/gateway/api"},{"asset":"https://www.currencycloud.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.myvisacardportal.com/enbd/en_ae/landing/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.visa.com.az/az_az/account/registration","type":"URL","bounty":true,"severity":"critical","instruction":"Includes regional variations of Visa Marketing sites, such as: \nhttps://usa.visa.com/en-us/account/registration"},{"asset":"https://www.visa.com.ua/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"my.visa.fr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"myanmar.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"myvu.visauniversity.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"releasor.payworks.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rs.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sandbox.authorize.net","type":"URL","bounty":true,"severity":"critical","instruction":"An account can be created via https://developer.authorize.net/hello_world/sandbox.html"},{"asset":"sandbox.developer.plus.authorize.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sandbox.secure.checkout.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sap.api-xperience.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"survey.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"test.payworks.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"testbank.xs2a.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"usa.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vasdemos.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vgov.catalogue.digitalcontrolroom.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"visa.co.za","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"visa.com.au","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"visa.com.jm","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"visa.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"visa.com.ru","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"visainnovationprogram.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"visaonchainanalytics.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"visasgic.api-xperience.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vwcm.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.authorize.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.cybersource.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.practicalbusinessskills.org","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.practicalmoneyskills.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.practicalmoneyskills.org","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.tink.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.trialpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.be","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.cl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.cn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.cr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.id","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.il","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.in","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.ke","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.ni","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.nz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.th","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.co.ve","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.az","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.bo","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.br","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.cy","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.ge","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.hk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.hn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.hr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.jm","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.kh","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.kz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.lk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.my","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.ng","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.ph","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.ru","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.sg","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.tr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.tw","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.com.vn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.cz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.de","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.dk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.ee","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.es","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.fi","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.fr","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"www.visa.gr","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.hu","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.ie","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.is","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.lt","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.lv","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.mn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.nl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.no","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.pl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.pt","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.ro","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.se","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visa.sk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visabg.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visaeurope.at","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visaeurope.ch","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visaeurope.lu","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visaeurope.si","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visaitalia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visakorea.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.visasoutheasteurope.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.07,"label":"none","experimental":true}},"derived":{"novelty":0.2278,"inverse_crowd":0.8328,"payout_reliability":0.8314,"value_per_competition":0.5296,"triage_quality":0.5025,"scope_breadth":0.8654,"crowding_per_asset_month":0.2623,"slop_risk":0.07},"score":{"total":51.7,"parts":{"novelty":0.228,"inverse_crowd":0.833,"payout_reliability":0.831,"value_per_competition":0.53,"triage_quality":0.503,"scope_breadth":0.865},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":81.0},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"neutral","text":"170 reports in 90 days across 216 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.3 years"}]},{"id":"hackerone:mercadolibre","platform":"hackerone","slug":"mercadolibre","name":"MercadoLibre","url":"https://hackerone.com/mercadolibre","meta":{"reward_min":100,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-11-28T15:13:00.250Z","age_months":34.730198383460724,"reports_90d":897,"resolved_total":1904,"response_efficiency":95,"response_indicator":"ok","paid_total":2250000,"paid_90d":165000,"last_resolved_at":"2026-10-14T03:03:23.296Z","days_since_resolved":6.607091004918981,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":100,"scope_count":137},"scope":[{"asset":"*.adminml.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.cl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.ar","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.mx","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.pe","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.uy","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadolibre.com.ve","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.mercadolivre.com.br","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.cl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.ar","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.br","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.mx","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.pe","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mercadopago.com.uy","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 1"},{"asset":"*.mlstatic.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"*.modoblack.mercadolivre.com.br","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"*.tucarro.com.ve","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"Crypto","type":"OTHER","bounty":true,"severity":"critical","instruction":"- www.mercadopago.com.mx/crypto/*\n- www.mercadopago.cl/crypto/*\n- www.mercadopago.com.br/crypto/*"},{"asset":"Leaked Credentials","type":"OTHER","bounty":true,"severity":"high","instruction":"Select this asset for issues related to credentials from public sources"},{"asset":"Point Smart","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Tier 1 - MLA - https://www.mercadopago.com.ar/point-smart\nTier 1 - MLB - https://www.mercadopago.com.br/point-smart"},{"asset":"Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wonder","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.mercadolibre.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 1 - See documentation: https://developers.mercadolibre.com.ar/en_us/api-docs"},{"asset":"api.mercadopago.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 1 - See documentation: https://www.mercadopago.com.ar/developers/en/reference"},{"asset":"biolibre.ar","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"biolibre.cl","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"biolibre.co","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"biolibre.mx","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"biolivre.com.br","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"com.3mosquitos.MercadoLibre","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Libre iOS: https://apps.apple.com/ar/app/mercado-libre/id463624852"},{"asset":"com.mercadoenvios.crowdsourcing","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Envíos Extra: https://play.google.com/store/apps/details?id=com.mercadoenvios.crowdsourcing"},{"asset":"com.mercadoenvios.driver","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Envíos Flex: https://play.google.com/store/apps/details?id=com.mercadoenvios.driver"},{"asset":"com.mercadoenvios.logistics","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Envíos Logistics: https://play.google.com/store/apps/details?id=com.mercadoenvios.logistics"},{"asset":"com.mercadolibre","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Libre Android: https://play.google.com/store/apps/details?id=com.mercadolibre"},{"asset":"com.mercadolibre.android.mplay_tv","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"com.mercadopago.MercadoPago","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Pago iOS:\nhttps://itunes.apple.com/ar/app/mercado-pago-recargar-celular/id925436649"},{"asset":"com.mercadopago.wallet","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Tier 1 - Mercado Pago Android:\nhttps://play.google.com/store/apps/details?id=com.mercadopago.wallet"},{"asset":"fullbarhomologa.modoblackfullbar.com.br","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"furycloud.io","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2 - Exposed in ZT"},{"asset":"furydocs.io","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2 - Exposed in ZT"},{"asset":"logistica.redelcom.cl","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"meliplay.com.ar","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"meliplay.com.pe","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"meliplay.com.uy","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadobackoffice.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoenvios.com.ve","type":"URL","bounty":false,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadolibreexperience.com.*","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadolivreexperience.mercadolivre.com.br","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"mercadopago.com.ve","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoplay.co","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoplay.com.pe","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoplay.com.uy","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoplay.pe","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mercadoplay.uy","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mpago.la","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"mpago.li","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"portalinmobiliario.cl","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"portalinmobiliario.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"sustentabilidadmercadolibre.com/","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"tucarro.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"tucarro.com.co","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"tumoto.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.ipbooster.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"www.mercadolibre.co.cr","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.bo","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.do","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.ec","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.gt","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.hn","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.ni","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.pa","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.py","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolibre.com.sv","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadolivre.com","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"},{"asset":"www.mercadopago.com.ec","type":"URL","bounty":true,"severity":"critical","instruction":"Tier 2"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"95% response, paid recently, resolved 7d ago"},"slop":{"risk":0.097,"label":"none","experimental":true}},"derived":{"novelty":0.2392,"inverse_crowd":0.2816,"payout_reliability":0.9608,"value_per_competition":0.1811,"triage_quality":0.95,"scope_breadth":0.7926,"crowding_per_asset_month":2.1825,"slop_risk":0.097},"score":{"total":51.5,"parts":{"novelty":0.239,"inverse_crowd":0.282,"payout_reliability":0.961,"value_per_competition":0.181,"triage_quality":0.95,"scope_breadth":0.793},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":80.5},"reasons":[{"sign":"good","text":"paid $165k in the last 90 days"},{"sign":"good","text":"95% response efficiency"},{"sign":"neutral","text":"897 reports in 90 days across 137 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.9 years"}]},{"id":"hackerone:affirm","platform":"hackerone","slug":"affirm","name":"Affirm","url":"https://hackerone.com/affirm","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-08-10T18:21:44.511Z","age_months":74.31521463526694,"reports_90d":54,"resolved_total":112,"response_efficiency":83,"response_indicator":"ok","paid_total":99665,"paid_90d":29384,"last_resolved_at":"2026-10-19T19:37:56.439Z","days_since_resolved":0.9164296276041666,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":16},"scope":[{"asset":"com.affirm.central.audit","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is the Android testing app built for HackerOne. It's distributed through Google Play Store."},{"asset":"com.affirm.internal.hackerone","type":"OTHER","bounty":true,"severity":"critical","instruction":"This is the testing iOS app built for HackerOne. It is distributed through Crashlytics."},{"asset":"sandbox.affirm.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"83% response, paid recently, resolved 1d ago"},"slop":{"risk":0.06,"label":"none","experimental":true}},"derived":{"novelty":0.1775,"inverse_crowd":0.4647,"payout_reliability":0.913,"value_per_competition":0.2954,"triage_quality":0.83,"scope_breadth":0.4557,"crowding_per_asset_month":1.125,"slop_risk":0.06},"score":{"total":51.3,"parts":{"novelty":0.178,"inverse_crowd":0.465,"payout_reliability":0.913,"value_per_competition":0.295,"triage_quality":0.83,"scope_breadth":0.456},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":80.1},"reasons":[{"sign":"good","text":"paid $29k in the last 90 days"},{"sign":"good","text":"83% response efficiency"},{"sign":"neutral","text":"54 reports in 90 days across 16 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.2 years"}]},{"id":"hackerone:grab","platform":"hackerone","slug":"grab","name":"Grab","url":"https://hackerone.com/grab","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-07-12T02:47:47.420Z","age_months":111.29750876067571,"reports_90d":301,"resolved_total":1055,"response_efficiency":88,"response_indicator":"ok","paid_total":1067779,"paid_90d":47260,"last_resolved_at":"2026-10-20T07:40:54.833Z","days_since_resolved":0.4143648822337963,"avg_bounty_low":250,"avg_bounty_high":500,"min_bounty":50,"scope_count":66},"scope":[{"asset":"*.grab-sure.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grab.co","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.grab.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grabpay.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grabtaxi.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.myteksi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.myteksi.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ovo.id","type":"WILDCARD","bounty":true,"severity":"high","instruction":"Staging/Development/UAT environments are considered out-of-scope, such as:\n- *.byte-stack.net\n- *.dududev\n- *.uat-ovo.net\nand other assets that might not be explicitly listed."},{"asset":"*.ovofinansial.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"*.taralite.com has been rebranded as OVO Finansial"},{"asset":"1142114207","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"OVO iOS application\nhttps://apps.apple.com/ID/app/id1142114207\nStaging/Development/UAT environments are considered out-of-scope, such as:\n- *.byte-stack.net\n- *.dududev\n- *.uat-ovo.net\nand other asset"},{"asset":"1257641454","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Grab Driver\n\n* Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability)"},{"asset":"1343620481","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"medium","instruction":"GrabPay Merchant"},{"asset":"1481198245","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"MoveIt is an independent two-wheeler taxi platform serving the Philippines."},{"asset":"647268330","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Grab (iOS)\n\n* Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability)"},{"asset":"C100447517","type":"OTHER","bounty":true,"severity":"critical","instruction":"Grab Superapp for Huawei Devices(using HMS)\nhttps://appgallery.huawei.com/#/app/C100447517"},{"asset":"C103149579","type":"OTHER","bounty":true,"severity":"critical","instruction":"Grab Driver app for Huawei Devices(using HMS)\nhttps://appgallery.huawei.com/#/app/C103149579"},{"asset":"Cloud & 3rd-Party Services (First-Party Misconfigurations)","type":"OTHER","bounty":true,"severity":"critical","instruction":"This category covers third-party hosted infrastructure, SaaS, and cloud platforms (e.g., Firebase, AWS, GCP) used by our organization. Scope is strictly limited to security misconfigurations within ou"},{"asset":"api.grabpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"**What it does:** Grab iOS and Android apps communicate with this service while you use Grab specifically for newer payment features. This endpoint acts as an API gateway proxy to all of our services."},{"asset":"com.grab.merchant","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.grabpay.merchant","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"medium","instruction":"GrabPay Merchant"},{"asset":"com.grabtaxi.driver2","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Grab Driver\n\n* Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability)"},{"asset":"com.grabtaxi.passenger","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Grab (Android)\n\n* Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability)"},{"asset":"com.moveit.app.customer","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"MoveIt is an independent two-wheeler taxi platform serving the Philippines."},{"asset":"gamma.grab.co","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gifts.grab.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grab.careers","type":"URL","bounty":true,"severity":"medium","instruction":"Certain features are managed by third-party vendors; bounties for these components will be evaluated on a case-by-case basis."},{"asset":"hungrygowhere.com","type":"URL","bounty":true,"severity":"high","instruction":"HungryGoWhere is a food discovery platform that helps users explore dining options, reviews, and deals, primarily in Singapore."},{"asset":"kartaview.org","type":"URL","bounty":true,"severity":"medium","instruction":"KartaView (formerly OpenStreetCam) is a community-contributed street-level imagery platform operated by Grab. Users upload geo-tagged photos that are processed through an automated pipeline before bei"},{"asset":"manage.grab.co","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ovo.id","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"OVO's Android App:\nhttps://play.google.com/store/apps/details?id=ovo.id\n\nStaging/Development/UAT environments are considered out-of-scope, such as:\n*.byte-stack.net\n*.dududev\n*.uat-ovo.net and other a"},{"asset":"p.grabtaxi.com","type":"URL","bounty":true,"severity":"critical","instruction":"**What it does:** Grab iOS and Android apps communicate with this service while you use Grab. This endpoint acts as an API gateway proxy to all of our services. This API exposes the largest attack sur"},{"asset":"xtramile.grabpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 0d ago"},"slop":{"risk":0.066,"label":"none","experimental":true}},"derived":{"novelty":0.1513,"inverse_crowd":0.3769,"payout_reliability":0.9391,"value_per_competition":0.2491,"triage_quality":0.88,"scope_breadth":0.6764,"crowding_per_asset_month":1.5202,"slop_risk":0.066},"score":{"total":50.7,"parts":{"novelty":0.151,"inverse_crowd":0.377,"payout_reliability":0.939,"value_per_competition":0.249,"triage_quality":0.88,"scope_breadth":0.676},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":79.6},"reasons":[{"sign":"good","text":"paid $47k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"301 reports in 90 days across 66 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.3 years"}]},{"id":"hackerone:trendyol","platform":"hackerone","slug":"trendyol","name":"Trendyol","url":"https://hackerone.com/trendyol","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-08-16T07:46:50.544Z","age_months":50.14900198297399,"reports_90d":128,"resolved_total":310,"response_efficiency":100,"response_indicator":"ok","paid_total":100000,"paid_90d":15000,"last_resolved_at":"2026-10-16T13:17:18.147Z","days_since_resolved":4.1807617109374995,"avg_bounty_low":150,"avg_bounty_high":150,"min_bounty":50,"scope_count":22},"scope":[{"asset":"1127881507","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Dolap IOS Application"},{"asset":"524362642","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Trendyol IOS Application"},{"asset":"6467634418","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Trendyol Milla IOS Application"},{"asset":"com.dolap.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.trendyol.go","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.trendyol.milla.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Trendyol Milla Android Application"},{"asset":"trendyol.com","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dolap.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.tgoyemek.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.trendyol-milla.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.trendyol.com","type":"URL","bounty":true,"severity":"critical","instruction":"Feel free to use en.trendyol.com as the codebase is shared across all languages"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 4d ago"},"slop":{"risk":0.086,"label":"none","experimental":true}},"derived":{"novelty":0.2072,"inverse_crowd":0.3111,"payout_reliability":0.9909,"value_per_competition":0.1724,"triage_quality":1.0,"scope_breadth":0.5044,"crowding_per_asset_month":1.9394,"slop_risk":0.086},"score":{"total":50.5,"parts":{"novelty":0.207,"inverse_crowd":0.311,"payout_reliability":0.991,"value_per_competition":0.172,"triage_quality":1.0,"scope_breadth":0.504},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":79.2},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"128 reports in 90 days across 22 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.2 years"}]},{"id":"hackerone:portswigger","platform":"hackerone","slug":"portswigger","name":"PortSwigger Web Security","url":"https://hackerone.com/portswigger","meta":{"reward_min":100,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-11-30T12:03:24.452Z","age_months":118.6441750349171,"reports_90d":80,"resolved_total":118,"response_efficiency":99,"response_indicator":"ok","paid_total":94700,"paid_90d":13600,"last_resolved_at":"2026-10-13T10:51:34.537Z","days_since_resolved":7.281960900752314,"avg_bounty_low":350,"avg_bounty_high":400,"min_bounty":100,"scope_count":16},"scope":[{"asset":"Burp Collaborator","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Burp Collaborator is part of Burp Suite Pro - for further information refer to  https://portswigger.net/burp/help/collaborator.html"},{"asset":"Burp Suite DAST","type":"OTHER","bounty":true,"severity":"critical","instruction":"Install from https://portswigger.net/burp/enterprise"},{"asset":"Burp Suite Pro/Community","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Download from https://portswigger.net/burp"},{"asset":"ai.portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"collections.portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http1mustdie.com","type":"URL","bounty":true,"severity":"high","instruction":"This is static content hosted using CloudFront."},{"asset":"id.portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"links.portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":"https://portswigger.net"},{"asset":"share.portswigger.net","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"99% response, paid recently, resolved 7d ago"},"slop":{"risk":0.087,"label":"none","experimental":true}},"derived":{"novelty":0.1475,"inverse_crowd":0.3514,"payout_reliability":0.9795,"value_per_competition":0.227,"triage_quality":0.99,"scope_breadth":0.4557,"crowding_per_asset_month":1.6667,"slop_risk":0.087},"score":{"total":50.2,"parts":{"novelty":0.148,"inverse_crowd":0.351,"payout_reliability":0.979,"value_per_competition":0.227,"triage_quality":0.99,"scope_breadth":0.456},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":78.7},"reasons":[{"sign":"good","text":"paid $14k in the last 90 days"},{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"80 reports in 90 days across 16 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.9 years"}]},{"id":"hackerone:deriv","platform":"hackerone","slug":"deriv","name":"Deriv.com","url":"https://hackerone.com/deriv","meta":{"reward_min":100,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-11-04T06:44:35.375Z","age_months":131.53029910404783,"reports_90d":272,"resolved_total":281,"response_efficiency":98,"response_indicator":"ok","paid_total":53585,"paid_90d":2550,"last_resolved_at":"2026-10-09T06:53:38.661Z","days_since_resolved":11.447190947048611,"avg_bounty_low":100,"avg_bounty_high":100,"min_bounty":100,"scope_count":54},"scope":[{"asset":"*.deriv.cloud","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.deriv.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.derivws.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"api.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cashier.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"core-api.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ct.deriv.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"deriv.partners","type":"URL","bounty":false,"severity":"none","instruction":null},{"asset":"derivws.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/binary-com","type":"SOURCE_CODE","bounty":true,"severity":"medium","instruction":null},{"asset":"github.com/deriv-com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"home.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://api-core.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"oauth.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"partners.deriv.com","type":"URL","bounty":false,"severity":"none","instruction":null},{"asset":"secure-dfadmin.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"smarttrader.deriv.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 11d ago"},"slop":{"risk":0.099,"label":"none","experimental":true}},"derived":{"novelty":0.1416,"inverse_crowd":0.3494,"payout_reliability":0.9661,"value_per_competition":0.1739,"triage_quality":0.98,"scope_breadth":0.6446,"crowding_per_asset_month":1.679,"slop_risk":0.099},"score":{"total":50.1,"parts":{"novelty":0.142,"inverse_crowd":0.349,"payout_reliability":0.966,"value_per_competition":0.174,"triage_quality":0.98,"scope_breadth":0.645},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":78.3},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"272 reports in 90 days across 54 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.0 years"}]},{"id":"hackerone:flipkart","platform":"hackerone","slug":"flipkart","name":"Flipkart","url":"https://hackerone.com/flipkart","meta":{"reward_min":100,"reward_max":350,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-04-03T06:40:06.187Z","age_months":18.577629390761654,"reports_90d":267,"resolved_total":65,"response_efficiency":83,"response_indicator":"ok","paid_total":47430,"paid_90d":1550,"last_resolved_at":"2026-10-20T10:29:40.689Z","days_since_resolved":0.2971674748263889,"avg_bounty_low":300,"avg_bounty_high":350,"min_bounty":100,"scope_count":44},"scope":[{"asset":"https://api.myntra.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/in/app/flipkart-online-shopping-app/id742044692","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/in/app/myntra-fashion-shopping-app/id907394059","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://pay.payzippy.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://payments.myntra.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.flipkart.android","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.myntra.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://uiscoop.payzippy.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.flipkart.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.myntra.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"83% response, paid recently, resolved 0d ago"},"slop":{"risk":0.237,"label":"none","experimental":true}},"derived":{"novelty":0.3043,"inverse_crowd":0.3004,"payout_reliability":0.9143,"value_per_competition":0.1958,"triage_quality":0.83,"scope_breadth":0.6123,"crowding_per_asset_month":2.0227,"slop_risk":0.237},"score":{"total":50.0,"parts":{"novelty":0.304,"inverse_crowd":0.3,"payout_reliability":0.914,"value_per_competition":0.196,"triage_quality":0.83,"scope_breadth":0.612},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":77.8},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"good","text":"83% response efficiency"},{"sign":"neutral","text":"267 reports in 90 days across 44 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.5 years"}]},{"id":"hackerone:unico_idtech","platform":"hackerone","slug":"unico_idtech","name":"Unico IDtech","url":"https://hackerone.com/unico_idtech","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-01-13T15:43:37.144Z","age_months":9.201779152340482,"reports_90d":283,"resolved_total":28,"response_efficiency":86,"response_indicator":"ok","paid_total":78558,"paid_90d":26982,"last_resolved_at":"2026-10-06T23:56:10.623Z","days_since_resolved":13.737098794270834,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":34},"scope":[{"asset":"*.uat.unico.app","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"[Unico] Liveness Bypass","type":"OTHER","bounty":true,"severity":"critical","instruction":"Test environment for identifying weaknesses in the Liveness verification system and exploring potential bypass methods.\n\nCurrently available as:\n1. APK (Android)\n2. IPA (iOS)\n3. Web Page\n\nPlease refer"},{"asset":"accountshomolog.acesso.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"backend-sdk.uat.private.unico.run","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"blog.unico.io","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"devcenter.unico.io","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"https://sdk-h1.unico.io/createprocess","type":"URL","bounty":true,"severity":"high","instruction":"Scope related to Unico Liveness Testing. This endpoint is used for the final liveness validation."},{"asset":"idcash-uat.unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"identityhomolog.acesso.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"idpay-uat.unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"issuer.idpay-uat.unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"openfinance.unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"secure.unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"unico.io","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 14d ago"},"slop":{"risk":0.5,"label":"watch","experimental":true}},"derived":{"novelty":0.3949,"inverse_crowd":0.2271,"payout_reliability":0.9017,"value_per_competition":0.1663,"triage_quality":0.86,"scope_breadth":0.5719,"crowding_per_asset_month":2.7745,"slop_risk":0.5},"score":{"total":49.6,"parts":{"novelty":0.395,"inverse_crowd":0.227,"payout_reliability":0.902,"value_per_competition":0.166,"triage_quality":0.86,"scope_breadth":0.572},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":77.4},"reasons":[{"sign":"good","text":"paid $27k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"283 reports in 90 days across 34 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 9 months ago"}]},{"id":"hackerone:ripio","platform":"hackerone","slug":"ripio","name":"Ripio","url":"https://hackerone.com/ripio","meta":{"reward_min":100,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-08-21T23:42:39.047Z","age_months":13.954710210595863,"reports_90d":301,"resolved_total":62,"response_efficiency":92,"response_indicator":"ok","paid_total":27320,"paid_90d":3800,"last_resolved_at":"2026-09-21T15:00:17.605Z","days_since_resolved":29.10924020630787,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":100,"scope_count":40},"scope":[{"asset":"*ripio.com","type":"WILDCARD","bounty":false,"severity":"none","instruction":"Vulnerabilities reported in wildcard will be valid for reputation only."},{"asset":"*ripiotrade.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Web3 - Smart Contracts Scope","type":"OTHER","bounty":true,"severity":"critical","instruction":"Please read the Ripio HackerOne Program - Scope & Exclusions Policy (Logic-Based)"},{"asset":"com.ripio.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Play store download: https://play.google.com/store/apps/details?id=com.ripio.android"},{"asset":"com.ripio.ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Apple Store iOS download: https://itunes.apple.com/us/app/ripio/id1221006761"},{"asset":"defi.ripio.com","type":"URL","bounty":true,"severity":"critical","instruction":"defi.ripio.com is an API for investing cryptocurrencies in DeFi protocols, offering deposit and withdrawal features."},{"asset":"http://auth.ripio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://app.ripio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://basescan.org/address/0xf469eC9dEBf7F0adEBA4d1Db2FF5c70707bEeB30","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://bridge.ripio.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x0DC4F92879B7670e5f4e4e6e3c801D229129D90D","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x337E7456B420bD3481e7FA61fA9850343d610d34","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x46167cB034feC6ceC46CaeD4f61281f5Aa0Eb0e6","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x465e642387d3d73a57CDc1368fFA53A800bA5D47","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x4F34c8b3b5FB6D98Da888F0feA543d4d9C9F2eBE","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x61D450a098b6a7f69fC4b98CE68198fe59768651","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0x8a1D45e102e886510e891d2Ec656a708991e2D76","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0xD168CFbBE260D48cd119497a9a2eE8482080C5E7","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0xD76f5Faf6888e24D9F04Bf92a0c8B921FE4390e0","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://etherscan.io/address/0xdcC340132740AD57E9Fc90C9BD08B00dBbc87986","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://kyc.ripio.com/","type":"URL","bounty":true,"severity":"critical","instruction":"This asset corresponds to the company's identity verification system (KYC), used for the authentication and validation of users across the various platforms and services we have at Ripio. The main pur"},{"asset":"https://worldscan.org/address/0xDe7Ec97CFDeE9F20f9d256F4a0A0d694479fa2E0","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"sandbox-b2b.ripio.com","type":"URL","bounty":true,"severity":"critical","instruction":"B2B API allows a third party to access different use cases and services inside of Ripio ecosystem."},{"asset":"trade.ripio.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"92% response, paid recently, resolved 29d ago"},"slop":{"risk":0.284,"label":"none","experimental":true}},"derived":{"novelty":0.3389,"inverse_crowd":0.2491,"payout_reliability":0.9047,"value_per_competition":0.1444,"triage_quality":0.92,"scope_breadth":0.5974,"crowding_per_asset_month":2.5083,"slop_risk":0.284},"score":{"total":49.5,"parts":{"novelty":0.339,"inverse_crowd":0.249,"payout_reliability":0.905,"value_per_competition":0.144,"triage_quality":0.92,"scope_breadth":0.597},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":76.9},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"92% response efficiency"},{"sign":"neutral","text":"301 reports in 90 days across 40 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.2 years"}]},{"id":"hackerone:brave","platform":"hackerone","slug":"brave","name":"Brave Software","url":"https://hackerone.com/brave","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-10-12T03:16:50.290Z","age_months":120.26604520070917,"reports_90d":311,"resolved_total":567,"response_efficiency":100,"response_indicator":"ok","paid_total":160000,"paid_90d":35000,"last_resolved_at":"2026-10-20T07:39:58.137Z","days_since_resolved":0.4150210859375,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":47},"scope":[{"asset":"Brave Browser Desktop","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Please specify operating system and version of Brave. Only issues in the latest nightly/beta/stable releases are in scope."},{"asset":"Brave websites","type":"OTHER","bounty":true,"severity":"critical","instruction":"This includes but is not limited to Brave Search, Brave Search API dashboard, Brave Creators, Brave Accounts, Brave Talk, and Brave Ads dashboard. Please do not report issues that have no real user im"},{"asset":"com.brave.browser","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.brave.ios.browser","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/brave/*, https://github.com/brave-intl/*","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"In general we're interested in vulnerabilities in all GitHub repos under brave/ and brave-intl/, barring explicit exclusions. Also exclude forks and archived repos."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 0d ago"},"slop":{"risk":0.101,"label":"none","experimental":true}},"derived":{"novelty":0.1467,"inverse_crowd":0.279,"payout_reliability":0.9991,"value_per_competition":0.158,"triage_quality":1.0,"scope_breadth":0.6227,"crowding_per_asset_month":2.2057,"slop_risk":0.101},"score":{"total":49.2,"parts":{"novelty":0.147,"inverse_crowd":0.279,"payout_reliability":0.999,"value_per_competition":0.158,"triage_quality":1.0,"scope_breadth":0.623},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":76.5},"reasons":[{"sign":"good","text":"paid $35k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"311 reports in 90 days across 47 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.0 years"}]},{"id":"hackerone:capital-one-bounty","platform":"hackerone","slug":"capital-one-bounty","name":"Capital One Bug Bounty","url":"https://hackerone.com/capital-one-bounty","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-09-09T18:58:26.822Z","age_months":25.328750907607045,"reports_90d":85,"resolved_total":78,"response_efficiency":84,"response_indicator":"ok","paid_total":73813,"paid_90d":10500,"last_resolved_at":"2026-10-06T14:53:37.245Z","days_since_resolved":14.113874002604167,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":16},"scope":[{"asset":"*.capitalone.ca","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.capitalone.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.capitalonegslbex.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.capitaloneshopping.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"1089294040","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"407558537","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"Capital One Shopping Browser Extension","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Eno® Browser Extension","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"com.konylabs.capitalone","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wikibuy.prod.main","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"84% response, paid recently, resolved 14d ago"},"slop":{"risk":0.107,"label":"none","experimental":true}},"derived":{"novelty":0.2703,"inverse_crowd":0.335,"payout_reliability":0.891,"value_per_competition":0.2413,"triage_quality":0.84,"scope_breadth":0.4557,"crowding_per_asset_month":1.7708,"slop_risk":0.107},"score":{"total":49.2,"parts":{"novelty":0.27,"inverse_crowd":0.335,"payout_reliability":0.891,"value_per_competition":0.241,"triage_quality":0.84,"scope_breadth":0.456},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":76.0},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"85 reports in 90 days across 16 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.1 years"}]},{"id":"hackerone:braze_inc","platform":"hackerone","slug":"braze_inc","name":"Braze, Inc.","url":"https://hackerone.com/braze_inc","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-05-07T18:43:04.575Z","age_months":17.444091331593658,"reports_90d":83,"resolved_total":66,"response_efficiency":93,"response_indicator":"ok","paid_total":33020,"paid_90d":3275,"last_resolved_at":"2026-10-06T20:06:10.444Z","days_since_resolved":13.896823088252315,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":12},"scope":[{"asset":"https://bug-bounty-api.k8s.tools-001.d-use-1.braze-dev.com/","type":"API","bounty":true,"severity":"critical","instruction":"This is NOT the REST API and will have different endpoints and documentation that can be found on the Braze Public Docs."},{"asset":"https://bug-bounty-dashboard.k8s.tools-001.d-use-1.braze-dev.com/","type":"URL","bounty":true,"severity":"critical","instruction":"Only test against accounts that you own, or have explicit permission to test against."},{"asset":"https://bug-bounty-rest.k8s.tools-001.d-use-1.braze-dev.com/","type":"API","bounty":true,"severity":"critical","instruction":"This is the REST API, and can be used to manage the Dashboard. Documentation can be found on the public braze docs: https://www.braze.com/docs/api/basics"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 14d ago"},"slop":{"risk":0.133,"label":"none","experimental":true}},"derived":{"novelty":0.3116,"inverse_crowd":0.2685,"payout_reliability":0.9364,"value_per_competition":0.1688,"triage_quality":0.93,"scope_breadth":0.4126,"crowding_per_asset_month":2.3056,"slop_risk":0.133},"score":{"total":49.2,"parts":{"novelty":0.312,"inverse_crowd":0.268,"payout_reliability":0.936,"value_per_competition":0.169,"triage_quality":0.93,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":75.6},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"neutral","text":"83 reports in 90 days across 12 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.5 years"}]},{"id":"hackerone:kayak","platform":"hackerone","slug":"kayak","name":"KAYAK","url":"https://hackerone.com/kayak","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-04-19T14:32:49.017Z","age_months":54.04939042582136,"reports_90d":105,"resolved_total":545,"response_efficiency":88,"response_indicator":"ok","paid_total":187593,"paid_90d":2950,"last_resolved_at":"2026-10-09T04:45:40.218Z","days_since_resolved":11.536061815104167,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":100,"scope_count":20},"scope":[{"asset":"*.kayak.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"business.kayak.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.kayak.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"The most recent version of this app is in scope"},{"asset":"com.kayak.travel","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The most recent version of this app is in scope"},{"asset":"kayak.ai","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.cheapflights.com","type":"URL","bounty":true,"severity":"critical","instruction":"including local versions: e.g. www.cheapflights.co.uk, www.cheapflights.com.au, etc. Please check https://www.kayak.com/global for full list of domains that belong to us."},{"asset":"www.checkfelix.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.hotelscombined.com","type":"URL","bounty":true,"severity":"critical","instruction":"including local versions: e.g.  www.hotelscombined.com.au, www.hotelscombined.co.kr, etc. Please check https://www.kayak.com/global for full list of domains that belong to us."},{"asset":"www.kayak.com","type":"URL","bounty":true,"severity":"critical","instruction":"including localised versions: e.g. www.kayak.de, www.kayak.fr and www.kayak.co.uk, etc. Please check https://www.kayak.com/global for full list of domains that belong to us."},{"asset":"www.momondo.com","type":"URL","bounty":true,"severity":"critical","instruction":"including localised versions: e.g. www.momondo.dk, www.momondo.se, etc."},{"asset":"www.mundi.com.br","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.swoodoo.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 12d ago"},"slop":{"risk":0.071,"label":"none","experimental":true}},"derived":{"novelty":0.2012,"inverse_crowd":0.3382,"payout_reliability":0.9159,"value_per_competition":0.2029,"triage_quality":0.88,"scope_breadth":0.4897,"crowding_per_asset_month":1.75,"slop_risk":0.071},"score":{"total":48.4,"parts":{"novelty":0.201,"inverse_crowd":0.338,"payout_reliability":0.916,"value_per_competition":0.203,"triage_quality":0.88,"scope_breadth":0.49},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":75.1},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"105 reports in 90 days across 20 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.5 years"}]},{"id":"hackerone:databricks","platform":"hackerone","slug":"databricks","name":"Databricks","url":"https://hackerone.com/databricks","meta":{"reward_min":100,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-02-01T16:22:04.139Z","age_months":56.5766719217526,"reports_90d":384,"resolved_total":487,"response_efficiency":91,"response_indicator":"ok","paid_total":406945,"paid_90d":89150,"last_resolved_at":"2026-09-17T18:10:41.553Z","days_since_resolved":32.9770185859375,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":100,"scope_count":65},"scope":[{"asset":"Databricks Free Edition","type":"OTHER","bounty":true,"severity":"critical","instruction":"Information and Signup links: https://docs.databricks.com/aws/en/getting-started/free-edition"},{"asset":"Lakebase-Supported extensions","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Open Scope","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.cloud.databricks.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"databricks.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://dbc-9a3f8ed1-7608.cloud.databricks.com","type":"URL","bounty":true,"severity":"critical","instruction":"Documentation :\nFor information on using Databricks, please visit https://docs.databricks.com/"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"91% response, pays, last resolved 33d ago"},"slop":{"risk":0.102,"label":"none","experimental":true}},"derived":{"novelty":0.1977,"inverse_crowd":0.3072,"payout_reliability":0.8936,"value_per_competition":0.1803,"triage_quality":0.91,"scope_breadth":0.6739,"crowding_per_asset_month":1.9692,"slop_risk":0.102},"score":{"total":48.4,"parts":{"novelty":0.198,"inverse_crowd":0.307,"payout_reliability":0.894,"value_per_competition":0.18,"triage_quality":0.91,"scope_breadth":0.674},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":74.7},"reasons":[{"sign":"good","text":"paid $89k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"384 reports in 90 days across 65 assets"},{"sign":"neutral","text":"running 4.7 years"}]},{"id":"hackerone:crowdstrike","platform":"hackerone","slug":"crowdstrike","name":"Crowdstrike","url":"https://hackerone.com/crowdstrike","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-01-30T01:08:27.856Z","age_months":104.66322461891588,"reports_90d":227,"resolved_total":null,"response_efficiency":100,"response_indicator":"ok","paid_total":196299,"paid_90d":50600,"last_resolved_at":"2026-09-17T22:01:42.486Z","days_since_resolved":32.81659112065972,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":100,"scope_count":34},"scope":[{"asset":"*.adaptive-shield.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Excluding 3rd party maintained targets"},{"asset":"*.bionic.ai","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Excluding 3rd party maintained targets"},{"asset":"*.crowdstrike.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"*.flowsecurity.app","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Excluding 3rd party maintained targets"},{"asset":"*.humio.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"*.preempt.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"*.preemptsecurity.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"*.reposify.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"*.securecircle.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"CrowdStrike public infrastructure","type":"OTHER","bounty":true,"severity":"critical","instruction":"**Excluding 3rd party maintained targets**"},{"asset":"apps.apple.com/us/app/crowdstrike-falcon/id1458815656","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"falcon-sandbox.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hybrid-analysis.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"play.google.com/store/apps/details?id=com.crowdstrike.falconmobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"sgnl.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Including all public SGNL infrastructure"},{"asset":"sgnl.cloud","type":"URL","bounty":true,"severity":"critical","instruction":"Including all public SGNL infrastructure"},{"asset":"sgnl.team","type":"URL","bounty":true,"severity":"critical","instruction":"Including all public SGNL infrastructure"},{"asset":"sgnlapis.cloud","type":"URL","bounty":true,"severity":"critical","instruction":"Including all public SGNL infrastructure"},{"asset":"www.crowdstrike.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Including all localized sites: crowdstrike.de, crowdstrike.com.au, crowdstrike.co.uk, crowdstrike.fr, crowdstrike.jp, crowdstrike.com.br**"},{"asset":"www.crowdstrike.org","type":"URL","bounty":true,"severity":"critical","instruction":"**CrowdStrike Foundation Website**"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"100% response, pays, last resolved 33d ago"},"slop":{"risk":0.48,"label":"watch","experimental":true}},"derived":{"novelty":0.155,"inverse_crowd":0.2769,"payout_reliability":0.9389,"value_per_competition":0.173,"triage_quality":1.0,"scope_breadth":0.5719,"crowding_per_asset_month":2.2255,"slop_risk":0.48},"score":{"total":47.9,"parts":{"novelty":0.155,"inverse_crowd":0.277,"payout_reliability":0.939,"value_per_competition":0.173,"triage_quality":1.0,"scope_breadth":0.572},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":74.2},"reasons":[{"sign":"good","text":"paid $51k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"227 reports in 90 days across 34 assets"},{"sign":"neutral","text":"running 8.7 years"}]},{"id":"hackerone:hypr-corp","platform":"hackerone","slug":"hypr-corp","name":"HYPR","url":"https://hackerone.com/hypr-corp","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-02T18:23:04.649Z","age_months":36.59855171869534,"reports_90d":158,"resolved_total":214,"response_efficiency":96,"response_indicator":"ok","paid_total":99025,"paid_90d":23650,"last_resolved_at":"2026-10-19T22:05:14.249Z","days_since_resolved":0.8141401600115741,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":18},"scope":[{"asset":"*.gethypr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hypr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"HYPR Workforce Access.app","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"HyprUnlock.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"com.hypr.one","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.hypr.one","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"96% response, paid recently, resolved 1d ago"},"slop":{"risk":0.135,"label":"none","experimental":true}},"derived":{"novelty":0.2344,"inverse_crowd":0.2161,"payout_reliability":0.9782,"value_per_competition":0.1421,"triage_quality":0.96,"scope_breadth":0.4736,"crowding_per_asset_month":2.9259,"slop_risk":0.135},"score":{"total":47.6,"parts":{"novelty":0.234,"inverse_crowd":0.216,"payout_reliability":0.978,"value_per_competition":0.142,"triage_quality":0.96,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":73.8},"reasons":[{"sign":"good","text":"paid $24k in the last 90 days"},{"sign":"good","text":"96% response efficiency"},{"sign":"neutral","text":"158 reports in 90 days across 18 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:floqast","platform":"hackerone","slug":"floqast","name":"FloQast","url":"https://hackerone.com/floqast","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-03-22T18:49:56.754Z","age_months":42.9716553368412,"reports_90d":43,"resolved_total":280,"response_efficiency":77,"response_indicator":"ok","paid_total":203975,"paid_90d":24050,"last_resolved_at":"2026-10-19T19:17:12.403Z","days_since_resolved":0.9308281924189815,"avg_bounty_low":500,"avg_bounty_high":1000,"min_bounty":50,"scope_count":9},"scope":[{"asset":"*.eu.floqast.app","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All domains for FloQast's Core Application for European Customers"},{"asset":"*.floqast.app","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All domains for FloQast's Core Application for US Customers"},{"asset":"api-eu.floqast.app","type":"URL","bounty":true,"severity":"critical","instruction":"Public API for FloQast's Core Application for European Customers"},{"asset":"https://*.floqast.engineering","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"If you discover a domain that is accessible to the public and returns a 200 OK status code (or similar) with actual page content, please report it. However, do not submit reports for pages that only d"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"77% response, pays"},"slop":{"risk":0.063,"label":"none","experimental":true}},"derived":{"novelty":0.2202,"inverse_crowd":0.3639,"payout_reliability":0.8829,"value_per_competition":0.2691,"triage_quality":0.77,"scope_breadth":0.3704,"crowding_per_asset_month":1.5926,"slop_risk":0.063},"score":{"total":47.6,"parts":{"novelty":0.22,"inverse_crowd":0.364,"payout_reliability":0.883,"value_per_competition":0.269,"triage_quality":0.77,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":73.3},"reasons":[{"sign":"good","text":"paid $24k in the last 90 days"},{"sign":"neutral","text":"43 reports in 90 days across 9 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.6 years"}]},{"id":"hackerone:rockstargames","platform":"hackerone","slug":"rockstargames","name":"Rockstar Games","url":"https://hackerone.com/rockstargames","meta":{"reward_min":150,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-03-02T17:41:47.982Z","age_months":115.61386720542437,"reports_90d":127,"resolved_total":null,"response_efficiency":75,"response_indicator":"ok","paid_total":435600,"paid_90d":10200,"last_resolved_at":"2026-10-19T14:17:42.307Z","days_since_resolved":1.1388154146412037,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":150,"scope_count":30},"scope":[{"asset":"*.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":"Some subdomains excluded. See the rest of the scope table below."},{"asset":"Rockstar Games Launcher","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"circolocorecords.com/","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"prod.ros.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rockstarnorth.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"socialclub.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"store.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please note that the checkout/payment process go through the Xsolla platform. If you believe you have found a vulnerability in the checkout/payment process, please confirm first whether the vulnerabil"},{"asset":"support.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":"Vulnerability reports for support.rockstargames.com may not be awarded bounties if it is discovered that the root vulnerability lies in Zendesk's code. Hackers are encouraged to submit such reports to"},{"asset":"www.rockstargames.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"75% response, pays"},"slop":{"risk":0.451,"label":"watch","experimental":true}},"derived":{"novelty":0.149,"inverse_crowd":0.3981,"payout_reliability":0.8725,"value_per_competition":0.2603,"triage_quality":0.75,"scope_breadth":0.5524,"crowding_per_asset_month":1.4111,"slop_risk":0.451},"score":{"total":47.5,"parts":{"novelty":0.149,"inverse_crowd":0.398,"payout_reliability":0.872,"value_per_competition":0.26,"triage_quality":0.75,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":72.9},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"neutral","text":"127 reports in 90 days across 30 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.6 years"}]},{"id":"hackerone:paypal","platform":"hackerone","slug":"paypal","name":"PayPal","url":"https://hackerone.com/paypal","meta":{"reward_min":0,"reward_max":2630,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-09-26T17:05:39.371Z","age_months":96.78922982273367,"reports_90d":520,"resolved_total":2501,"response_efficiency":91,"response_indicator":"ok","paid_total":13825937,"paid_90d":392930,"last_resolved_at":"2026-10-20T12:09:12.782Z","days_since_resolved":0.22804602806712962,"avg_bounty_low":1600,"avg_bounty_high":2630,"min_bounty":0,"scope_count":61},"scope":[{"asset":"*.braintree-api.com","type":"URL","bounty":true,"severity":"critical","instruction":"For testing and account creation, please use *.sandbox.braintree-api.com rather than production."},{"asset":"*.braintree.tools","type":"URL","bounty":true,"severity":"critical","instruction":"Please note, this is a development environment that is constantly in flux. Accordingly, vulnerabilities found on this asset will generally have lower impact and payouts."},{"asset":"*.braintreegateway.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.braintreepayments.com","type":"URL","bounty":true,"severity":"critical","instruction":"For testing and account creation, please use *.sand.braintreepayments.com rather than production."},{"asset":"*.hyperwallet.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paydiant.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paylution.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paypal.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.paypalcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.venmo.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xoom.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"351727428","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[iOS Venmo App](https://apps.apple.com/us/app/venmo/id351727428)"},{"asset":"Account restrictions and control bypasses - campaign","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Braintree SDK","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"PayPal SDK","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.loanbuilder.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"api.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"com.paypal.android.p2pmobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.paypal.merchant","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.paypal.merchant.client","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.venmo","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xoom.android.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xoom.app","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.yourcompany.PPClient","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":null},{"asset":"decision.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":"We are aware that the root URL of this domain returns an error, the API is functioning correctly."},{"asset":"loanbuilder.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"my.loanbuilder.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"my.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"partner.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":"We are aware that the root URL of this domain returns an error, the API is functioning correctly."},{"asset":"paypal.me","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"paypalobjects.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"pigeon.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":"We are aware that the root URL of this domain returns an error, the API is functioning correctly."},{"asset":"prequal.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":"We are aware that the root URL of this domain returns an error, the API is functioning correctly."},{"asset":"py.pl","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sandbox.braintreegateway.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"scrutiny.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":"We are aware that the root URL of this domain returns an error, the API is functioning correctly."},{"asset":"swiftcapital.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"www.loanbuilder.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"www.paypal-*.com","type":"URL","bounty":true,"severity":"low","instruction":"PayPal's Partner Sites (www.paypal-__.com) are mainly marketing based sites that are not part of the core PayPal customer domains (.paypal.com) and are managed by hosting vendor companies. They have v"},{"asset":"www.swiftcapital.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"www.swiftfinancial.com","type":"URL","bounty":true,"severity":"low","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 0d ago"},"slop":{"risk":0.111,"label":"none","experimental":true}},"derived":{"novelty":0.1599,"inverse_crowd":0.2221,"payout_reliability":0.9545,"value_per_competition":0.207,"triage_quality":0.91,"scope_breadth":0.6639,"crowding_per_asset_month":2.8415,"slop_risk":0.111},"score":{"total":47.4,"parts":{"novelty":0.16,"inverse_crowd":0.222,"payout_reliability":0.954,"value_per_competition":0.207,"triage_quality":0.91,"scope_breadth":0.664},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":72.4},"reasons":[{"sign":"good","text":"paid $393k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"520 reports in 90 days across 61 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.1 years"}]},{"id":"hackerone:moonpay","platform":"hackerone","slug":"moonpay","name":"MoonPay ","url":"https://hackerone.com/moonpay","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-12-15T15:52:33.619Z","age_months":46.16256078022093,"reports_90d":465,"resolved_total":114,"response_efficiency":100,"response_indicator":"ok","paid_total":117770,"paid_90d":15450,"last_resolved_at":"2026-08-25T17:11:17.900Z","days_since_resolved":56.0182645697338,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":54},"scope":[{"asset":"*.hypermint.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.iron.xyz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"The main Iron application and its sandbox counterpart do not support self-registration. This is intentional. Testing should be conducted from an unauthenticated perspective, and no test accounts will "},{"asset":"*.moonpay.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.moonpaycloud.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.swaps.xyz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"api.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.moonx-dev.com","type":"URL","bounty":true,"severity":"critical","instruction":"In scope only for MoonX API functionality used by Paybox, including authentication, wallet management, signing, balances, and swaps. Reports must demonstrate an impact on Paybox users, data, wallets, "},{"asset":"api.paybox.sh","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.paybox.sh","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"buy.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/app/id1635031432","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/moonpay","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Archived repositories are excluded and considered out of scope."},{"asset":"https://play.google.com/store/apps/details?id=com.moonpay","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"hypermint.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iframe.moonx-dev.com","type":"URL","bounty":true,"severity":"critical","instruction":"In scope only where used by Paybox for authentication, session management, and passkey ceremonies. Reports must demonstrate a security impact on Paybox or its users; issues unrelated to the Paybox int"},{"asset":"moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sell.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"web3.moonpay.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"100% response, pays, last resolved 56d ago"},"slop":{"risk":0.266,"label":"none","experimental":true}},"derived":{"novelty":0.2141,"inverse_crowd":0.2201,"payout_reliability":0.9073,"value_per_competition":0.1442,"triage_quality":1.0,"scope_breadth":0.6446,"crowding_per_asset_month":2.8704,"slop_risk":0.266},"score":{"total":47.3,"parts":{"novelty":0.214,"inverse_crowd":0.22,"payout_reliability":0.907,"value_per_competition":0.144,"triage_quality":1.0,"scope_breadth":0.645},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":71.9},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"465 reports in 90 days across 54 assets"},{"sign":"neutral","text":"running 3.8 years"}]},{"id":"hackerone:krisp","platform":"hackerone","slug":"krisp","name":"Krisp","url":"https://hackerone.com/krisp","meta":{"reward_min":50,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-12-07T06:16:32.482Z","age_months":58.43032301955472,"reports_90d":190,"resolved_total":110,"response_efficiency":99,"response_indicator":"ok","paid_total":50000,"paid_90d":10000,"last_resolved_at":"2026-09-07T12:36:54.095Z","days_since_resolved":43.20881786834491,"avg_bounty_low":100,"avg_bounty_high":100,"min_bounty":50,"scope_count":27},"scope":[{"asset":"*.krisp.ai","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Except for OOS domains"},{"asset":"Other","type":"OTHER","bounty":true,"severity":"critical","instruction":"Anything that is verified that belongs to us and doesn't match any other scope."},{"asset":"account.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Krisp account frontend"},{"asset":"analytics.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Krisp analytics"},{"asset":"api.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Krisp API"},{"asset":"app.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Krisp account frontend"},{"asset":"download.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Download endpoints"},{"asset":"help-jp.krisp.ai","type":"URL","bounty":false,"severity":"low","instruction":"Misconfigurations are in scope and may be awarded"},{"asset":"help.krisp.ai","type":"URL","bounty":false,"severity":"critical","instruction":"Misconfigurations are in scope and may be awarded"},{"asset":"https://download.krisp.ai/mac","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Krisp MacOS electron app.\nBypassing free minutes limitation via changing frontend applications' logic is out of scope"},{"asset":"https://download.krisp.ai/win","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Krisp Windows electron app.\nBypassing free minutes limitation via changing frontend applications' logic is out of scope"},{"asset":"krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"resources.krisp.ai","type":"URL","bounty":false,"severity":"none","instruction":"Misconfigurations are in scope and may be awarded"},{"asset":"teams.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Teams API"},{"asset":"upld.krisp.ai","type":"URL","bounty":true,"severity":"critical","instruction":"Websocket API"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"99% response, pays, last resolved 43d ago"},"slop":{"risk":0.154,"label":"none","experimental":true}},"derived":{"novelty":0.1952,"inverse_crowd":0.2644,"payout_reliability":0.9187,"value_per_competition":0.1393,"triage_quality":0.99,"scope_breadth":0.536,"crowding_per_asset_month":2.3457,"slop_risk":0.154},"score":{"total":47.2,"parts":{"novelty":0.195,"inverse_crowd":0.264,"payout_reliability":0.919,"value_per_competition":0.139,"triage_quality":0.99,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":71.5},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"190 reports in 90 days across 27 assets"},{"sign":"neutral","text":"running 4.9 years"}]},{"id":"hackerone:hostinger","platform":"hackerone","slug":"hostinger","name":"hostinger ","url":"https://hackerone.com/hostinger","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-01-02T13:01:25.082Z","age_months":33.583303246187924,"reports_90d":417,"resolved_total":1017,"response_efficiency":100,"response_indicator":"ok","paid_total":1415785,"paid_90d":393074,"last_resolved_at":"2026-10-20T12:49:28.278Z","days_since_resolved":0.2000888984375,"avg_bounty_low":250,"avg_bounty_high":500,"min_bounty":100,"scope_count":30},"scope":[{"asset":"H5G/Agency","type":"OTHER","bounty":true,"severity":"critical","instruction":"We are introducing a new testing scope for our Hosting Infrastructure tailored for WordPress websites."},{"asset":"Managed OpenClaw","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"agents.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"builder.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cpanel.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Hostinger's customers management panel, area meant for managing all services: hosting, vps, domains, ssl, cpanel hosting, windows_vps, logibox email, gsuite, cloudflare, marketgoo, flockmail. "},{"asset":"ecommerce.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"horizons.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Hostinger's main web application meant for service presentation and client account registration. No confidential information or client data is stored on these systems. However, gaining access "},{"asset":"hpanel.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Hostinger's customers management panel, area meant for managing all services: hosting, vps, domains, ssl, cpanel hosting, windows_vps, logibox email, gsuite, cloudflare, marketgoo, flockmail. "},{"asset":"mail.hostinger.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"payments.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"reach.hostinger.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 0d ago"},"slop":{"risk":0.183,"label":"none","experimental":true}},"derived":{"novelty":0.2424,"inverse_crowd":0.1371,"payout_reliability":0.9996,"value_per_competition":0.1114,"triage_quality":1.0,"scope_breadth":0.5524,"crowding_per_asset_month":4.6333,"slop_risk":0.183},"score":{"total":47.0,"parts":{"novelty":0.242,"inverse_crowd":0.137,"payout_reliability":1.0,"value_per_competition":0.111,"triage_quality":1.0,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":71.0},"reasons":[{"sign":"good","text":"paid $393k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"417 reports in 90 days across 30 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.8 years"}]},{"id":"hackerone:lyst","platform":"hackerone","slug":"lyst","name":"Lyst","url":"https://hackerone.com/lyst","meta":{"reward_min":100,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-02-13T10:02:38.530Z","age_months":116.18286463944978,"reports_90d":26,"resolved_total":102,"response_efficiency":78,"response_indicator":"ok","paid_total":34550,"paid_90d":600,"last_resolved_at":"2026-09-18T14:41:12.261Z","days_since_resolved":32.12249650260417,"avg_bounty_low":150,"avg_bounty_high":150,"min_bounty":100,"scope_count":8},"scope":[{"asset":"*.lyst.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.lyst.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.lystit.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"597940518","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"cdna.lystit.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.lyst.lystapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"mobileapi.lystit.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"78% response, pays, last resolved 32d ago"},"slop":{"risk":0.049,"label":"none","experimental":true}},"derived":{"novelty":0.1487,"inverse_crowd":0.476,"payout_reliability":0.83,"value_per_competition":0.2432,"triage_quality":0.78,"scope_breadth":0.3534,"crowding_per_asset_month":1.0833,"slop_risk":0.049},"score":{"total":46.9,"parts":{"novelty":0.149,"inverse_crowd":0.476,"payout_reliability":0.83,"value_per_competition":0.243,"triage_quality":0.78,"scope_breadth":0.353},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":70.6},"reasons":[{"sign":"good","text":"paid $600 in the last 90 days"},{"sign":"neutral","text":"26 reports in 90 days across 8 assets"},{"sign":"neutral","text":"running 9.7 years"}]},{"id":"hackerone:reddit","platform":"hackerone","slug":"reddit","name":"Reddit","url":"https://hackerone.com/reddit","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-04-14T14:30:19.620Z","age_months":66.20550472995095,"reports_90d":333,"resolved_total":721,"response_efficiency":88,"response_indicator":"ok","paid_total":1131425,"paid_90d":56500,"last_resolved_at":"2026-10-13T21:28:38.228Z","days_since_resolved":6.839557069733796,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":45},"scope":[{"asset":"*.reddit.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"*.redditblog.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"[Non-core asset]"},{"asset":"*.reddithelp.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"[Non-core asset]"},{"asset":"*.redditinc.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"[Non-core asset]\nVendor hosted and managed CMS for corporate / marketing site. It is domain whitelisted for reddit.com functionality so if you can string an attack together with reddit.com then this b"},{"asset":"*.redditmedia.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":"[Non-core asset]"},{"asset":"*.snooguts.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"[Core asset]\nThis is our internal domain for \"intranet\" related services. Accessible to the internet should be either 1) an OAuth proxy that gates access to backend services (SCM, admin tooling, CI/CD"},{"asset":"*.spiketrap.io","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"[Non-core asset]"},{"asset":"Android App","type":"OTHER","bounty":true,"severity":"high","instruction":"[Core asset]"},{"asset":"Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Non-Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nAuthentication / authorization service for reddit.com"},{"asset":"ads.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"amp.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nThis service houses our AMP generated pages for search engine optimization."},{"asset":"api.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nThe Reddit API is used for programmatic access. Please use your own test accounts and do not try to access the private data of other users/mods/admins or Reddit employees. Authentication "},{"asset":"business.reddithelp.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-core asset]\nReddit maintains a SFDC tenant for customer management for our advertisers. SFDC bugs aren't eligible for payout, but misconfigurations that are Reddit's responsibility are."},{"asset":"developers.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"gateway.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nFrontdoor service that handles dispensation to backend microservices. Relies on oauth authentication"},{"asset":"gql.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nGraphQL implementation for Reddit accessing all our internal things requiring OAuth."},{"asset":"iOS App","type":"OTHER","bounty":true,"severity":"high","instruction":"[Core asset]"},{"asset":"m.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nMobile webapp (we call mweb) for Reddit. Use a mobile UA to access."},{"asset":"matrix.redditspace.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"meta-api.reddit.com","type":"URL","bounty":true,"severity":"high","instruction":"[Core asset]\nHouses Reddit's smart contracts based on Ethereum, which is called Community Points and ties in with the Vault functionality within Reddit's official mobile apps."},{"asset":"mod.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nThe Reddit modmail interface is used by moderators to take moderator actions and view reports. Please test against your own subreddits and not those belonging to other users/mods/admins."},{"asset":"new.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nThe Reddit redesign. Follow the same rules as `www.reddit.com`."},{"asset":"redditforbusiness.com","type":"URL","bounty":true,"severity":"medium","instruction":"[Non-core asset]\nThird party hosted CMS platform on WebFlow"},{"asset":"sh.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"strapi.reddit.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nOur streaming api."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 7d ago"},"slop":{"risk":0.107,"label":"none","experimental":true}},"derived":{"novelty":0.1858,"inverse_crowd":0.2529,"payout_reliability":0.9254,"value_per_competition":0.1811,"triage_quality":0.88,"scope_breadth":0.6159,"crowding_per_asset_month":2.4667,"slop_risk":0.107},"score":{"total":46.9,"parts":{"novelty":0.186,"inverse_crowd":0.253,"payout_reliability":0.925,"value_per_competition":0.181,"triage_quality":0.88,"scope_breadth":0.616},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":70.1},"reasons":[{"sign":"good","text":"paid $56k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"333 reports in 90 days across 45 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.5 years"}]},{"id":"hackerone:exodus","platform":"hackerone","slug":"exodus","name":"Exodus","url":"https://hackerone.com/exodus","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-11-04T17:57:44.434Z","age_months":71.49030022238384,"reports_90d":622,"resolved_total":111,"response_efficiency":97,"response_indicator":"ok","paid_total":165540,"paid_90d":26000,"last_resolved_at":"2026-09-25T09:56:22.030Z","days_since_resolved":25.320300102141204,"avg_bounty_low":400,"avg_bounty_high":500,"min_bounty":100,"scope_count":64},"scope":[{"asset":"*.a.exodus.io","type":"WILDCARD","bounty":true,"severity":"high","instruction":"Everything underneath the `*-s.a.exodus.io` is generally considered our staging environment and is okay/safe for performing simple/basic attack vectors against our wallet and our backends.  Add `-s` t"},{"asset":"*.exodus.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":"This is basically a marketing site while our product API is still pointing to `*.exodus.io`, Some of `exodus.io` subdomains should be redirected to `exodus.com` such as `www.exodus.io`  --> `www.exodu"},{"asset":"*.exodus.io","type":"WILDCARD","bounty":true,"severity":"high","instruction":"Any domains or subdomains underneath exodus.io are considered our public \"face\" of our company, including our website, subdomains, download links, etc.  Please review our policy for things that are co"},{"asset":"Exodus Desktop Wallet","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Desktop Download Link: [Exodus Crypto Wallet](https://exodus.io/download)\n\nThis is the official Exodus Crypto Wallet for the Desktop (Mac/Win/Linux) which itself stores and manages a user's cryptocurr"},{"asset":"Smart Contract: Solana - EQYRmLmkE7G7a2WQyojwrXg4SeguypCdnbm3ecncizsd","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Smart Contract: Solana mainnet - xoUSDq85Rjsb6SbUwJyreFgeWQvxdkT7R3c3g7s6p5Y","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"ctr.a.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"exodus-movement.exodus","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"App Store: [Exodus Crypto Wallet](https://apps.apple.com/us/app/exodus-crypto-wallet/id1414384820)\n\nThis is the official Exodus Crypto Wallet, which itself stores and manages a user's cryptocurrency. "},{"asset":"fiat-p.a.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fiat-prod-fallback.a.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fiat.a.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/ExodusOSS/bytes","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/ExodusOSS/crypto","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/ExodusOSS/hydra","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@exodus/errors","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@exodus/keychain","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@exodus/safe-string","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@exodus/sentry-client","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"kyc.a.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.exodus.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nexotrack-p.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"nexotrack.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pay-admin.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pay.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"turing.exodus.io","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 25d ago"},"slop":{"risk":0.341,"label":"none","experimental":true}},"derived":{"novelty":0.1803,"inverse_crowd":0.1961,"payout_reliability":0.936,"value_per_competition":0.1481,"triage_quality":0.97,"scope_breadth":0.6715,"crowding_per_asset_month":3.2396,"slop_risk":0.341},"score":{"total":46.6,"parts":{"novelty":0.18,"inverse_crowd":0.196,"payout_reliability":0.936,"value_per_competition":0.148,"triage_quality":0.97,"scope_breadth":0.671},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":69.7},"reasons":[{"sign":"good","text":"paid $26k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"622 reports in 90 days across 64 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:wisdomtree","platform":"hackerone","slug":"wisdomtree","name":"WisdomTree, Inc.","url":"https://hackerone.com/wisdomtree","meta":{"reward_min":50,"reward_max":1500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-08-30T16:43:59.285Z","age_months":37.68500139699787,"reports_90d":69,"resolved_total":47,"response_efficiency":94,"response_indicator":"ok","paid_total":147250,"paid_90d":50100,"last_resolved_at":"2026-09-11T05:17:23.817Z","days_since_resolved":39.514029419270834,"avg_bounty_low":1000,"avg_bounty_high":1500,"min_bounty":50,"scope_count":9},"scope":[{"asset":"api.wisdomtreeprimeapp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wisdomtree.wtprime","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.wisdomtree.wtprime","type":"TESTFLIGHT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://app.wisdomtreeconnect.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://app.wisdomtreeconnect.com/api/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://app.wisdomtreeconnect.com/o/token/","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"94% response, pays, last resolved 40d ago"},"slop":{"risk":0.151,"label":"none","experimental":true}},"derived":{"novelty":0.2317,"inverse_crowd":0.2449,"payout_reliability":0.8989,"value_per_competition":0.2077,"triage_quality":0.94,"scope_breadth":0.3704,"crowding_per_asset_month":2.5556,"slop_risk":0.151},"score":{"total":46.5,"parts":{"novelty":0.232,"inverse_crowd":0.245,"payout_reliability":0.899,"value_per_competition":0.208,"triage_quality":0.94,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":69.2},"reasons":[{"sign":"good","text":"paid $50k in the last 90 days"},{"sign":"good","text":"94% response efficiency"},{"sign":"neutral","text":"69 reports in 90 days across 9 assets"},{"sign":"neutral","text":"running 3.1 years"}]},{"id":"hackerone:arkose_labs","platform":"hackerone","slug":"arkose_labs","name":"Arkose Labs","url":"https://hackerone.com/arkose_labs","meta":{"reward_min":50,"reward_max":425,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-01-29T18:10:30.760Z","age_months":32.68918746628071,"reports_90d":76,"resolved_total":52,"response_efficiency":78,"response_indicator":"ok","paid_total":36576,"paid_90d":4760,"last_resolved_at":"2026-07-27T11:39:13.747Z","days_since_resolved":85.24886819241898,"avg_bounty_low":350,"avg_bounty_high":425,"min_bounty":50,"scope_count":17},"scope":[{"asset":"cdn.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"client-api.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"customer-sessions.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"demo.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This web app is mainly a Marketing based site. Vulnerabilities on this asset will be awarded with lower bounties."},{"asset":"iframe.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"portal.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"verify.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.arkoselabs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This website is mainly a Marketing based site. Vulnerabilities on this asset will be awarded with lower bounties."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"78% response, pays, last resolved 85d ago"},"slop":{"risk":0.112,"label":"none","experimental":true}},"derived":{"novelty":0.2449,"inverse_crowd":0.3826,"payout_reliability":0.7676,"value_per_competition":0.2455,"triage_quality":0.78,"scope_breadth":0.4649,"crowding_per_asset_month":1.4902,"slop_risk":0.112},"score":{"total":46.5,"parts":{"novelty":0.245,"inverse_crowd":0.383,"payout_reliability":0.768,"value_per_competition":0.245,"triage_quality":0.78,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":68.8},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"76 reports in 90 days across 17 assets"},{"sign":"neutral","text":"running 2.7 years"}]},{"id":"hackerone:rei_bbp","platform":"hackerone","slug":"rei_bbp","name":"REI BBP","url":"https://hackerone.com/rei_bbp","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-09-11T19:02:58.615Z","age_months":37.28757979459464,"reports_90d":237,"resolved_total":91,"response_efficiency":80,"response_indicator":"ok","paid_total":134257,"paid_90d":3287,"last_resolved_at":"2026-10-19T20:17:45.449Z","days_since_resolved":0.888779048900463,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":33},"scope":[{"asset":"Android & iOS App for REI Customers","type":"OTHER","bounty":true,"severity":"critical","instruction":"To download the app, please visit https://www.rei.com/mobile\n\nWhat it does?\nREI customers can place orders through the app on their smartphone"},{"asset":"Any public cloud resource or infrastructure operated and managed by REI.","type":"OTHER","bounty":true,"severity":"critical","instruction":"* Public cloud storage accounts. (e.g. AWS S3 buckets)\n* Public cloud computer server. (e.g. AWS EC2 instances)"},{"asset":"http://collaboration.rei.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://www.rei.com/learn/expert-advice","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.rei.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rei.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"80% response, paid recently, resolved 1d ago"},"slop":{"risk":0.19,"label":"none","experimental":true}},"derived":{"novelty":0.2327,"inverse_crowd":0.2597,"payout_reliability":0.898,"value_per_competition":0.197,"triage_quality":0.8,"scope_breadth":0.5672,"crowding_per_asset_month":2.3939,"slop_risk":0.19},"score":{"total":46.5,"parts":{"novelty":0.233,"inverse_crowd":0.26,"payout_reliability":0.898,"value_per_competition":0.197,"triage_quality":0.8,"scope_breadth":0.567},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":68.3},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"80% response efficiency"},{"sign":"neutral","text":"237 reports in 90 days across 33 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.1 years"}]},{"id":"hackerone:whoop_bug_bounty","platform":"hackerone","slug":"whoop_bug_bounty","name":"Whoop Bug Bounty","url":"https://hackerone.com/whoop_bug_bounty","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-02-25T14:26:31.016Z","age_months":19.782593711622557,"reports_90d":102,"resolved_total":51,"response_efficiency":80,"response_indicator":"ok","paid_total":50400,"paid_90d":15550,"last_resolved_at":"2026-09-28T18:25:37.009Z","days_since_resolved":21.966654511863425,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":15},"scope":[{"asset":"WHOOP 4.0 STRAP","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"WHOOP 5.0/MG STRAP","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.prod.whoop.com","type":"URL","bounty":true,"severity":"critical","instruction":"Destructive actions are prohibited. We will verify if a destructive action is possible. If you delete data or impact a user’s experience we will consider this as a destructive action. \n\nThis is the AP"},{"asset":"app.whoop.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.whoop.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.whoop.iphone","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"join.whoop.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"shop.whoop.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"80% response, paid recently, resolved 22d ago"},"slop":{"risk":0.162,"label":"none","experimental":true}},"derived":{"novelty":0.2971,"inverse_crowd":0.2725,"payout_reliability":0.8567,"value_per_competition":0.1922,"triage_quality":0.8,"scope_breadth":0.446,"crowding_per_asset_month":2.2667,"slop_risk":0.162},"score":{"total":46.4,"parts":{"novelty":0.297,"inverse_crowd":0.273,"payout_reliability":0.857,"value_per_competition":0.192,"triage_quality":0.8,"scope_breadth":0.446},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":67.9},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"good","text":"80% response efficiency"},{"sign":"neutral","text":"102 reports in 90 days across 15 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.6 years"}]},{"id":"hackerone:superhuman","platform":"hackerone","slug":"superhuman","name":"Superhuman (formerly Grammarly)","url":"https://hackerone.com/superhuman","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-12-11T14:55:32.974Z","age_months":94.29527834239295,"reports_90d":961,"resolved_total":455,"response_efficiency":90,"response_indicator":"ok","paid_total":1054406,"paid_90d":59484,"last_resolved_at":"2026-09-21T09:45:58.508Z","days_since_resolved":29.327516791956022,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":118},"scope":[{"asset":"*.coda.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grammarly.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grammarly.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.grammarlyaws.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.superhuman.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All subdomains of Superhuman.com - third party saas domains are excluded."},{"asset":"Capture the Flag","type":"OTHER","bounty":true,"severity":"critical","instruction":"The first hacker who reports the `$FLAG` saved in the document (`document_id: 1198436185`) of the user `h1_ctf@grammarly.com` (`user_id: 1411519194`) will be awarded a **$100K bounty**."},{"asset":"Coda Chrome Extension","type":"OTHER","bounty":true,"severity":"high","instruction":null},{"asset":"Grammarly Browser Extensions","type":"OTHER","bounty":true,"severity":"critical","instruction":"The extension is available in the extension/add-on store of the respective browser: \n* [Chrome](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioakkpcpgfkobkghlhen?hl=en) \n"},{"asset":"Grammarly Desktop for Windows","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"https://download-windows.grammarly.com/GrammarlyInstaller.exe"},{"asset":"Grammarly Desktop for macOS","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"https://download-mac.grammarly.com/Grammarly.dmg"},{"asset":"Superhuman Go","type":"OTHER","bounty":true,"severity":"critical","instruction":"Superhuman Go is a proactive AI assistant that integrates with 100+ apps to coordinate agents and provide context-aware help across your workflow. It works in every tab where you work.\n[Superhuman Go "},{"asset":"Superhuman Mail Chrome Extension","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Superhuman Mail Desktop App","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"coda.grammarly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"coda.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"codacontent.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"codahosted.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.grammarly.android.keyboard","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Grammarly for Android](https://www.grammarly.com/mobile/android).\n\nVulnerabilities with PoC may qualify for additional bounty via [Google Play Security Rewards Program](https://hackerone.com/googlepl"},{"asset":"com.grammarly.keyboard","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Grammarly for iOS](https://www.grammarly.com/mobile/ios)"},{"asset":"com.superhuman.mail","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Superhuman Mail Android app\nhttps://play.google.com/store/apps/details?id=com.superhuman.mail&hl=en"},{"asset":"com.superhuman.mail ","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Superhuman Mail iOS app\nhttps://apps.apple.com/us/app/superhuman-mail/id1120837655"},{"asset":"docs.superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gateway.superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id.superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"io.coda","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"io.coda.codaapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"mail.superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"settings.superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"superhuman.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"90% response, paid recently, resolved 29d ago"},"slop":{"risk":0.182,"label":"none","experimental":true}},"derived":{"novelty":0.1616,"inverse_crowd":0.2318,"payout_reliability":0.8944,"value_per_competition":0.169,"triage_quality":0.9,"scope_breadth":0.7688,"crowding_per_asset_month":2.7147,"slop_risk":0.182},"score":{"total":46.3,"parts":{"novelty":0.162,"inverse_crowd":0.232,"payout_reliability":0.894,"value_per_competition":0.169,"triage_quality":0.9,"scope_breadth":0.769},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":67.4},"reasons":[{"sign":"good","text":"paid $59k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"961 reports in 90 days across 118 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 7.9 years"}]},{"id":"hackerone:toolsforhumanity","platform":"hackerone","slug":"toolsforhumanity","name":"Tools for Humanity","url":"https://hackerone.com/toolsforhumanity","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-02-16T14:11:59.983Z","age_months":32.10325347015932,"reports_90d":576,"resolved_total":168,"response_efficiency":94,"response_indicator":"ok","paid_total":149776,"paid_90d":13950,"last_resolved_at":"2026-10-15T23:26:51.660Z","days_since_resolved":4.757457162326389,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":100,"scope_count":42},"scope":[{"asset":"*.consumer.worldcoin.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorld App backend. TFH-owned asset"},{"asset":"*.toolsforhumanity.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nTFH-owned asset"},{"asset":"*.worldcoin-distributors.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorldcoin Foundation-owned asset"},{"asset":"*.worldcoin.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorldcoin Foundation-owned asset"},{"asset":"*.worldcoin.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorldcoin Foundation-owned asset"},{"asset":"Primary Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Secondary Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.worldcoin.org","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Asset**\n\nWorldcoin Foundation-owned asset"},{"asset":"https://apps.apple.com/no/app/world-app-worldcoin-wallet/id1560859847","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"**Primary Asset**\n\nTFH-owned asset"},{"asset":"https://docs.world.org/world-chain/reference/address-book","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":"**Primary Asset**\n\nWorldcoin Foundation-owned asset.\n\nSmart contracts listed in this page are within scope for our program."},{"asset":"https://github.com/worldcoin","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorldcoin Foundation-owned asset"},{"asset":"https://github.com/worldcoin/orb-core","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Primary Asset**"},{"asset":"https://github.com/worldcoin/orb-firmware","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Primary Asset**"},{"asset":"https://github.com/worldcoin/orb-messages","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Secondary Asset**"},{"asset":"https://github.com/worldcoin/orb-relay-messages","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Secondary Asset**"},{"asset":"https://github.com/worldcoin/orb-rustzone","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Primary Asset**"},{"asset":"https://github.com/worldcoin/orb-secure-element","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Primary Asset**"},{"asset":"https://github.com/worldcoin/orb-software","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Primary Asset**"},{"asset":"https://play.google.com/store/apps/details?id=com.worldcoin","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"**Primary Asset**\n\nWorld App for Android. TFH-owned asset"},{"asset":"toolsforhumanity.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nTFH-owned asset"},{"asset":"world.org","type":"URL","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorld Foundation-owned asset"},{"asset":"worldcoin.org","type":"URL","bounty":true,"severity":"critical","instruction":"**Secondary Asset**\n\nWorldcoin Foundation-owned asset"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"94% response, paid recently, resolved 5d ago"},"slop":{"risk":0.302,"label":"none","experimental":true}},"derived":{"novelty":0.2466,"inverse_crowd":0.139,"payout_reliability":0.9597,"value_per_competition":0.1127,"triage_quality":0.94,"scope_breadth":0.605,"crowding_per_asset_month":4.5714,"slop_risk":0.302},"score":{"total":46.0,"parts":{"novelty":0.247,"inverse_crowd":0.139,"payout_reliability":0.96,"value_per_competition":0.113,"triage_quality":0.94,"scope_breadth":0.605},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":67.0},"reasons":[{"sign":"good","text":"paid $14k in the last 90 days"},{"sign":"good","text":"94% response efficiency"},{"sign":"neutral","text":"576 reports in 90 days across 42 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.7 years"}]},{"id":"hackerone:semrush","platform":"hackerone","slug":"semrush","name":"Semrush","url":"https://hackerone.com/semrush","meta":{"reward_min":100,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-10-31T10:16:03.014Z","age_months":107.64046427288197,"reports_90d":270,"resolved_total":848,"response_efficiency":100,"response_indicator":"ok","paid_total":430000,"paid_90d":50000,"last_resolved_at":"2026-10-20T14:32:05.599Z","days_since_resolved":0.12882360908564813,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":100,"scope_count":26},"scope":[{"asset":"*.berush.com","type":"WILDCARD","bounty":false,"severity":"high","instruction":"Registration is stopped at the moment."},{"asset":"*.myinsights.io","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.prowly.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.scatec.io","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.sellzone.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.semrush.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.semrush.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.seoab.io","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"*.seoquake.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":null},{"asset":"Leaked/Сompromised Employee accounts","type":"OTHER","bounty":true,"severity":"medium","instruction":"Please review the program policy on this scope before submitting your report."},{"asset":"Other Semrush Related Asset","type":"OTHER","bounty":true,"severity":"critical","instruction":"Please use this Asset tag for any High and Critical report that does not relate directly to another Semrush asset listed in scope, and is also NOT listed under the \"Out of Scope\" section.\nPlease note,"},{"asset":"investors.semrush.com","type":"URL","bounty":false,"severity":"medium","instruction":null},{"asset":"workflows.semrush.com","type":"URL","bounty":false,"severity":"medium","instruction":null},{"asset":"www.semrush.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 0d ago"},"slop":{"risk":0.137,"label":"none","experimental":true}},"derived":{"novelty":0.1533,"inverse_crowd":0.1839,"payout_reliability":0.9997,"value_per_competition":0.1136,"triage_quality":1.0,"scope_breadth":0.5302,"crowding_per_asset_month":3.4615,"slop_risk":0.137},"score":{"total":45.9,"parts":{"novelty":0.153,"inverse_crowd":0.184,"payout_reliability":1.0,"value_per_competition":0.114,"triage_quality":1.0,"scope_breadth":0.53},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":66.5},"reasons":[{"sign":"good","text":"paid $50k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"270 reports in 90 days across 26 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.0 years"}]},{"id":"hackerone:eternal","platform":"hackerone","slug":"eternal","name":"Eternal","url":"https://hackerone.com/eternal","meta":{"reward_min":50,"reward_max":285,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-02-04T11:58:25.728Z","age_months":128.5005514605008,"reports_90d":736,"resolved_total":1298,"response_efficiency":100,"response_indicator":"ok","paid_total":521149,"paid_90d":36372,"last_resolved_at":"2026-10-19T07:15:24.013Z","days_since_resolved":1.4320827063078705,"avg_bounty_low":200,"avg_bounty_high":285,"min_bounty":50,"scope_count":57},"scope":[{"asset":"*.district.in","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.edition.in","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.eternal.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hyperpure.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.insider.in","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.runnr.in","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ticketnew.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tktnew.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.zdev.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.zomans.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This domain is mainly used for internal applications that are hosted in AWS. Our area of interest is any issue that can potentially give anyone unrestricted access or expose internal or confidential d"},{"asset":"*.zomato.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"434613896","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Zomato: Food Delivery & Dining"},{"asset":"6670203019","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Bistro by Blinkit: A mobile app offering instant food delivery\n\nhttps://apps.apple.com/in/app/bistro-food-in-minutes/id6670203019"},{"asset":"6670536058","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"District by Zomato: an app for movies, events, dining out bookings.\n\nhttps://apps.apple.com/in/app/district-movies-events-dining/id6670536058"},{"asset":"960335206","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Blinkit iOS App\n\nhttps://apps.apple.com/th/app/blinkit-grocery-in-10-minutes/id960335206"},{"asset":"All Assets (other than Blinkit)","type":"OTHER","bounty":true,"severity":"critical","instruction":"Bounty table header"},{"asset":"Data Protection Program","type":"OTHER","bounty":true,"severity":"critical","instruction":"For more information on what is and isn’t allowed, refer to the Program Policy."},{"asset":"Scope Questions: Items not explicitly listed here","type":"OTHER","bounty":false,"severity":"critical","instruction":"If you have a question about something that is not explicitly listed as out-of-scope or in-scope, please submit a report and we will provide clarification. We will allow you to self close that report "},{"asset":"Tier 1","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 2","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.grofers.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api2.grofers.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bistro-api.blinkit.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"blinkit.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.application.zomato","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.application.zomato.district","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"District by Zomato: an app for movies, events, dining out bookings.\n\nhttps://play.google.com/store/apps/details?id=com.application.zomato.district&hl=en_IN"},{"asset":"com.application.zomatomerchant","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":null},{"asset":"com.blinkit.bistro","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Bistro by Blinkit: A mobile app offering instant food delivery\n\nhttps://play.google.com/store/apps/details?id=com.blinkit.bistro"},{"asset":"com.grofers.customerapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Blinkit's Customer Android App:\nhttps://play.google.com/store/apps/details?id=com.grofers.customerapp"},{"asset":"http://*.grofer.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"http://*.grofers.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://mcp-server.zomato.com/mcp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"winecellar.zomato.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 1d ago"},"slop":{"risk":0.178,"label":"none","experimental":true}},"derived":{"novelty":0.1429,"inverse_crowd":0.1479,"payout_reliability":0.9968,"value_per_competition":0.1077,"triage_quality":1.0,"scope_breadth":0.6532,"crowding_per_asset_month":4.3041,"slop_risk":0.178},"score":{"total":45.6,"parts":{"novelty":0.143,"inverse_crowd":0.148,"payout_reliability":0.997,"value_per_competition":0.108,"triage_quality":1.0,"scope_breadth":0.653},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":66.1},"reasons":[{"sign":"good","text":"paid $36k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"736 reports in 90 days across 57 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.7 years"}]},{"id":"hackerone:bybit_fintech","platform":"hackerone","slug":"bybit_fintech","name":"Bybit Fintech Ltd","url":"https://hackerone.com/bybit_fintech","meta":{"reward_min":50,"reward_max":693,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-11-14T06:58:14.154Z","age_months":35.20144566310175,"reports_90d":94,"resolved_total":118,"response_efficiency":85,"response_indicator":"ok","paid_total":110025,"paid_90d":25064,"last_resolved_at":"2026-10-08T07:49:44.707Z","days_since_resolved":12.408232081307869,"avg_bounty_low":505,"avg_bounty_high":693,"min_bounty":50,"scope_count":12},"scope":[{"asset":"*.bybit.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.bybit.eu","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.bybit.tr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"http://testnet.bybit.eu","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://www.bybit.com/en/alpha/overview/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://www.bybit.com/trade/tradfi/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://www.byreal.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/bybit-app/id1488296980","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.bybit.app&hl=en","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"85% response, paid recently, resolved 12d ago"},"slop":{"risk":0.126,"label":"none","experimental":true}},"derived":{"novelty":0.238,"inverse_crowd":0.2402,"payout_reliability":0.8992,"value_per_competition":0.1829,"triage_quality":0.85,"scope_breadth":0.4126,"crowding_per_asset_month":2.6111,"slop_risk":0.126},"score":{"total":45.5,"parts":{"novelty":0.238,"inverse_crowd":0.24,"payout_reliability":0.899,"value_per_competition":0.183,"triage_quality":0.85,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":65.6},"reasons":[{"sign":"good","text":"paid $25k in the last 90 days"},{"sign":"good","text":"85% response efficiency"},{"sign":"neutral","text":"94 reports in 90 days across 12 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.9 years"}]},{"id":"hackerone:netflix","platform":"hackerone","slug":"netflix","name":"Netflix","url":"https://hackerone.com/netflix","meta":{"reward_min":50,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-21T15:50:57.572Z","age_months":28.979845762729102,"reports_90d":712,"resolved_total":2991,"response_efficiency":88,"response_indicator":"ok","paid_total":384938,"paid_90d":35200,"last_resolved_at":"2026-10-20T00:01:37.995Z","days_since_resolved":0.7333097664930556,"avg_bounty_low":600,"avg_bounty_high":600,"min_bounty":50,"scope_count":49},"scope":[{"asset":"*.nflxext.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nStatic content is served over this domain"},{"asset":"*.nflximg.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nStatic content is served over this domain"},{"asset":"*.nflxso.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nStatic content is served over this domain"},{"asset":"*.nflxvideo.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.prod.cloud.netflix.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nThe primary Netflix experience is driven by microservices that are hosted and called through our API.\n\nYou may see the API referenced as `api*.netflix.com` as well as `www.netflix.c"},{"asset":"*.prod.dradis.netflix.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nThe primary Netflix experience is driven by microservices that are hosted and called through our API. \n\nYou may see the API referenced as` api*.netflix.com` as well as `www.netflix."},{"asset":"*.prod.ftl.netflix.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nThe primary Netflix experience is driven by microservices that are hosted and called through our API. \n\nYou may see the API referenced as` api*.netflix.com` as well as `www.netflix."},{"asset":"Affiliates or entities such as recently acquired companies","type":"OTHER","bounty":false,"severity":"critical","instruction":"**Non-Rewardable**"},{"asset":"Content Authorization Targets","type":"OTHER","bounty":true,"severity":"critical","instruction":"**Device & Content Authorization Findings**\n\nHigh severity targets include methods of subverting content authorization or obtaining private keys. Medium severity targets include leaked private keys fo"},{"asset":"Content authorization vulnerabilities affecting only the in-browser player","type":"OTHER","bounty":false,"severity":"critical","instruction":"**Non-Rewardable**"},{"asset":"Corporate Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":"** Netflix.com Google G suite **\n**For targets listed in the \"Corporate Targets Overview\" section, we only reward for the bugs that are critical or High based on the CVSS.** \n\n- We do accept submissio"},{"asset":"Low impact, individually exposed Google Docs with no common root cause (see “Publicly accessible Google Document or Drive Links” in the “Corporate Targets” section)","type":"OTHER","bounty":false,"severity":"critical","instruction":"**Non-Rewardable**"},{"asset":"Microsites","type":"OTHER","bounty":true,"severity":"critical","instruction":"## Secondary Target\nMicrosites are sites that Netflix typically publishes for promotion or in support of Netflix titles.\nNot all microsites are hosted by Netflix. Some are hosted by vendors or partner"},{"asset":"Netflix Gaming Target","type":"OTHER","bounty":false,"severity":"critical","instruction":"**Non-Rewardable**"},{"asset":"Netflix Mobile Application for Android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"## Mobile target\n**App Id on play store - com.netflix.mediaclient**\nWe only accept Critical and High-level vulnerabilities in the apps"},{"asset":"Netflix Mobile Application for iOS","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"## Mobile target\n**App ID on app store - 363590051**\nWe only accept Critical and High-level vulnerabilities in the apps"},{"asset":"Open Source - Atlas","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"## https://github.com/Netflix/atlas\n**Secondary Target**"},{"asset":"Open Source - Spectator","type":"OTHER","bounty":true,"severity":"critical","instruction":"## https://github.com/Netflix/spectator\n\n**Secondary Target**"},{"asset":"Open Source - Zuul","type":"OTHER","bounty":true,"severity":"critical","instruction":"## https://github.com/Netflix/zuul\n\n**Primary Target**"},{"asset":"Secondary Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api*.netflix.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Primary Target**\nThe primary Netflix experience is driven by microservices that are hosted and called through our API. \n\nYou may see the API referenced as` api*.netflix.com` as well as `www.netflix."},{"asset":"beacon.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\nBeacon is a logging endpoint used to collect client information from member's browsers and streaming devices."},{"asset":"customerevents.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\n`customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. \n\nSubmissions containing variations of the URL "},{"asset":"help.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\nOur help site provides a knowledge base and customer service chat"},{"asset":"ichnaea.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\nIchanaea is a logging endpoint used to collect client information"},{"asset":"meechum.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\nNetflix partner page"},{"asset":"nmtracking.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\n`customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. \n\nSubmissions containing variations of the URL "},{"asset":"presentationtracking.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\n`customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. \n\nSubmissions containing variations of the URL "},{"asset":"secure.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Primary Target**\nSecure static assets are hosted on this domain"},{"asset":"www.netflix.com","type":"URL","bounty":true,"severity":"critical","instruction":"## Primary Target\nThe primary Netflix experience is hosted on this top level domain. The UI uses a combination of React JS and Node."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 1d ago"},"slop":{"risk":0.184,"label":"none","experimental":true}},"derived":{"novelty":0.2566,"inverse_crowd":0.1309,"payout_reliability":0.9384,"value_per_competition":0.1106,"triage_quality":0.88,"scope_breadth":0.6293,"crowding_per_asset_month":4.8435,"slop_risk":0.184},"score":{"total":45.0,"parts":{"novelty":0.257,"inverse_crowd":0.131,"payout_reliability":0.938,"value_per_competition":0.111,"triage_quality":0.88,"scope_breadth":0.629},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":65.2},"reasons":[{"sign":"good","text":"paid $35k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"712 reports in 90 days across 49 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.4 years"}]},{"id":"hackerone:robinhood","platform":"hackerone","slug":"robinhood","name":"Robinhood Markets Bounty","url":"https://hackerone.com/robinhood","meta":{"reward_min":50,"reward_max":1620,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-10-18T12:41:48.676Z","age_months":12.064243396009202,"reports_90d":182,"resolved_total":148,"response_efficiency":68,"response_indicator":"missed","paid_total":460000,"paid_90d":85000,"last_resolved_at":"2026-09-21T22:19:31.087Z","days_since_resolved":28.80422305353009,"avg_bounty_low":1000,"avg_bounty_high":1620,"min_bounty":50,"scope_count":76},"scope":[{"asset":"*.rhinternal.net","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.robinhood.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.robinhood.net","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.say.rocks","type":"OTHER","bounty":true,"severity":"medium","instruction":null},{"asset":"*.saytechnologies.com","type":"OTHER","bounty":true,"severity":"medium","instruction":null},{"asset":"1634080733","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"6462308655","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"938003185","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"Id1406825640","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Bitstamp iOS application"},{"asset":"Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.robinhood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cashier.robinhood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.robinhood.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.robinhood.gateway","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.robinhood.global Android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.robinhood.money","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"fusion.tradepmr.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"https://*.saytechnologies.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"identi.robinhood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"insight2.tradepmr.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"minerva.robinhood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"net.bitstamp.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Bitstamp Android application"},{"asset":"nummus.robinhood.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.bitstamp.net","type":"URL","bounty":true,"severity":"critical","instruction":"www.bitstamp.net is the main host associated with the Bitstamp website. Subdomains are in Tier 3."},{"asset":"www.tradepmr.com","type":"URL","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.078,"label":"none","experimental":true}},"derived":{"novelty":0.3577,"inverse_crowd":0.5672,"payout_reliability":0.7852,"value_per_competition":0.415,"triage_quality":0.51,"scope_breadth":0.6987,"crowding_per_asset_month":0.7982,"slop_risk":0.078},"score":{"total":44.8,"parts":{"novelty":0.358,"inverse_crowd":0.567,"payout_reliability":0.785,"value_per_competition":0.415,"triage_quality":0.51,"scope_breadth":0.699},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":64.7},"reasons":[{"sign":"good","text":"paid $85k in the last 90 days"},{"sign":"neutral","text":"182 reports in 90 days across 76 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.0 years"}]},{"id":"hackerone:kubernetes","platform":"hackerone","slug":"kubernetes","name":"Kubernetes","url":"https://hackerone.com/kubernetes","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-01-14T16:46:23.383Z","age_months":81.18391990867177,"reports_90d":718,"resolved_total":143,"response_efficiency":77,"response_indicator":"ok","paid_total":113100,"paid_90d":1400,"last_resolved_at":"2026-10-16T01:03:55.982Z","days_since_resolved":4.69004602806713,"avg_bounty_low":100,"avg_bounty_high":200,"min_bounty":50,"scope_count":95},"scope":[{"asset":"Community Management & Communications","type":"OTHER","bounty":false,"severity":"critical","instruction":"Kubernetes community management & communication tools are currently ineligible for bounty. Please avoid disruptions.\n\nList of ineligible community assets:\n\n- k8s.io event calendar: https://calendar.go"},{"asset":"Tier 1","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 2","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 3","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/kubernetes-csi","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes CSI drivers & infrastructure. Not all repos are eligible for bounty.\n\nEligible for bounty:\n- github.com/kubernetes-csi/external-provisioner\n- github.com/kubernetes-csi/external-snapshotter\n"},{"asset":"github.com/kubernetes-retired","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"The retired projects are no longer maintained"},{"asset":"https://github.com/kubernetes-client","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes client libraries. The stable libraries are eligible for bounty, including:\n- https://github.com/kubernetes-client/python\n- https://github.com/kubernetes-client/java\n\nSupporting libraries ar"},{"asset":"https://github.com/kubernetes-incubator","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"The kubernetes-incubator process is deprecated."},{"asset":"https://github.com/kubernetes-security","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Unauthorized access (read or write) to any repositories under the kubernetes-security github organization is eligible."},{"asset":"https://github.com/kubernetes-sigs","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Unless explicitly listed as an eligible asset, repositories under the kubernetes-sigs github org are not eligible for bounty."},{"asset":"https://github.com/kubernetes/api","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The canonical location of the Kubernetes API definition."},{"asset":"https://github.com/kubernetes/apiextensions-apiserver","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"API server for API extensions like CustomResourceDefinitions"},{"asset":"https://github.com/kubernetes/apimachinery","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/kubernetes/apiserver","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Library for writing a Kubernetes-style API server."},{"asset":"https://github.com/kubernetes/autoscaler","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Autoscaling components for Kubernetes"},{"asset":"https://github.com/kubernetes/cli-runtime","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Set of helpers for creating kubectl commands and plugins."},{"asset":"https://github.com/kubernetes/client-go","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Go client for Kubernetes."},{"asset":"https://github.com/kubernetes/cloud-provider","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"cloud-provider defines the shared interfaces which Kubernetes cloud providers implement. These interfaces allow various controllers to integrate with any cloud provider in a pluggable fashion. Also se"},{"asset":"https://github.com/kubernetes/cloud-provider-alibaba-cloud","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"CloudProvider for Alibaba Cloud\n\nVendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cloud-provider-aws","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Vendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cloud-provider-azure","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Cloud provider for Azure\n\nVendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cloud-provider-gcp","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Vendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cloud-provider-openstack","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Vendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cloud-provider-sample","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Sample of how to build a cloud provider repo. This will build a Kubernetes image which deploys on bare metal. It uses the fake cloud provider. It consumes the K8s/K8s build artifact and adds to it the"},{"asset":"https://github.com/kubernetes/cloud-provider-vsphere","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Kubernetes Cloud Provider for vSphere (Beta)\n\nVendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/cluster-bootstrap","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/kubernetes/cluster-registry","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Cluster Registry API"},{"asset":"https://github.com/kubernetes/code-generator","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Generators for kube-like API types"},{"asset":"https://github.com/kubernetes/community","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Kubernetes community content"},{"asset":"https://github.com/kubernetes/component-base","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Shared code for kubernetes core components"},{"asset":"https://github.com/kubernetes/cri-api","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Container Runtime Interface (CRI) – a plugin interface which enables kubelet to use a wide variety of container runtimes."},{"asset":"https://github.com/kubernetes/csi-api","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/kubernetes/csi-translation-lib","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Staging repo for CSI Migration/Translation libraries"},{"asset":"https://github.com/kubernetes/dns","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes DNS service"},{"asset":"https://github.com/kubernetes/enhancements","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Features tracking repo for Kubernetes releases"},{"asset":"https://github.com/kubernetes/examples","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Kubernetes application example tutorials"},{"asset":"https://github.com/kubernetes/frakti","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"The hypervisor-based container runtime for Kubernetes.\n\nVendor-specific plugins are not eligible for bounty. We recommend reporting vulnerabilities through the vendor's bug bounty program instead."},{"asset":"https://github.com/kubernetes/funding","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Funding requests for project infrastructure, events, and consulting."},{"asset":"https://github.com/kubernetes/gengo","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Gengo library for code generation."},{"asset":"https://github.com/kubernetes/git-sync","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"A sidecar app which clones a git repo and keeps it in sync with the upstream."},{"asset":"https://github.com/kubernetes/k8s.io","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes files for various *.k8s.io sites"},{"asset":"https://github.com/kubernetes/klog","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Forked from golang/glog\nLeveled execution logs for Go (fork of https://github.com/golang/glog)"},{"asset":"https://github.com/kubernetes/kompose","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Go from Docker Compose to Kubernetes"},{"asset":"https://github.com/kubernetes/kops","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes Operations (kops) - Production Grade K8s Installation, Upgrades, and Management"},{"asset":"https://github.com/kubernetes/kube-aggregator","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Aggregator for Kubernetes-style API servers: dynamic registration, discovery summarization, secure proxy"},{"asset":"https://github.com/kubernetes/kube-controller-manager","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"kube-controller-manager component configs"},{"asset":"https://github.com/kubernetes/kube-deploy","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"A place for cluster deployment automation"},{"asset":"https://github.com/kubernetes/kube-openapi","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes OpenAPI spec generation & serving"},{"asset":"https://github.com/kubernetes/kube-proxy","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"kube-proxy component configs"},{"asset":"https://github.com/kubernetes/kube-scheduler","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"kube-scheduler component configs"},{"asset":"https://github.com/kubernetes/kube-state-metrics","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Add-on agent to generate and expose cluster-level metrics."},{"asset":"https://github.com/kubernetes/kubeadm","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Aggregator for issues filed against kubeadm"},{"asset":"https://github.com/kubernetes/kubectl","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Issue tracker and mirror of kubectl code"},{"asset":"https://github.com/kubernetes/kubelet","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"kubelet component configs"},{"asset":"https://github.com/kubernetes/kubernetes","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Production-Grade Container Scheduling and Management"},{"asset":"https://github.com/kubernetes/kubernetes-anywhere","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"{concise,reliable,cross-platform} turnup of Kubernetes clusters\n\nDEPRECATED"},{"asset":"https://github.com/kubernetes/kubernetes-template-project","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"A template for starting new projects on the github.com/kubernetes organization"},{"asset":"https://github.com/kubernetes/legacy-cloud-providers","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"This repository hosts the legacy in-tree cloud providers. Out-of-tree cloud providers can consume packages in this repo to support legacy implementations of their Kubernetes cloud provider.\n\nVendor-sp"},{"asset":"https://github.com/kubernetes/metrics","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes metrics-related API types and clients"},{"asset":"https://github.com/kubernetes/minikube","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Run Kubernetes locally"},{"asset":"https://github.com/kubernetes/node-api","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/kubernetes/node-problem-detector","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"This is a place for various problem detectors running on the Kubernetes nodes."},{"asset":"https://github.com/kubernetes/org","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Meta configuration for Kubernetes Github Org"},{"asset":"https://github.com/kubernetes/perf-tests","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Performance tests and benchmarks"},{"asset":"https://github.com/kubernetes/publishing-bot","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Code behind the robot to publish from staging to real repositories."},{"asset":"https://github.com/kubernetes/release","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Release infrastructure for Kubernetes and related components"},{"asset":"https://github.com/kubernetes/repo-infra","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes repository infrastucture tools"},{"asset":"https://github.com/kubernetes/sample-apiserver","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Reference implementation of an apiserver for a custom Kubernetes API.\n\nExample code."},{"asset":"https://github.com/kubernetes/sample-cli-plugin","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Sample kubectl plugin"},{"asset":"https://github.com/kubernetes/sample-controller","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Repository for sample controller. Complements sample-apiserver"},{"asset":"https://github.com/kubernetes/security","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"Kubernetes Security Process and Security Committee docs"},{"asset":"https://github.com/kubernetes/sig-release","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Repo for SIG release"},{"asset":"https://github.com/kubernetes/steering","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"The Kubernetes Steering Committee"},{"asset":"https://github.com/kubernetes/test-infra","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Test infrastructure for the Kubernetes project."},{"asset":"https://github.com/kubernetes/utils","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Non-Kubernetes-specific utility libraries which are consumed by multiple projects."},{"asset":"https://github.com/kubernetes/website","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Kubernetes website and documentation repo:"},{"asset":"https://storage.googleapis.com/kubernetes-release/","type":"OTHER","bounty":true,"severity":"critical","instruction":"Kubernetes release artifacts download server.\n\nWrite access or modification of assets are eligible for bounty. Please DO NOT modify production artifacts. If you need a test target, you can use a test "},{"asset":"k8s.gcr.io","type":"OTHER","bounty":true,"severity":"critical","instruction":"Our official container repository (an alias to gcr.io/google-containers).\n\nThe ability to write to or modify containers in the repository are in scope. Please DO NOT modify production containers. If y"},{"asset":"k8s.io","type":"URL","bounty":true,"severity":"critical","instruction":"Kubernetes nginx server."},{"asset":"kubernetes-csi.github.io","type":"URL","bounty":true,"severity":"critical","instruction":"Kubernetes CSI documentation site."},{"asset":"kubernetes.io","type":"URL","bounty":true,"severity":"critical","instruction":"Main kubernetes website, hosted by netlify."},{"asset":"prow.k8s.io","type":"URL","bounty":true,"severity":"critical","instruction":"Kubernetes build & test infrastructure.\n\nPlease limit automated scanning to 1qps."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"77% response, pays"},"slop":{"risk":0.292,"label":"none","experimental":true}},"derived":{"novelty":0.1714,"inverse_crowd":0.2481,"payout_reliability":0.8748,"value_per_competition":0.1522,"triage_quality":0.77,"scope_breadth":0.7342,"crowding_per_asset_month":2.5193,"slop_risk":0.292},"score":{"total":44.5,"parts":{"novelty":0.171,"inverse_crowd":0.248,"payout_reliability":0.875,"value_per_competition":0.152,"triage_quality":0.77,"scope_breadth":0.734},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":64.3},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"neutral","text":"718 reports in 90 days across 95 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.8 years"}]},{"id":"hackerone:3cx","platform":"hackerone","slug":"3cx","name":"3CX","url":"https://hackerone.com/3cx","meta":{"reward_min":50,"reward_max":350,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-10-04T09:42:09.593Z","age_months":24.520087598229903,"reports_90d":444,"resolved_total":67,"response_efficiency":97,"response_indicator":"ok","paid_total":65254,"paid_90d":18200,"last_resolved_at":"2026-10-19T07:06:27.904Z","days_since_resolved":1.438287671585648,"avg_bounty_low":200,"avg_bounty_high":350,"min_bounty":50,"scope_count":18},"scope":[{"asset":"3CX Live chat WordPress plugin","type":"OTHER","bounty":true,"severity":"medium","instruction":"This is a plugin that integrates 3CX Livechat into a WordPress site. A 3CX installation is required (On Premise or in the Cloud).\n\nLink to the plugin: https://wordpress.org/plugins/wp-live-chat-suppor"},{"asset":"3CX Phone System","type":"OTHER","bounty":true,"severity":"critical","instruction":"1. Register on www.3cx.com using your **hackerone email address**. Confirm your email and follow the wizard to select a deployment type. (Please refer to our documentation for more information about e"},{"asset":"3CX SBC","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"1. 3CX SBC requires an existing installation of 3CX Server. \n\n2. Use the following ISO instead to deploy 3CX SBC on-premise: https://downloads-global.3cx.com/downloads/debian12iso/debian-amd64-netinst"},{"asset":"Other","type":"OTHER","bounty":false,"severity":"none","instruction":null},{"asset":"activate.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX to activate the product."},{"asset":"downloads-global.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX (and other services) to download various packages and files. \n\nIt contains sample configuration files which are commonly miscategorized as findings by researchers."},{"asset":"https://apps.apple.com/us/app/3cx/id992045982","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension'"},{"asset":"https://apps.microsoft.com/detail/3cx/9NW77489NGJ0","type":"WINDOWS_APP_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The 3CX softphone app for Windows allows you to make calls, view the status of colleagues, chat, schedule a video conference and check voicemail from your desktop"},{"asset":"https://play.google.com/store/apps/details?id=com.tcx.sipphone14","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension'"},{"asset":"https://portal.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the portal where customers and partners can manage their 3CX account/license keys."},{"asset":"mailproxy.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX to send out emails."},{"asset":"repo.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX to download Debian packages."},{"asset":"rps.3cx.com","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX for the provisioning of remote IP  phones."},{"asset":"wmr.3cx.net","type":"URL","bounty":true,"severity":"critical","instruction":"Endpoint used by the 3CX PBX for the Webmeeting and transcription services."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 1d ago"},"slop":{"risk":0.561,"label":"watch","experimental":true}},"derived":{"novelty":0.2737,"inverse_crowd":0.0739,"payout_reliability":0.9818,"value_per_competition":0.0642,"triage_quality":0.97,"scope_breadth":0.4736,"crowding_per_asset_month":8.2222,"slop_risk":0.561},"score":{"total":44.3,"parts":{"novelty":0.274,"inverse_crowd":0.074,"payout_reliability":0.982,"value_per_competition":0.064,"triage_quality":0.97,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":63.8},"reasons":[{"sign":"good","text":"paid $18k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"444 reports in 90 days across 18 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.0 years"}]},{"id":"hackerone:urbancompany","platform":"hackerone","slug":"urbancompany","name":"Urban Company","url":"https://hackerone.com/urbancompany","meta":{"reward_min":200,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-06-21T04:35:34.066Z","age_months":63.98498817127729,"reports_90d":62,"resolved_total":214,"response_efficiency":95,"response_indicator":"ok","paid_total":92450,"paid_90d":3600,"last_resolved_at":"2026-08-14T10:45:11.326Z","days_since_resolved":67.28639621325232,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":200,"scope_count":8},"scope":[{"asset":"1032480595","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This is our customer iOS apps"},{"asset":"982922982","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This is our professional ios app."},{"asset":"com.urbanclap.provider","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is our partner android app."},{"asset":"com.urbanclap.urbanclap","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is our customer app."},{"asset":"www.urbanclap.com","type":"URL","bounty":true,"severity":"critical","instruction":"www.urbanclap.com is also our root and critical domain. Most of our traffic routes through it."},{"asset":"www.urbancompany.com","type":"URL","bounty":true,"severity":"critical","instruction":"www.urbancompany.com is our main and critical domain. Most of our traffic routes through urbanclap.com. Other subdomains mentioned in scope are for internal purpose and either are password protected o"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"95% response, pays, last resolved 67d ago"},"slop":{"risk":0.105,"label":"none","experimental":true}},"derived":{"novelty":0.1883,"inverse_crowd":0.2425,"payout_reliability":0.8697,"value_per_competition":0.1557,"triage_quality":0.95,"scope_breadth":0.3534,"crowding_per_asset_month":2.5833,"slop_risk":0.105},"score":{"total":44.0,"parts":{"novelty":0.188,"inverse_crowd":0.243,"payout_reliability":0.87,"value_per_competition":0.156,"triage_quality":0.95,"scope_breadth":0.353},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":63.3},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"95% response efficiency"},{"sign":"neutral","text":"62 reports in 90 days across 8 assets"},{"sign":"neutral","text":"running 5.3 years"}]},{"id":"hackerone:forescout_technologies","platform":"hackerone","slug":"forescout_technologies","name":"ForeScout Technologies","url":"https://hackerone.com/forescout_technologies","meta":{"reward_min":100,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-07-31T15:32:09.533Z","age_months":86.67226649396342,"reports_90d":46,"resolved_total":99,"response_efficiency":66,"response_indicator":"missed","paid_total":117600,"paid_90d":0,"last_resolved_at":"2026-06-10T16:02:08.943Z","days_since_resolved":132.06628490538193,"avg_bounty_low":600,"avg_bounty_high":1000,"min_bounty":100,"scope_count":157},"scope":[{"asset":"194.90.151.192/28","type":"CIDR","bounty":true,"severity":"critical","instruction":"Please do not bombard these sites while testing. Be gentle."},{"asset":"194.90.25.80/29","type":"CIDR","bounty":true,"severity":"critical","instruction":"Please be careful when testing these sites to not bombard them. Be gentle."},{"asset":"194.90.89.165/32","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"212.143.112.81/29","type":"CIDR","bounty":true,"severity":"critical","instruction":"Please be gentle when testing these sites. Do not bombard them."},{"asset":"38.140.238.56/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"64.47.18.80/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"64.84.60.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"97.105.243.96/28","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"CounterAct 9.x","type":"HARDWARE","bounty":true,"severity":"high","instruction":null},{"asset":"ab2b0c50cdc7b445391f99d4957850c5-cd4ccfdb37dfafad.elb.us-east-1.amazonaws.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aebddc74953f248bc8455665b0f7d47b-78af959a11e5d0c1.elb.us-east-1.amazonaws.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cloud.forescout.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"community.forescout.com","type":"URL","bounty":true,"severity":"critical","instruction":"Community Support Login"},{"asset":"datapod-1-100-druid-ingest.development.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":"*New Host Added on 3/12/2010\n** Naming convention is datapod-[1-100]-druid-ingest.development.forescoutcloud.net\n** Example: datapod-1-druid-ingest.development.forescoutcloud.net\n** Example: datapod-1"},{"asset":"datapod-1-100-druid-ingest.testing.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":"* Expanded Datapod Host Range to 100 nodes\n** Naming convention is datapod-[1-100]-druid-ingest.development.forescoutcloud.net\n** Example: datapod-1-druid-ingest.development.forescoutcloud.net\n** Exam"},{"asset":"datapod-1-100-druid-query.development.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":"** Naming convention is datapod-[1-100]-druid-query.development.forescoutcloud.net\n** Example: datapod-1-druid-query.development.forescoutcloud.net\n** Example: datapod-10-druid-query.development.fores"},{"asset":"datapod-1-100-druid-query.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":"datapod-1-100-druid-query.production.forescoutcloud.net is the range\nex. datapod-1-druid-query.production.forescoutcloud.net\n      datapod-2-druid-query.production.forescoutcloud.net\n      datapod-10-"},{"asset":"datapod-1-druid-ingest.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"datapod-1-ingest.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"datapod-1-query.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"datapod-2-druid-ingest.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"datapod-2-ingest.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"datapod-2-query.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"de.forescout.cloud","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://backend-api.devicecloud.production.forescoutcloud.net/api/v1/settings","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-ingest.production.forescoutcloud.net/v1/upload","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v1/polling","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v1/query/agg","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/deletestatus","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/matrixoverview","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/firstreporttimeentry","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/grouptogroup","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/iplist","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bydst/details","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bysrc","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/overlappinggroups","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/service-list","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v2/services","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v3/matrixoverview","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/overlappingzones","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/zonetozone","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://logstash-props.devicecloud.production.forescoutcloud.net/api/v1/properties","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://mgmtpod-1.production.forescoutcloud.net/oauth/token","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/package","type":"URL","bounty":true,"severity":"critical","instruction":"This asset is currently in Acceptance testing."},{"asset":"https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/polling","type":"URL","bounty":true,"severity":"critical","instruction":"This asset is currently in Acceptance testing."},{"asset":"https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/upload","type":"URL","bounty":true,"severity":"critical","instruction":"This asset is currently in Acceptance Testing."},{"asset":"iris-testing-us-east-1-nlb-4df4bbde6f6e2bbb.elb.us-east-1.amazonaws.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"logstash-props.devicecloud.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":"Please begin testing against this host as soon as possible. We are working through a release cycle and this testing is part of that cycle."},{"asset":"mgmt-sensors.iris.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mgmt-sensors.iris.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mgmtpod-1-dashboard.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mgmtpod-1.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"obs-sensors.iris.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"obs-sensors.iris.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"streaming-api.iris.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"streaming-api.iris.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"streaming-gw.iris.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"streaming.iris.acceptance.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"streaming.iris.production.forescoutcloud.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"uk.forescout.cloud","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"updates.forescout.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"us.forescout.cloud","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.forescout.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the primary www.forescout.com website."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.022,"label":"none","experimental":true}},"derived":{"novelty":0.1671,"inverse_crowd":0.9422,"payout_reliability":0.3761,"value_per_competition":0.6355,"triage_quality":0.495,"scope_breadth":0.8144,"crowding_per_asset_month":0.0977,"slop_risk":0.022},"score":{"total":44.0,"parts":{"novelty":0.167,"inverse_crowd":0.942,"payout_reliability":0.376,"value_per_competition":0.636,"triage_quality":0.495,"scope_breadth":0.814},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":62.9},"reasons":[{"sign":"neutral","text":"46 reports in 90 days across 157 assets"},{"sign":"neutral","text":"running 7.2 years"}]},{"id":"hackerone:snapchat","platform":"hackerone","slug":"snapchat","name":"Snapchat","url":"https://hackerone.com/snapchat","meta":{"reward_min":250,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-04-02T17:17:26.237Z","age_months":138.61236965618107,"reports_90d":518,"resolved_total":730,"response_efficiency":92,"response_indicator":"ok","paid_total":1953481,"paid_90d":175000,"last_resolved_at":"2026-09-28T16:06:08.482Z","days_since_resolved":22.063512463252316,"avg_bounty_low":250,"avg_bounty_high":500,"min_bounty":250,"scope_count":48},"scope":[{"asset":"*.sc-core.net","type":"URL","bounty":true,"severity":"critical","instruction":"Snapchat's internal services"},{"asset":"*.sc-corp.net","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Lens Studio","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"medium","instruction":null},{"asset":"Tier A - Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier B - Non Core (Bitmoji, Playcanvas)","type":"OTHER","bounty":true,"severity":"medium","instruction":null},{"asset":"accounts.snapchat.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nSnapchat's account management website."},{"asset":"ads.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"app.snapchat.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core asset]\nMain server-side application hosted on Google App Engine under the hostname feelinsonice-hrd.appspot.com and app.snapchat.com."},{"asset":"blog.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"business.snapchat.com","type":"URL","bounty":true,"severity":"critical","instruction":"Snapchat's Business Manager."},{"asset":"businesshelp.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"Snapchat's Salesforce instance"},{"asset":"code.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"com.bitstrips.imoji","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"medium","instruction":"[Non-core asset]\n[iOS App Store](https://itunes.apple.com/us/app/bitmoji-keyboard-your-avatar/id868077558)"},{"asset":"com.bitstrips.imoji","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"medium","instruction":"[Non-core asset]\n[Google Play Store](https://play.google.com/store/apps/details?id=com.bitstrips.imoji)"},{"asset":"com.snapchat.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Core asset]\n[Google Play Store](https://play.google.com/store/apps/details?id=com.snapchat.android)"},{"asset":"com.toyopagroup.picaboo","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"[Core asset]\n[iOS App Store](https://itunes.apple.com/us/app/snapchat/id447188370?mt=8)"},{"asset":"create.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"Snapchat's Geofilter creation tool."},{"asset":"developer.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"forum.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"geofilters.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"[Core asset]\nSnapchat's on-demand Geofilters purchase website."},{"asset":"https://lensstudio.snapchat.com/api/","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"kit.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"[Core asset]\nSNAPKIT web application and SDKs"},{"asset":"launch.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"login.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"map.snapchat.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"msg.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"my.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"Snapchat's Spotlight on the web."},{"asset":"playcanv.as","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"relay.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"rt.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"scan.snapchat.com","type":"URL","bounty":true,"severity":"low","instruction":"[Core asset]\nSnapcode creation website"},{"asset":"snappublisher.snapchat.com","type":"URL","bounty":true,"severity":"high","instruction":"[Core asset]\nSnapchat's publisher tool."},{"asset":"spectacles.com","type":"URL","bounty":true,"severity":"low","instruction":"[Core asset]\nSnapchat's spectacles purchase website."},{"asset":"store.playcanvas.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"store.snapchat.com","type":"URL","bounty":true,"severity":"critical","instruction":"Snapchat's Bitmoji Merch Store"},{"asset":"story.snapchat.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"web.snapchat.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.bitmoji.com","type":"URL","bounty":true,"severity":"medium","instruction":"[Non-core asset]"},{"asset":"www.bitstrips.com","type":"URL","bounty":true,"severity":"medium","instruction":"[Non-core asset]"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"92% response, paid recently, resolved 22d ago"},"slop":{"risk":0.158,"label":"none","experimental":true}},"derived":{"novelty":0.1387,"inverse_crowd":0.1771,"payout_reliability":0.9165,"value_per_competition":0.1365,"triage_quality":0.92,"scope_breadth":0.626,"crowding_per_asset_month":3.5972,"slop_risk":0.158},"score":{"total":43.8,"parts":{"novelty":0.139,"inverse_crowd":0.177,"payout_reliability":0.917,"value_per_competition":0.137,"triage_quality":0.92,"scope_breadth":0.626},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":62.4},"reasons":[{"sign":"good","text":"paid $175k in the last 90 days"},{"sign":"good","text":"92% response efficiency"},{"sign":"neutral","text":"518 reports in 90 days across 48 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.6 years"}]},{"id":"hackerone:kiwicom","platform":"hackerone","slug":"kiwicom","name":"Kiwi.com","url":"https://hackerone.com/kiwicom","meta":{"reward_min":100,"reward_max":256,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-01-25T08:50:27.037Z","age_months":44.82516880440528,"reports_90d":623,"resolved_total":273,"response_efficiency":84,"response_indicator":"ok","paid_total":150168,"paid_90d":3650,"last_resolved_at":"2026-10-19T10:40:12.710Z","days_since_resolved":1.2898524169560186,"avg_bounty_low":200,"avg_bounty_high":256,"min_bounty":100,"scope_count":51},"scope":[{"asset":"*.kiwi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Mostly branded versions of our main www.kiwi.com site, please report vulnerabilities only for www.kiwi.com and don't duplicate it here."},{"asset":"*.skypicker.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"APIs & internal tools."},{"asset":"auth.skypicker.com","type":"URL","bounty":true,"severity":"critical","instruction":"Authentication API used on www.kiwi.com."},{"asset":"com.skypicker.Skypicker","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"**Primary target** - Available in [App Store](https://itunes.apple.com/bs/app/kiwi-com-cheap-flight-tickets/id657843853)"},{"asset":"com.skypicker.main","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"**Primary target** - Available in the [Play Store](https://play.google.com/store/apps/details?id=com.skypicker.main)"},{"asset":"http://www.kiwi.com/stories","type":"URL","bounty":true,"severity":"high","instruction":"Online travel magazine Kiwi.com Stories, with very limited impact on our sites & infrastructure."},{"asset":"jobs.kiwi.com","type":"URL","bounty":true,"severity":"medium","instruction":"Hiring page, no sensitive information, likely no impact on our company."},{"asset":"tequila.kiwi.com","type":"URL","bounty":true,"severity":"critical","instruction":"B2B platform. Backend API requests are proxied via **tequila-api.kiwi.com** & **api.tequila.kiwi.com**"},{"asset":"www.kiwi.com","type":"URL","bounty":true,"severity":"critical","instruction":"Our main website"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"84% response, paid recently, resolved 1d ago"},"slop":{"risk":0.238,"label":"none","experimental":true}},"derived":{"novelty":0.2166,"inverse_crowd":0.1564,"payout_reliability":0.9172,"value_per_competition":0.1105,"triage_quality":0.84,"scope_breadth":0.6356,"crowding_per_asset_month":4.0719,"slop_risk":0.238},"score":{"total":43.8,"parts":{"novelty":0.217,"inverse_crowd":0.156,"payout_reliability":0.917,"value_per_competition":0.11,"triage_quality":0.84,"scope_breadth":0.636},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":62.0},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"623 reports in 90 days across 51 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.7 years"}]},{"id":"hackerone:magic-eden","platform":"hackerone","slug":"magic-eden","name":"Magic Eden","url":"https://hackerone.com/magic-eden","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-11-23T14:27:09.566Z","age_months":46.88730184532094,"reports_90d":43,"resolved_total":97,"response_efficiency":65,"response_indicator":"missed","paid_total":476085,"paid_90d":9000,"last_resolved_at":"2026-08-27T02:16:15.506Z","days_since_resolved":54.6398200558449,"avg_bounty_low":1000,"avg_bounty_high":1000,"min_bounty":50,"scope_count":32},"scope":[{"asset":"api.dicey.com","type":"URL","bounty":true,"severity":"critical","instruction":"Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.\nStrictly Out of Scope:\nNo Social Engineering.\nNo Non-Production Assets: Testing is li"},{"asset":"dicey.com","type":"URL","bounty":true,"severity":"critical","instruction":"Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games.\nStrictly Out of Scope:\nNo Social Engineering.\nNo Non-Production Assets: Testing is li"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.034,"label":"none","experimental":true}},"derived":{"novelty":0.2128,"inverse_crowd":0.7239,"payout_reliability":0.734,"value_per_competition":0.4818,"triage_quality":0.4875,"scope_breadth":0.5624,"crowding_per_asset_month":0.4479,"slop_risk":0.034},"score":{"total":43.8,"parts":{"novelty":0.213,"inverse_crowd":0.724,"payout_reliability":0.734,"value_per_competition":0.482,"triage_quality":0.488,"scope_breadth":0.562},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":61.5},"reasons":[{"sign":"good","text":"paid $9k in the last 90 days"},{"sign":"neutral","text":"43 reports in 90 days across 32 assets"},{"sign":"neutral","text":"running 3.9 years"}]},{"id":"hackerone:nintendo","platform":"hackerone","slug":"nintendo","name":"Nintendo","url":"https://hackerone.com/nintendo","meta":{"reward_min":100,"reward_max":1250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-12-06T00:17:04.692Z","age_months":118.46316498092061,"reports_90d":80,"resolved_total":189,"response_efficiency":81,"response_indicator":"ok","paid_total":330000,"paid_90d":30000,"last_resolved_at":"2026-10-16T00:43:29.812Z","days_since_resolved":4.704237810474537,"avg_bounty_low":900,"avg_bounty_high":1250,"min_bounty":100,"scope_count":11},"scope":[{"asset":"Nintendo Switch 2 Kernel / ARM® TrustZone®","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch 2 Security controller known as PSC or Platform Security Controller (any component) / Security controller known as TSEC (bootROM only)","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch 2 System Processes","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch 2 System Processes allowing piracy","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch 2 applications for which Nintendo is the publisher worldwide","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch System","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Nintendo Switch applications for which Nintendo is the publisher worldwide","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"81% response, paid recently, resolved 5d ago"},"slop":{"risk":0.104,"label":"none","experimental":true}},"derived":{"novelty":0.1476,"inverse_crowd":0.2568,"payout_reliability":0.8948,"value_per_competition":0.2103,"triage_quality":0.81,"scope_breadth":0.3997,"crowding_per_asset_month":2.4242,"slop_risk":0.104},"score":{"total":43.7,"parts":{"novelty":0.148,"inverse_crowd":0.257,"payout_reliability":0.895,"value_per_competition":0.21,"triage_quality":0.81,"scope_breadth":0.4},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":61.1},"reasons":[{"sign":"good","text":"paid $30k in the last 90 days"},{"sign":"good","text":"81% response efficiency"},{"sign":"neutral","text":"80 reports in 90 days across 11 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.9 years"}]},{"id":"hackerone:xvideos","platform":"hackerone","slug":"xvideos","name":"XVIDEOS","url":"https://hackerone.com/xvideos","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-08-18T15:21:32.841Z","age_months":62.06470572584417,"reports_90d":83,"resolved_total":254,"response_efficiency":93,"response_indicator":"ok","paid_total":142092,"paid_90d":5700,"last_resolved_at":"2026-08-25T08:03:28.357Z","days_since_resolved":56.398699095196754,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":50,"scope_count":10},"scope":[{"asset":"https://www.xvideos.net/app/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.xnxx.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.xnxx.gold","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.xvideos.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.xvideos.red","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"93% response, pays, last resolved 56d ago"},"slop":{"risk":0.113,"label":"none","experimental":true}},"derived":{"novelty":0.1906,"inverse_crowd":0.2277,"payout_reliability":0.8719,"value_per_competition":0.1422,"triage_quality":0.93,"scope_breadth":0.3857,"crowding_per_asset_month":2.7667,"slop_risk":0.113},"score":{"total":43.6,"parts":{"novelty":0.191,"inverse_crowd":0.228,"payout_reliability":0.872,"value_per_competition":0.142,"triage_quality":0.93,"scope_breadth":0.386},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":60.6},"reasons":[{"sign":"good","text":"paid $6k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"neutral","text":"83 reports in 90 days across 10 assets"},{"sign":"neutral","text":"running 5.2 years"}]},{"id":"hackerone:notion","platform":"hackerone","slug":"notion","name":"Notion Labs, Inc.","url":"https://hackerone.com/notion","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-11-12T18:05:33.986Z","age_months":11.235501548720434,"reports_90d":486,"resolved_total":187,"response_efficiency":91,"response_indicator":"ok","paid_total":295859,"paid_90d":32350,"last_resolved_at":"2026-10-02T15:55:43.310Z","days_since_resolved":18.070748250289352,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":16},"scope":[{"asset":"Github Repositories or other public artifacts owned by makenotion","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Notion AI","type":"AI_MODEL","bounty":true,"severity":"critical","instruction":"We are particularly interested in the ability to access data the user lacks permission to view. Prompt engineering for inappropriate AI responses is out of scope. The usage of obfuscated or invisible "},{"asset":"Notion Authentication","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Notion Desktop App","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Any desktop app available for download at www.notion.so/desktop\n\nWe only reward for the most recent version of the app."},{"asset":"Notion Frontend","type":"OTHER","bounty":true,"severity":"critical","instruction":"Includes any resources served to or affects a user from notion.so/ or our marketing site on notion.so."},{"asset":"Notion Integrations","type":"OTHER","bounty":true,"severity":"critical","instruction":"We are most interested in any CSRF in third-party integrations."},{"asset":"Notion MCP","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Privilege Escalation","type":"OTHER","bounty":true,"severity":"critical","instruction":"We are particularly interested in the ability to access pages a given user should lack the ability to access. \n\nAdditionally, if a page is available through “Anyone with a link at…” (permission grant)"},{"asset":"Product API","type":"OTHER","bounty":true,"severity":"critical","instruction":"Includes resources at notion.so/api/v3.\n\nAttacks we are most interested in receiving reports about include: injection attacks, remote code execution, server-side request forgery, IDOR, and privilege e"},{"asset":"Public API","type":"OTHER","bounty":true,"severity":"critical","instruction":"Includes resources at [api.notion.com](https://api.notion.com/).\n\nWe are particularly interested in the ability to escalate your privileges beyond the scope of our API tokens."},{"asset":"calendar.notion.so","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mail.notion.so","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"notion.id","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Includes the Android app available for download at https://play.google.com/store/apps/details?id=notion.id. We only reward for the most recent version of the app."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 18d ago"},"slop":{"risk":0.468,"label":"watch","experimental":true}},"derived":{"novelty":0.3672,"inverse_crowd":0.0585,"payout_reliability":0.9186,"value_per_competition":0.0502,"triage_quality":0.91,"scope_breadth":0.4557,"crowding_per_asset_month":10.125,"slop_risk":0.468},"score":{"total":43.6,"parts":{"novelty":0.367,"inverse_crowd":0.059,"payout_reliability":0.919,"value_per_competition":0.05,"triage_quality":0.91,"scope_breadth":0.456},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":60.2},"reasons":[{"sign":"good","text":"paid $32k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"486 reports in 90 days across 16 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 11 months ago"}]},{"id":"hackerone:hilton","platform":"hackerone","slug":"hilton","name":"Hilton","url":"https://hackerone.com/hilton","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-03-21T18:24:28.917Z","age_months":43.00509051708305,"reports_90d":497,"resolved_total":471,"response_efficiency":80,"response_indicator":"ok","paid_total":349725,"paid_90d":73350,"last_resolved_at":"2026-10-14T17:25:52.238Z","days_since_resolved":6.008144916956018,"avg_bounty_low":150,"avg_bounty_high":300,"min_bounty":50,"scope_count":47},"scope":[{"asset":"*.hilton.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All subdomains of hilton.com that resolve to IP addresses belonging to the Rackspace organization are considered out of scope. In addition, the application eis.hilton.com is out of scope."},{"asset":"*.hilton.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hiltonbusinessonline.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hiltonlocalbiz.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"121.200.237.36/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"167.187.0.0/16","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"192.251.123.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"192.251.124.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"192.251.125.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"192.251.126.0/24","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"203.79.37.2/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"62.216.152.46/29","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"82.196.42.196/28","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"Hilton Franchised Properties","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Hilton Third Party Applications - *.hilton.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"These are applications that are hosted by a 3rd party, but are accessible using a sub-domain of hilton.com (i.e. *.hilton.com)."},{"asset":"Managed Property Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"com.hilton.android.hhonors","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"hilton.com","type":"URL","bounty":true,"severity":"critical","instruction":"Authentication functionality when a user creates a Hilton Honors account (https://www.hilton.com/en/hilton-honors/join/).  To create a Hilton Honors account, finders should complete the free sign-up p"},{"asset":"hilton.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hiltonbusinessonline.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hiltonlocalbiz.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id635150066","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"resmax.hilton.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"80% response, paid recently, resolved 6d ago"},"slop":{"risk":0.169,"label":"none","experimental":true}},"derived":{"novelty":0.2201,"inverse_crowd":0.1807,"payout_reliability":0.8871,"value_per_competition":0.1274,"triage_quality":0.8,"scope_breadth":0.6227,"crowding_per_asset_month":3.5248,"slop_risk":0.169},"score":{"total":43.5,"parts":{"novelty":0.22,"inverse_crowd":0.181,"payout_reliability":0.887,"value_per_competition":0.127,"triage_quality":0.8,"scope_breadth":0.623},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":59.7},"reasons":[{"sign":"good","text":"paid $73k in the last 90 days"},{"sign":"good","text":"80% response efficiency"},{"sign":"neutral","text":"497 reports in 90 days across 47 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.6 years"}]},{"id":"hackerone:okg","platform":"hackerone","slug":"okg","name":"OKG","url":"https://hackerone.com/okg","meta":{"reward_min":50,"reward_max":589,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-03-14T08:59:59.557Z","age_months":43.24794904624876,"reports_90d":866,"resolved_total":227,"response_efficiency":98,"response_indicator":"ok","paid_total":290000,"paid_90d":30000,"last_resolved_at":"2026-10-19T03:15:47.354Z","days_since_resolved":1.598479222511574,"avg_bounty_low":400,"avg_bounty_high":589,"min_bounty":50,"scope_count":30},"scope":[{"asset":"*.oklink.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.okx.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Mac OS Executable","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://www.okx.com/download"},{"asset":"OKX Android APK","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.okinc.okex.gp"},{"asset":"OKX Wallet Chrome Extension","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://chromewebstore.google.com/detail/okx-wallet/mcohilncbfahbmgdjkbpemcciiolgcge"},{"asset":"OKX Wallet Edge Add-ons","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://microsoftedge.microsoft.com/addons/detail/okx-wallet/pbpjkcldjiffchgbbndmhojiacbgflha"},{"asset":"OKX Wallet Safari Extension","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/okx-wallet/id6463797825"},{"asset":"OKX iOS APP","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/okx-buy-bitcoin-btc-crypto/id1327268470"},{"asset":"Windows OS Executable","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://www.okx.com/download"},{"asset":"https://github.com/okx/go-wallet-sdk","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 2d ago"},"slop":{"risk":0.499,"label":"watch","experimental":true}},"derived":{"novelty":0.2196,"inverse_crowd":0.062,"payout_reliability":0.9865,"value_per_competition":0.0606,"triage_quality":0.98,"scope_breadth":0.5524,"crowding_per_asset_month":9.6222,"slop_risk":0.499},"score":{"total":43.5,"parts":{"novelty":0.22,"inverse_crowd":0.062,"payout_reliability":0.986,"value_per_competition":0.061,"triage_quality":0.98,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":59.3},"reasons":[{"sign":"good","text":"paid $30k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"866 reports in 90 days across 30 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.6 years"}]},{"id":"hackerone:airbnb","platform":"hackerone","slug":"airbnb","name":"Airbnb","url":"https://hackerone.com/airbnb","meta":{"reward_min":0,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-02-27T00:09:56.460Z","age_months":139.7528555398985,"reports_90d":477,"resolved_total":1694,"response_efficiency":100,"response_indicator":"ok","paid_total":3450253,"paid_90d":157500,"last_resolved_at":"2026-08-28T16:17:15.167Z","days_since_resolved":53.05579620167824,"avg_bounty_low":500,"avg_bounty_high":1000,"min_bounty":0,"scope_count":36},"scope":[{"asset":"*.airbnb-aws.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"*.airbnb.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.airbnbcitizen.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.airbnbpayments.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.atairbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.byairbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.hoteltonight-test.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.hoteltonight.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.luxuryretreats.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.muscache.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"*.musta.ch","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.withairbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"Localized airbnb sites listed at the link below:","type":"OTHER","bounty":true,"severity":"critical","instruction":"**https://www.airbnb.com/sitemaps/localized**\nHigher Impact Scope"},{"asset":"api.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"assets.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"callbacks.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"com.airbnb.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"com.airbnb.app","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"com.luxuryretreats.ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"m.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"next.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"one.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"open.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"},{"asset":"support-api.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"www.airbnb.com","type":"URL","bounty":true,"severity":"critical","instruction":"Higher Impact Scope"},{"asset":"www.hoteltonight.com","type":"URL","bounty":true,"severity":"critical","instruction":"Lower Impact Scope"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"100% response, pays, last resolved 53d ago"},"slop":{"risk":0.17,"label":"none","experimental":true}},"derived":{"novelty":0.1382,"inverse_crowd":0.144,"payout_reliability":0.9109,"value_per_competition":0.1288,"triage_quality":1.0,"scope_breadth":0.5809,"crowding_per_asset_month":4.4167,"slop_risk":0.17},"score":{"total":43.4,"parts":{"novelty":0.138,"inverse_crowd":0.144,"payout_reliability":0.911,"value_per_competition":0.129,"triage_quality":1.0,"scope_breadth":0.581},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":58.8},"reasons":[{"sign":"good","text":"paid $158k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"477 reports in 90 days across 36 assets"},{"sign":"neutral","text":"running 11.6 years"}]},{"id":"hackerone:doordash","platform":"hackerone","slug":"doordash","name":"DoorDash","url":"https://hackerone.com/doordash","meta":{"reward_min":50,"reward_max":724,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-10-23T15:56:33.068Z","age_months":11.895529276304282,"reports_90d":228,"resolved_total":14,"response_efficiency":75,"response_indicator":"ok","paid_total":56920,"paid_90d":3989,"last_resolved_at":"2026-09-26T05:10:48.230Z","days_since_resolved":24.518607972511575,"avg_bounty_low":724,"avg_bounty_high":724,"min_bounty":50,"scope_count":19},"scope":[{"asset":"com.dd.doordash","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Consumer Android: https://play.google.com/store/apps/details?id=com.dd.doordash"},{"asset":"doordash.DoorDashConsumer","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Consumer iOS: https://itunes.apple.com/us/app/doordash-food-delivery/id719972451"},{"asset":"www.doordash.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"75% response, pays"},"slop":{"risk":0.544,"label":"watch","experimental":true}},"derived":{"novelty":0.3596,"inverse_crowd":0.1593,"payout_reliability":0.8273,"value_per_competition":0.133,"triage_quality":0.75,"scope_breadth":0.4819,"crowding_per_asset_month":4.0,"slop_risk":0.544},"score":{"total":43.4,"parts":{"novelty":0.36,"inverse_crowd":0.159,"payout_reliability":0.827,"value_per_competition":0.133,"triage_quality":0.75,"scope_breadth":0.482},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":58.4},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"neutral","text":"228 reports in 90 days across 19 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 12 months ago"}]},{"id":"hackerone:1password","platform":"hackerone","slug":"1password","name":"1Password - Enterprise Password Manager","url":"https://hackerone.com/1password","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-12-09T17:10:37.967Z","age_months":22.34147767580234,"reports_90d":82,"resolved_total":null,"response_efficiency":86,"response_indicator":"ok","paid_total":33350,"paid_90d":8000,"last_resolved_at":"2026-08-14T18:02:05.219Z","days_since_resolved":66.98299467390046,"avg_bounty_low":100,"avg_bounty_high":300,"min_bounty":50,"scope_count":9},"scope":[{"asset":"<Your own 1Password account> —> Latest stable, beta, or nightly Browser Extension (Chrome, Brave, Firefox, Edge, and Safari)","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"<Your own 1Password account> —> Latest stable, beta, or nightly Command Line Interface (CLI)","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"http://--your-own-1password-account--.1password.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://events.1password.com/api/","type":"API","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"86% response, pays, last resolved 67d ago"},"slop":{"risk":0.509,"label":"watch","experimental":true}},"derived":{"novelty":0.2836,"inverse_crowd":0.2087,"payout_reliability":0.825,"value_per_competition":0.1427,"triage_quality":0.86,"scope_breadth":0.3704,"crowding_per_asset_month":3.037,"slop_risk":0.509},"score":{"total":43.3,"parts":{"novelty":0.284,"inverse_crowd":0.209,"payout_reliability":0.825,"value_per_competition":0.143,"triage_quality":0.86,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":57.9},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"82 reports in 90 days across 9 assets"},{"sign":"neutral","text":"running 1.9 years"}]},{"id":"hackerone:basecamp","platform":"hackerone","slug":"basecamp","name":"Basecamp","url":"https://hackerone.com/basecamp","meta":{"reward_min":100,"reward_max":328,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-10-13T13:06:35.054Z","age_months":72.21973568515666,"reports_90d":488,"resolved_total":597,"response_efficiency":97,"response_indicator":"ok","paid_total":601716,"paid_90d":196371,"last_resolved_at":"2026-10-19T23:04:46.604Z","days_since_resolved":0.7727934586226852,"avg_bounty_low":250,"avg_bounty_high":328,"min_bounty":100,"scope_count":23},"scope":[{"asset":"*.hey.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Basecamp.app","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Basecamp for Mac: https://basecamp.com/via#basecamp-for-your-mac-or-pc"},{"asset":"HEY.app","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"HEY for macOS: https://hey.com/apps/"},{"asset":"HEY.exe","type":"WINDOWS_APP_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"HEY for Windows: https://www.microsoft.com/en-us/p/hey-mail/9pf08ljw7gw2"},{"asset":"app.basecamp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Basecamp 5"},{"asset":"app.fizzy.do","type":"URL","bounty":false,"severity":"critical","instruction":"Full source code is available at https://github.com/basecamp/fizzy and https://github.com/basecamp/fizzy-saas"},{"asset":"basecamp-setup.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Basecamp for Windows: https://basecamp.com/via#basecamp-for-your-mac-or-pc"},{"asset":"com.basecamp.bc3","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Basecamp for Android: https://basecamp.com/via#basecamp-for-ios-and-android-devices"},{"asset":"com.basecamp.bc3-ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Basecamp for iOS: https://basecamp.com/via#basecamp-for-ios-and-android-devices"},{"asset":"com.basecamp.hey","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"HEY for Android: https://play.google.com/store/apps/details?id=com.basecamp.hey"},{"asset":"com.hey.app.ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"HEY for iOS: https://apps.apple.com/us/app/hey-email/id1506603805"},{"asset":"hey-mail","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"HEY for Linux: https://snapcraft.io/hey-mail/"},{"asset":"https://github.com/basecamp/once-campfire","type":"SOURCE_CODE","bounty":false,"severity":"high","instruction":"[Campfire](https://once.com/campfire) is an installable, self-hosted group chat system designed, built, and backed by 37signals.\n\nhttps://once.com/campfire"},{"asset":"https://github.com/basecamp/trix","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"[Trix](https://trix-editor.org/) is a rich text editor used in HEY. \n\nFindings in Trix that are reproducible in HEY are eligible for bounties, but other issues that are mitigated in HEY and only repro"},{"asset":"https://github.com/basecamp/writebook","type":"SOURCE_CODE","bounty":false,"severity":"high","instruction":"[Writebook](https://once.com/writebook) is an installable, self-hosted app to publish your own books on the web. \n\nhttps://once.com/writebook"},{"asset":"launchpad.37signals.com","type":"URL","bounty":true,"severity":"critical","instruction":"Launchpad"},{"asset":"world.hey.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 1d ago"},"slop":{"risk":0.287,"label":"none","experimental":true}},"derived":{"novelty":0.1795,"inverse_crowd":0.0873,"payout_reliability":0.9833,"value_per_competition":0.0725,"triage_quality":0.97,"scope_breadth":0.5112,"crowding_per_asset_month":7.0725,"slop_risk":0.287},"score":{"total":42.9,"parts":{"novelty":0.18,"inverse_crowd":0.087,"payout_reliability":0.983,"value_per_competition":0.072,"triage_quality":0.97,"scope_breadth":0.511},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":57.5},"reasons":[{"sign":"good","text":"paid $196k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"488 reports in 90 days across 23 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:starbucks","platform":"hackerone","slug":"starbucks","name":"Starbucks","url":"https://hackerone.com/starbucks","meta":{"reward_min":100,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-11-29T16:01:42.243Z","age_months":118.67159240848164,"reports_90d":70,"resolved_total":2120,"response_efficiency":63,"response_indicator":"missed","paid_total":1360000,"paid_90d":20000,"last_resolved_at":"2026-10-19T09:31:07.782Z","days_since_resolved":1.3378261206597222,"avg_bounty_low":500,"avg_bounty_high":600,"min_bounty":100,"scope_count":47},"scope":[{"asset":"Other assets","type":"OTHER","bounty":false,"severity":"critical","instruction":"If you have found a vulnerability in a Starbucks site or app not contained within this list, you can still submit, and Starbucks will triage the report.\nThese types of reports will not result in a mon"},{"asset":"Subdomain Takeover (SDTO)","type":"OTHER","bounty":true,"severity":"critical","instruction":"Subdomain Takeovers will be evaluated on their severity considering cookie scoping, historical significance and potential traffic volume. They maybe bounty eligible or alternately informative as deter"},{"asset":"app.starbucks.com","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks US\nhttps://app.starbucks.com"},{"asset":"com.starbucks.mobilecard","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Starbucks USA Android app.\nhttps://play.google.com/store/apps/details?id=com.starbucks.mobilecard"},{"asset":"com.starbucks.mystarbucks","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Starbucks US ios app.\nhttps://itunes.apple.com/us/app/starbucks/id331177714"},{"asset":"openapi.starbucks.com","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks digital service capabilities to 3rd party business partner(s)/cooperators via standard Open API."},{"asset":"secureui.starbucks.com","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks Payment Processing\nhttps://secureui.starbucks.com/"},{"asset":"www.starbucks.ca","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks Canada\nhttps://www.starbucks.ca/"},{"asset":"www.starbucks.com","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks US\nhttps://www.starbucks.com/"},{"asset":"www.starbucksreserve.com","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks Reserve\nhttps://www.starbucksreserve.com/"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.019,"label":"none","experimental":true}},"derived":{"novelty":0.1475,"inverse_crowd":0.6985,"payout_reliability":0.812,"value_per_competition":0.4317,"triage_quality":0.4725,"scope_breadth":0.6227,"crowding_per_asset_month":0.4965,"slop_risk":0.019},"score":{"total":42.9,"parts":{"novelty":0.148,"inverse_crowd":0.699,"payout_reliability":0.812,"value_per_competition":0.432,"triage_quality":0.473,"scope_breadth":0.623},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":57.0},"reasons":[{"sign":"good","text":"paid $20k in the last 90 days"},{"sign":"neutral","text":"70 reports in 90 days across 47 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.9 years"}]},{"id":"hackerone:pornbox","platform":"hackerone","slug":"pornbox","name":"PornBox","url":"https://hackerone.com/pornbox","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-01-25T15:16:59.958Z","age_months":32.82456308495893,"reports_90d":56,"resolved_total":103,"response_efficiency":98,"response_indicator":"ok","paid_total":64922,"paid_90d":2510,"last_resolved_at":"2026-09-14T10:17:34.641Z","days_since_resolved":36.30557080815972,"avg_bounty_low":250,"avg_bounty_high":300,"min_bounty":50,"scope_count":4},"scope":[{"asset":"www.analvids.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.ddfcontent.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.pornbox.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.pornworld.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"98% response, pays, last resolved 36d ago"},"slop":{"risk":0.19,"label":"none","experimental":true}},"derived":{"novelty":0.2445,"inverse_crowd":0.136,"payout_reliability":0.9236,"value_per_competition":0.1017,"triage_quality":0.98,"scope_breadth":0.2589,"crowding_per_asset_month":4.6667,"slop_risk":0.19},"score":{"total":42.9,"parts":{"novelty":0.245,"inverse_crowd":0.136,"payout_reliability":0.924,"value_per_competition":0.102,"triage_quality":0.98,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":56.6},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"56 reports in 90 days across 4 assets"},{"sign":"neutral","text":"running 2.7 years"}]},{"id":"hackerone:slack","platform":"hackerone","slug":"slack","name":"Slack","url":"https://hackerone.com/slack","meta":{"reward_min":250,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-02-28T18:05:03.940Z","age_months":151.68725835380067,"reports_90d":519,"resolved_total":2337,"response_efficiency":100,"response_indicator":"ok","paid_total":2916370,"paid_90d":128250,"last_resolved_at":"2026-10-12T16:03:04.723Z","days_since_resolved":8.065639303530093,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":250,"scope_count":27},"scope":[{"asset":"*.quip.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only accepting Critical reports as of 2023-12-01"},{"asset":"Slack Desktop Application","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.slack.com","type":"URL","bounty":true,"severity":"critical","instruction":"The Slack API"},{"asset":"app.slack.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.Slack","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.slack.slackmdm","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Reports are accepted for vulnerabilities specific to the [Slack EMM/MDM version of the app](https://apps.apple.com/us/app/slack-for-emm/id1254292716).\n\nEMM client vulnerabilities in the absence of a v"},{"asset":"com.tinyspeck.chatlyio","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The main Slack app is included: [Slack iOS App](https://apps.apple.com/us/app/slack/id618783545)\n\nOther versions of the app, such as the EMM and Intune versions, are not included."},{"asset":"edgeapi.slack.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/quip-docs-chat-sheets/id647922896","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Only accepting Critical reports as of 2023-12-01"},{"asset":"https://github.com/slackhq/nebula","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Accepting Critical severity ONLY as of 2026-05-27. Refer to Out of Scope section for detailed guidance"},{"asset":"https://salesforce.quip.com/blog/desktop","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"slack-imgs.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"slack-redir.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"slack-status.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"slack.com","type":"URL","bounty":true,"severity":"critical","instruction":"The slack.com site and application."},{"asset":"slackatwork.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"slackb.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"spaces.pm","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.quip.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only accepting Critical reports as of 2023-12-01"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 8d ago"},"slop":{"risk":0.24,"label":"none","experimental":true}},"derived":{"novelty":0.1338,"inverse_crowd":0.0972,"payout_reliability":0.9829,"value_per_competition":0.0847,"triage_quality":1.0,"scope_breadth":0.536,"crowding_per_asset_month":6.4074,"slop_risk":0.24},"score":{"total":42.8,"parts":{"novelty":0.134,"inverse_crowd":0.097,"payout_reliability":0.983,"value_per_competition":0.085,"triage_quality":1.0,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":56.1},"reasons":[{"sign":"good","text":"paid $128k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"519 reports in 90 days across 27 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.6 years"}]},{"id":"hackerone:coinbase","platform":"hackerone","slug":"coinbase","name":"Coinbase","url":"https://hackerone.com/coinbase","meta":{"reward_min":200,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-03-28T22:09:39.471Z","age_months":150.76176001514372,"reports_90d":696,"resolved_total":1208,"response_efficiency":85,"response_indicator":"ok","paid_total":3113838,"paid_90d":352100,"last_resolved_at":"2026-10-15T12:54:30.622Z","days_since_resolved":5.196589546585648,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":200,"scope_count":64},"scope":[{"asset":"*.base.app","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.base.org","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.cbhq.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.coinbase-corp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.coinbase.com","type":"URL","bounty":true,"severity":"critical","instruction":"Coinbase's main domain."},{"asset":"54.175.255.192/27","type":"CIDR","bounty":true,"severity":"critical","instruction":null},{"asset":"Other","type":"OTHER","bounty":false,"severity":"medium","instruction":"Applications that may have been missed as a part of our standard scope; this will be assessed on a by submission basis."},{"asset":"com.coinbase.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Coinbase's retail mobile app on Android."},{"asset":"com.vilcsak.bitcoin2","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Coinbase's retail mobile app on iOS."},{"asset":"https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/base/*","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/coinbase/*","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/coinbase/cb-mpc","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/coinbase/cb-mpc-go","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"While we appreciate submissions regarding this repo, this repo is not eligible for bounties."},{"asset":"org.toshi","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Base Android app"},{"asset":"org.toshi.distribution","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Base iOS app"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"85% response, paid recently, resolved 5d ago"},"slop":{"risk":0.154,"label":"none","experimental":true}},"derived":{"novelty":0.1341,"inverse_crowd":0.1757,"payout_reliability":0.9138,"value_per_competition":0.1158,"triage_quality":0.85,"scope_breadth":0.6715,"crowding_per_asset_month":3.625,"slop_risk":0.154},"score":{"total":42.8,"parts":{"novelty":0.134,"inverse_crowd":0.176,"payout_reliability":0.914,"value_per_competition":0.116,"triage_quality":0.85,"scope_breadth":0.671},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":55.7},"reasons":[{"sign":"good","text":"paid $352k in the last 90 days"},{"sign":"good","text":"85% response efficiency"},{"sign":"neutral","text":"696 reports in 90 days across 64 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.6 years"}]},{"id":"hackerone:inditex","platform":"hackerone","slug":"inditex","name":"Inditex","url":"https://hackerone.com/inditex","meta":{"reward_min":150,"reward_max":416,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-09-05T15:32:06.047Z","age_months":37.48951627949844,"reports_90d":62,"resolved_total":null,"response_efficiency":100,"response_indicator":"ok","paid_total":70000,"paid_90d":5000,"last_resolved_at":"2026-09-14T06:05:43.506Z","days_since_resolved":36.480468203993055,"avg_bounty_low":397,"avg_bounty_high":416,"min_bounty":150,"scope_count":4},"scope":[{"asset":"Main corporate site","type":"OTHER","bounty":true,"severity":"critical","instruction":"This scope covers Inditex's main corporate site, mainly made up of the following domains:\n\n- www.inditex.com\n- www.inditex.cn\n\nAs these services are consumed in a non-authenticated and public way by u"},{"asset":"Other related e-commerce services","type":"OTHER","bounty":true,"severity":"critical","instruction":"This scope covers other Inditex's e-commerce services, that do not comply with the scope specified under \"e-Commerce\", mainly made up of the following domain wildcards:\n\n- *.zara.com\n- *.bershka.com\n-"},{"asset":"Recruitment services","type":"OTHER","bounty":true,"severity":"critical","instruction":"This scope covers Inditex's recruitment services, mainly made up of the following domain wildcards:\n\n* *.inditexcareers.com"},{"asset":"e-Commerce","type":"OTHER","bounty":true,"severity":"critical","instruction":"This scope covers Inditex's entire e-commerce platform, mainly made up of the following domains:\n\n- www.zara.com\n- www.bershka.com\n- www.oysho.com\n- www.stradivarius.com\n- www.zarahome.com\n- www.pulla"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"100% response, pays, last resolved 36d ago"},"slop":{"risk":0.586,"label":"watch","experimental":true}},"derived":{"novelty":0.2322,"inverse_crowd":0.1223,"payout_reliability":0.9334,"value_per_competition":0.0988,"triage_quality":1.0,"scope_breadth":0.2589,"crowding_per_asset_month":5.1667,"slop_risk":0.586},"score":{"total":42.7,"parts":{"novelty":0.232,"inverse_crowd":0.122,"payout_reliability":0.933,"value_per_competition":0.099,"triage_quality":1.0,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":55.2},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"62 reports in 90 days across 4 assets"},{"sign":"neutral","text":"running 3.1 years"}]},{"id":"hackerone:trip_com","platform":"hackerone","slug":"trip_com","name":"Trip.com","url":"https://hackerone.com/trip_com","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-17T07:14:41.166Z","age_months":36.120988209302986,"reports_90d":416,"resolved_total":164,"response_efficiency":90,"response_indicator":"ok","paid_total":51473,"paid_90d":14850,"last_resolved_at":"2026-09-16T08:27:56.864Z","days_since_resolved":34.381702486400464,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":27},"scope":[{"asset":"*.budgetair.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.cheaptickets.nl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Low priority Scope"},{"asset":"*.flugladen.de","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.staging.travix.com","type":"OTHER","bounty":false,"severity":"critical","instruction":"The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these platf"},{"asset":"*.trainpal.com,*.mytrainpal.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Low priority Scope"},{"asset":"*.travix.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Low priority Scope"},{"asset":"*.travix.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Low priority Scope"},{"asset":"*.trip.biz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.trip.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Except for the domain name of <local>. trip.com\nLow priority Scope"},{"asset":"*.triplinkintl.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tyo-masters.co.jp","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.vayama.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.vliegwinkel.nl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"<locale>.trip.com","type":"OTHER","bounty":true,"severity":"critical","instruction":"Trip Main Sites\nHigh priority Scope"},{"asset":"com.trip.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"High priority Scope"},{"asset":"com.trip.ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"High priority Scope"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"90% response, pays, last resolved 34d ago"},"slop":{"risk":0.286,"label":"none","experimental":true}},"derived":{"novelty":0.2356,"inverse_crowd":0.1231,"payout_reliability":0.8865,"value_per_competition":0.0826,"triage_quality":0.9,"scope_breadth":0.536,"crowding_per_asset_month":5.1358,"slop_risk":0.286},"score":{"total":42.4,"parts":{"novelty":0.236,"inverse_crowd":0.123,"payout_reliability":0.886,"value_per_competition":0.083,"triage_quality":0.9,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":54.8},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"416 reports in 90 days across 27 assets"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:s-pankki","platform":"hackerone","slug":"s-pankki","name":"S-Pankki","url":"https://hackerone.com/s-pankki","meta":{"reward_min":150,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-01-30T11:18:33.931Z","age_months":44.65751845304776,"reports_90d":37,"resolved_total":138,"response_efficiency":65,"response_indicator":"missed","paid_total":70000,"paid_90d":5000,"last_resolved_at":"2026-10-16T11:37:11.273Z","days_since_resolved":4.25028571556713,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":150,"scope_count":21},"scope":[{"asset":"740514933","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"S-mobiili banking application (iOS).\n\nThe application can be found from App Store \nhttps://apps.apple.com/fi/app/s-mobiili/id740514933?l=fi"},{"asset":"digili.s-cloud.fi","type":"URL","bounty":true,"severity":"critical","instruction":"Services for S-Bank and S-group customers where customers can take S-bank basic banking services into use (later \"digipa\") and gain S-Group co-op membership (later \"digili). \n\nBasic banking services i"},{"asset":"extranet.s-pankki.fi","type":"URL","bounty":true,"severity":"critical","instruction":"S-Bank portal where customers can take care of their S-Bank actions with other banks credentials."},{"asset":"fi.spankki","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"S-mobiili banking application (Android).\n\nThe application can be found from Google Play https://play.google.com/store/apps/details?id=fi.spankki&hl=fi"},{"asset":"https://crosskey.io/stores/s-pankki/apis","type":"URL","bounty":true,"severity":"critical","instruction":"S-Bank PSD2 interface."},{"asset":"mobile.s-pankki.fi","type":"URL","bounty":true,"severity":"critical","instruction":"S-mobile banking application interface."},{"asset":"online.s-pankki.fi","type":"URL","bounty":true,"severity":"critical","instruction":"S-Bank netbank which provides netbank functionalities (accounts, payments, cards, loans, investments etc) to private customers. \n\nNotice that you should use your own netbank credentials or demo custom"},{"asset":"www.s-pankki.fi","type":"URL","bounty":true,"severity":"critical","instruction":"S-bank public pages"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.032,"label":"none","experimental":true}},"derived":{"novelty":0.2169,"inverse_crowd":0.6545,"payout_reliability":0.8158,"value_per_competition":0.3955,"triage_quality":0.4875,"scope_breadth":0.4972,"crowding_per_asset_month":0.5873,"slop_risk":0.032},"score":{"total":42.3,"parts":{"novelty":0.217,"inverse_crowd":0.654,"payout_reliability":0.816,"value_per_competition":0.395,"triage_quality":0.488,"scope_breadth":0.497},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":54.3},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"37 reports in 90 days across 21 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.7 years"}]},{"id":"hackerone:mergify","platform":"hackerone","slug":"mergify","name":"Mergify","url":"https://hackerone.com/mergify","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-16T15:05:25.219Z","age_months":36.143102418368315,"reports_90d":130,"resolved_total":54,"response_efficiency":100,"response_indicator":"ok","paid_total":49950,"paid_90d":12500,"last_resolved_at":"2026-09-28T07:40:35.386Z","days_since_resolved":22.414589963252315,"avg_bounty_low":300,"avg_bounty_high":300,"min_bounty":50,"scope_count":5},"scope":[{"asset":"api.mergify.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dashboard.mergify.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 22d ago"},"slop":{"risk":0.408,"label":"watch","experimental":true}},"derived":{"novelty":0.2355,"inverse_crowd":0.0697,"payout_reliability":0.9559,"value_per_competition":0.0596,"triage_quality":1.0,"scope_breadth":0.2882,"crowding_per_asset_month":8.6667,"slop_risk":0.408},"score":{"total":41.7,"parts":{"novelty":0.236,"inverse_crowd":0.07,"payout_reliability":0.956,"value_per_competition":0.06,"triage_quality":1.0,"scope_breadth":0.288},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":53.8},"reasons":[{"sign":"good","text":"paid $12k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"130 reports in 90 days across 5 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:boozt","platform":"hackerone","slug":"boozt","name":"Boozt Fashion AB","url":"https://hackerone.com/boozt","meta":{"reward_min":50,"reward_max":390,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-17T08:31:21.978Z","age_months":36.119238718086926,"reports_90d":125,"resolved_total":59,"response_efficiency":78,"response_indicator":"ok","paid_total":65751,"paid_90d":4807,"last_resolved_at":"2026-10-15T08:47:40.546Z","days_since_resolved":5.3680024632523144,"avg_bounty_low":348,"avg_bounty_high":390,"min_bounty":50,"scope_count":11},"scope":[{"asset":"*.boozt.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.booztlet.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"com.boozt","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.boozt.app","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.boozt.booztlet","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.booztlet","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"kronor.io","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in reports covering the following endpoints only:\n\n1. https://kronor.io/v1/graphql\n2. https://payment-gateway.kronor.io\n3. https://kronor.io/cde/gql"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"78% response, pays"},"slop":{"risk":0.221,"label":"none","experimental":true}},"derived":{"novelty":0.2356,"inverse_crowd":0.1682,"payout_reliability":0.8784,"value_per_competition":0.1259,"triage_quality":0.78,"scope_breadth":0.3997,"crowding_per_asset_month":3.7879,"slop_risk":0.221},"score":{"total":41.6,"parts":{"novelty":0.236,"inverse_crowd":0.168,"payout_reliability":0.878,"value_per_competition":0.126,"triage_quality":0.78,"scope_breadth":0.4},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":53.4},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"125 reports in 90 days across 11 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:eero","platform":"hackerone","slug":"eero","name":"eero","url":"https://hackerone.com/eero","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-03-28T19:27:52.619Z","age_months":42.77366466644802,"reports_90d":236,"resolved_total":18,"response_efficiency":81,"response_indicator":"ok","paid_total":58400,"paid_90d":23500,"last_resolved_at":"2026-10-16T20:11:37.467Z","days_since_resolved":3.8930380998263887,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":50,"scope_count":18},"scope":[{"asset":"*.e2ro.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.eero.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1023499075","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.eero.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"eero Devices","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"This covers all eero-branded or manufactured devices sold by eero or an authorized retailer. The eero device must be running the latest available software and must be listed on the ‘eero security upda"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"81% response, paid recently, resolved 4d ago"},"slop":{"risk":0.557,"label":"watch","experimental":true}},"derived":{"novelty":0.2206,"inverse_crowd":0.1456,"payout_reliability":0.8965,"value_per_competition":0.0997,"triage_quality":0.81,"scope_breadth":0.4736,"crowding_per_asset_month":4.3704,"slop_risk":0.557},"score":{"total":41.6,"parts":{"novelty":0.221,"inverse_crowd":0.146,"payout_reliability":0.897,"value_per_competition":0.1,"triage_quality":0.81,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":52.9},"reasons":[{"sign":"good","text":"paid $24k in the last 90 days"},{"sign":"good","text":"81% response efficiency"},{"sign":"neutral","text":"236 reports in 90 days across 18 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.6 years"}]},{"id":"hackerone:stripe","platform":"hackerone","slug":"stripe","name":"Stripe","url":"https://hackerone.com/stripe","meta":{"reward_min":100,"reward_max":789,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-07-06T17:41:22.311Z","age_months":63.47424657685946,"reports_90d":959,"resolved_total":646,"response_efficiency":77,"response_indicator":"ok","paid_total":1370360,"paid_90d":419329,"last_resolved_at":"2026-10-19T14:15:44.166Z","days_since_resolved":1.1401827873263888,"avg_bounty_low":500,"avg_bounty_high":789,"min_bounty":100,"scope_count":64},"scope":[{"asset":"*.bridge.xyz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Stripe [acquired](https://stripe.com/ae/newsroom/news/stripe-completes-bridge-acquisition) Bridge in February 2025.\n\nBridge does not currently have a self-service sign-up option. Scope for the bug bou"},{"asset":"*.lemonsqueezy.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Lemon Squeezy is the all-in-one platform for running your SaaS business. Payments, subscriptions, global tax compliance, fraud prevention, multi-currency support, failed payment recovery, PayPal integ"},{"asset":"*.link.co","type":"URL","bounty":true,"severity":"critical","instruction":"Link is a simple and secure way to pay in one click on tens of thousands of sites. Save your payment information with Link the first time you check out. Link will autofill your saved card details and "},{"asset":"*.metronome.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Stripe [acquired](https://stripe.com/newsroom/news/stripe-completes-metronome-acquisition) Metronome in January 2026.\n\nTo create an account for testing follow the steps below:\n* Visit metronome.com\n* "},{"asset":"*.recko.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.reckoproduction.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.reckostaging.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.stripe.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"978516833","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Stripe iOS Dashboard App\nApp Store URL: https://apps.apple.com/us/app/stripe-dashboard/id978516833"},{"asset":"Customer Portal","type":"OTHER","bounty":true,"severity":"critical","instruction":"Give your customers the ability to manage their account by setting up a customer portal. Configure the portal in the Dashboard, or use the API to implement advanced features, such as setting up unique"},{"asset":"Global Payouts","type":"OTHER","bounty":true,"severity":"critical","instruction":"Global Payouts allows you to send funds directly to any third party in their local currency.\n\nDocumentation: https://docs.stripe.com/global-payouts"},{"asset":"Munkisrv Open Source Project","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://github.com/stripe/munkisrv\n\nStripe's munkisrv open source project is in scope but severity is evaluated using Stripe specific threat models based on how it is used internally. Reports would ha"},{"asset":"Sandboxes","type":"OTHER","bounty":true,"severity":"critical","instruction":"Description: Sandboxes is the default testing tool offered by Stripe. Sandboxes now has support for all Stripe products (including Stripe Apps, Sigma, and BaaS products). They allow a merchant to now "},{"asset":"Smokescreen Open Source Project","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://github.com/stripe/smokescreen\n\nStripe's Smokescreen open source project is in scope but severity is evaluated using Stripe specific threat models based on how it is used internally. Reports wo"},{"asset":"Stripe Apps","type":"OTHER","bounty":true,"severity":"critical","instruction":"Vulnerabilities found in third party apps  and their backend infrastructure should be reported to the responsible developer.\nReporters should only report vulnerabilities in Stripe third party apps to "},{"asset":"Stripe Atlas","type":"OTHER","bounty":true,"severity":"critical","instruction":"Startup incorporation\n\nDocs: https://stripe.com/docs/atlas"},{"asset":"Stripe Billing","type":"OTHER","bounty":true,"severity":"critical","instruction":"Create and manage subscriptions, track usage, and issue invoices.\n\nSee Metronome for Stripe's usage-based billing solution. https://docs.stripe.com/billing/usage-based\n\nDocumentation:\n* https://stripe"},{"asset":"Stripe CLI","type":"OTHER","bounty":true,"severity":"critical","instruction":"Use the Stripe CLI to build, test, and manage your integration from the command line. Use the Stripe CLI to perform common tasks such as calling an API, testing a webhooks integration, and creating an"},{"asset":"Stripe Capital","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/capital/how-stripe-capital-works"},{"asset":"Stripe Checkout","type":"OTHER","bounty":true,"severity":"critical","instruction":"Prebuilt, Stripe hosted checkout page\n\nURL: https://checkout.stripe.com/\nDocs: https://stripe.com/docs/payments/checkout\n\nSample Checkout applications:\n* [stripe-samples/checkout-subscription-and-add-"},{"asset":"Stripe Climate","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/climate"},{"asset":"Stripe Connect","type":"OTHER","bounty":true,"severity":"critical","instruction":"Payments for platforms and marketplaces\n\nDocs: https://stripe.com/docs/connect\n\nSample Connect applications:\n* [stripe/stripe-demo-connect-kavholm-marketplace](https://github.com/stripe/stripe-demo-co"},{"asset":"Stripe Dashboard","type":"OTHER","bounty":true,"severity":"critical","instruction":"A user interface to operate and configure your Stripe account.\n\nURL: https://dashboard.stripe.com\nDocs: https://stripe.com/docs/dashboard"},{"asset":"Stripe Data Pipeline","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/stripe-data/access-data-in-warehouse"},{"asset":"Stripe Elements","type":"OTHER","bounty":true,"severity":"critical","instruction":"Secure frontend UI component\n\nDocs: https://stripe.com/docs/stripe-js\n\nSample Stripe Elements application: [stripe/elements-examples](https://github.com/stripe/elements-examples): Stripe Elements exam"},{"asset":"Stripe Financial Connections","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://docs.stripe.com/financial-connections"},{"asset":"Stripe Identity","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/identity"},{"asset":"Stripe Invoicing","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/invoicing"},{"asset":"Stripe Issuing","type":"OTHER","bounty":true,"severity":"critical","instruction":"Card creation\n\nDocs: https://stripe.com/docs/issuing"},{"asset":"Stripe Open Source","type":"OTHER","bounty":true,"severity":"critical","instruction":"Open source projects authored or maintained by Stripe. Only non-archived and non-demo/non-sample projects are in scope. In addition, if a project's README states that the project is not eligible for b"},{"asset":"Stripe Organizations","type":"OTHER","bounty":true,"severity":"critical","instruction":"Organizations is a new grouping entity where Stripe users can group multiple business accounts. With an Organization, users can:\n- Search for resources across all the business accounts in an Organizat"},{"asset":"Stripe Payment Links","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/payment-links"},{"asset":"Stripe Payments","type":"OTHER","bounty":true,"severity":"critical","instruction":"Online payments\n\nDocs: https://stripe.com/docs/payments\n\nSample Payments application: [stripe-samples/accept-a-card-payment](https://github.com/stripe-samples/accept-a-card-payment): Learn how to acce"},{"asset":"Stripe Projects","type":"OTHER","bounty":true,"severity":"critical","instruction":"Stripe Projects lets you or your agents provision multiple services, generate and store credentials, and manage usage and billing from the CLI. Set up hosting, databases, auth, AI, analytics, and more"},{"asset":"Stripe Radar","type":"OTHER","bounty":true,"severity":"critical","instruction":"Fraud and risk management\n\nDocs: https://stripe.com/docs/radar"},{"asset":"Stripe Revenue Recognition","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/revenue-recognition"},{"asset":"Stripe SDKs","type":"OTHER","bounty":true,"severity":"critical","instruction":"Libraries and tools for interacting with your Stripe integration. Includes the Stripe Agent Toolkit.\n\nStripe Agent Toolkit Documentation: https://docs.stripe.com/agents/quickstart\nStripe Agent Toolkit"},{"asset":"Stripe Sigma","type":"OTHER","bounty":true,"severity":"critical","instruction":"Custom reports\n\nDocs: https://stripe.com/docs/sigma"},{"asset":"Stripe Tax","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/tax"},{"asset":"Stripe Terminal","type":"OTHER","bounty":true,"severity":"critical","instruction":"In-person and omnichannel payments\n\nDocs: https://stripe.com/docs/terminal\n\nSample Terminal application: [stripe/stripe-terminal-js-demo](https://github.com/stripe/stripe-terminal-js-demo): Demo app f"},{"asset":"Stripe Treasury","type":"OTHER","bounty":true,"severity":"critical","instruction":"Docs: https://docs.stripe.com/treasury"},{"asset":"Stripe fiat-to-crypto onramp","type":"OTHER","bounty":true,"severity":"critical","instruction":"The Stripe fiat-to-crypto onramp lets your customers securely purchase and exchange cryptocurrencies directly from your platform or decentralized application (Dapp) at checkout. Onramp can be direct e"},{"asset":"Stripe for Visual Studio Code","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tap to Pay (Android)","type":"OTHER","bounty":true,"severity":"critical","instruction":"URL: https://stripe.com/terminal/tap-to-pay\nDocs: https://docs.stripe.com/terminal/payments/setup-reader/tap-to-pay?platform=android"},{"asset":"Tap to Pay (iOS)","type":"OTHER","bounty":true,"severity":"critical","instruction":"URL: https://stripe.com/terminal/tap-to-pay\nDocs: https://docs.stripe.com/terminal/payments/setup-reader/tap-to-pay?platform=ios"},{"asset":"api.stripe.com","type":"URL","bounty":true,"severity":"critical","instruction":"https://stripe.com/docs/api"},{"asset":"api.taxjar.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.taxjar.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.stripe.android.dashboard","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Google Play Store URL: https://play.google.com/store/apps/details?id=com.stripe.android.dashboard&hl=en_US&pli=1"},{"asset":"js.stripe.com","type":"URL","bounty":true,"severity":"critical","instruction":"https://stripe.com/docs/js\n\nSample Stripe.js application: https://github.com/stripe-samples/accept-a-card-payment"},{"asset":"mcp.stripe.com","type":"URL","bounty":true,"severity":"critical","instruction":"https://docs.stripe.com/mcp\n\nStripe's MCP server implements Dynamic Client Registration by design. This enables any MCP-compatible client — Cursor, Claude, VS Code, Windsurf, and the broader ecosystem"},{"asset":"www.stripe.partners","type":"URL","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"77% response, pays"},"slop":{"risk":0.239,"label":"none","experimental":true}},"derived":{"novelty":0.1889,"inverse_crowd":0.1267,"payout_reliability":0.8825,"value_per_competition":0.1124,"triage_quality":0.77,"scope_breadth":0.6715,"crowding_per_asset_month":4.9948,"slop_risk":0.239},"score":{"total":41.3,"parts":{"novelty":0.189,"inverse_crowd":0.127,"payout_reliability":0.882,"value_per_competition":0.112,"triage_quality":0.77,"scope_breadth":0.671},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":52.5},"reasons":[{"sign":"good","text":"paid $419k in the last 90 days"},{"sign":"neutral","text":"959 reports in 90 days across 64 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.3 years"}]},{"id":"hackerone:chaturbate","platform":"hackerone","slug":"chaturbate","name":"Chaturbate","url":"https://hackerone.com/chaturbate","meta":{"reward_min":100,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-09-19T01:16:09.682Z","age_months":97.04087241494601,"reports_90d":26,"resolved_total":309,"response_efficiency":62,"response_indicator":"missed","paid_total":247549,"paid_90d":1050,"last_resolved_at":"2026-09-24T16:20:15.961Z","days_since_resolved":26.05370367853009,"avg_bounty_low":250,"avg_bounty_high":400,"min_bounty":100,"scope_count":19},"scope":[{"asset":"*.cb.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**Caution: Reports about the testbed will be excluded if they do not affect the main site.** However it is useful to test some exploits."},{"asset":"*.highwebmedia.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This domain covers all our main media servers; such as video servers, chat servers, image servers, etc."},{"asset":"*.mmcdn.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Our new CDN Domain, replaces highwebmedia.com"},{"asset":"*.mmwebc.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Our domain for Web Components"},{"asset":"*.securegatewayaccess.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Our billing customer service site. Any access here is critical and must be immediately reported."},{"asset":"billingsupport.chaturbate.com","type":"URL","bounty":true,"severity":"critical","instruction":"Alisas of the billing customer support site."},{"asset":"chaturbate.com","type":"URL","bounty":true,"severity":"critical","instruction":"The main chaturbate site!"},{"asset":"m.chaturbate.com","type":"URL","bounty":true,"severity":"critical","instruction":"The mobile version of Chaturbate"},{"asset":"secure.chaturbate.com","type":"URL","bounty":true,"severity":"critical","instruction":"The billing customer service and signup page"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.02,"label":"none","experimental":true}},"derived":{"novelty":0.1597,"inverse_crowd":0.7195,"payout_reliability":0.7597,"value_per_competition":0.4156,"triage_quality":0.465,"scope_breadth":0.4819,"crowding_per_asset_month":0.4561,"slop_risk":0.02},"score":{"total":41.2,"parts":{"novelty":0.16,"inverse_crowd":0.719,"payout_reliability":0.76,"value_per_competition":0.416,"triage_quality":0.465,"scope_breadth":0.482},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":52.0},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"neutral","text":"26 reports in 90 days across 19 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.1 years"}]},{"id":"hackerone:csg-public","platform":"hackerone","slug":"csg-public","name":"Cloud Software Group","url":"https://hackerone.com/csg-public","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-10-12T19:45:40.005Z","age_months":72.24348465808237,"reports_90d":46,"resolved_total":null,"response_efficiency":47,"response_indicator":"missed","paid_total":543499,"paid_90d":250,"last_resolved_at":"2026-08-31T08:45:36.620Z","days_since_resolved":50.369436791956026,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":50,"scope_count":53},"scope":[{"asset":"*.citrixworkspacesapi.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*developer.cloud.com","type":"URL","bounty":false,"severity":"none","instruction":"This asset is will NOT be eligible for the bounty as this domain is intended for documentation only. Kindly avoid attacking the documentation site."},{"asset":"Citrix End Point Analysis (EPA) client for Linux","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix End Point Analysis (EPA) client for Windows","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix Secure Access client for Android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix Secure Access client for Linux","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix Secure Access client for Windows","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix Secure Access client for iOS","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Citrix Secure Access client for macOS","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"adm.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please note that some UI elements and features of ADM may only become available when an organization has an ADC, MPX, SDX or VPX appliance to onboard into ADM. The most efficient and cost-effective wa"},{"asset":"ap-s.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"api.adm.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the API Gateway for Citrix Application Delivery Management. All traffic between an Agent and Application Delivery Management service is proxied via API Gateway. \n\nAPI Gateway is also responsib"},{"asset":"eu.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"onboarding-*.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"onboarding.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"us.cloud.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 47%"},"slop":{"risk":0.41,"label":"watch","experimental":true}},"derived":{"novelty":0.1795,"inverse_crowd":0.8158,"payout_reliability":0.6493,"value_per_competition":0.4153,"triage_quality":0.3525,"scope_breadth":0.6417,"crowding_per_asset_month":0.2893,"slop_risk":0.41},"score":{"total":41.2,"parts":{"novelty":0.18,"inverse_crowd":0.816,"payout_reliability":0.649,"value_per_competition":0.415,"triage_quality":0.352,"scope_breadth":0.642},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":51.6},"reasons":[{"sign":"good","text":"paid $250 in the last 90 days"},{"sign":"bad","text":"response efficiency only 47%"},{"sign":"neutral","text":"46 reports in 90 days across 53 assets"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:klarna","platform":"hackerone","slug":"klarna","name":"Klarna","url":"https://hackerone.com/klarna","meta":{"reward_min":50,"reward_max":920,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-13T13:05:30.131Z","age_months":29.246454417759903,"reports_90d":364,"resolved_total":69,"response_efficiency":76,"response_indicator":"ok","paid_total":141537,"paid_90d":31715,"last_resolved_at":"2026-10-12T14:35:09.745Z","days_since_resolved":8.126692289641204,"avg_bounty_low":850,"avg_bounty_high":920,"min_bounty":50,"scope_count":24},"scope":[{"asset":"*.klarna.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.klarna.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.klarnacdn.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.pricerunner.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Klarna Android App (com.myklarnamobile)","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Please use your hacker email alias (e.g. h1username@wearehackerone.com) when testing. URL: https://play.google.com/store/apps/details?id=com.myklarnamobile"},{"asset":"Klarna iOS App (com.klarna.app)","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Please use your hacker email alias (e.g. h1username@wearehackerone.com) when testing. URL: https://apps.apple.com/it/app/klarna-shop-now-pay-later/id1115120118"},{"asset":"Merchant Portal","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://portal.playground.klarna.com"},{"asset":"app.klarna.com","type":"API","bounty":true,"severity":"critical","instruction":"Klarna app's API."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"76% response, pays"},"slop":{"risk":0.393,"label":"watch","experimental":true}},"derived":{"novelty":0.2557,"inverse_crowd":0.1251,"payout_reliability":0.8627,"value_per_competition":0.1138,"triage_quality":0.76,"scope_breadth":0.5178,"crowding_per_asset_month":5.0556,"slop_risk":0.393},"score":{"total":41.2,"parts":{"novelty":0.256,"inverse_crowd":0.125,"payout_reliability":0.863,"value_per_competition":0.114,"triage_quality":0.76,"scope_breadth":0.518},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":51.1},"reasons":[{"sign":"good","text":"paid $32k in the last 90 days"},{"sign":"neutral","text":"364 reports in 90 days across 24 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.4 years"}]},{"id":"hackerone:algolia","platform":"hackerone","slug":"algolia","name":"Algolia","url":"https://hackerone.com/algolia","meta":{"reward_min":100,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-11-04T14:58:59.166Z","age_months":131.51901923827856,"reports_90d":64,"resolved_total":329,"response_efficiency":97,"response_indicator":"ok","paid_total":61935,"paid_90d":550,"last_resolved_at":"2026-10-20T08:31:27.901Z","days_since_resolved":0.37925992853009266,"avg_bounty_low":100,"avg_bounty_high":100,"min_bounty":100,"scope_count":4},"scope":[{"asset":"*.algolia.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.algolianet.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"dashboard.algolia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.algolia.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"97% response, paid recently, resolved 0d ago"},"slop":{"risk":0.2,"label":"none","experimental":true}},"derived":{"novelty":0.1416,"inverse_crowd":0.1183,"payout_reliability":0.9842,"value_per_competition":0.0736,"triage_quality":0.97,"scope_breadth":0.2589,"crowding_per_asset_month":5.3333,"slop_risk":0.2},"score":{"total":41.0,"parts":{"novelty":0.142,"inverse_crowd":0.118,"payout_reliability":0.984,"value_per_competition":0.074,"triage_quality":0.97,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":50.7},"reasons":[{"sign":"good","text":"paid $550 in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"64 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.0 years"}]},{"id":"hackerone:vodafone_oman","platform":"hackerone","slug":"vodafone_oman","name":"Vodafone Oman","url":"https://hackerone.com/vodafone_oman","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-08-06T07:54:21.152Z","age_months":26.460945625836565,"reports_90d":110,"resolved_total":20,"response_efficiency":99,"response_indicator":"ok","paid_total":20000,"paid_90d":null,"last_resolved_at":"2026-10-08T05:53:16.861Z","days_since_resolved":12.489109928530093,"avg_bounty_low":1000,"avg_bounty_high":1000,"min_bounty":50,"scope_count":11},"scope":[{"asset":"1589071345","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"App name: My Vodafone Oman"},{"asset":"apix.vodafone.om","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"om.vodafone.mva","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"App name: My Vodafone Oman"},{"asset":"vfo01.vodafone.om","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vfo02.vodafone.om","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vfo03.vodafone.om","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.vodafone.om","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"99% response, no recent payout seen"},"slop":{"risk":0.34,"label":"none","experimental":true}},"derived":{"novelty":0.2658,"inverse_crowd":0.1908,"payout_reliability":0.6691,"value_per_competition":0.161,"triage_quality":0.99,"scope_breadth":0.3997,"crowding_per_asset_month":3.3333,"slop_risk":0.34},"score":{"total":41.0,"parts":{"novelty":0.266,"inverse_crowd":0.191,"payout_reliability":0.669,"value_per_competition":0.161,"triage_quality":0.99,"scope_breadth":0.4},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":50.2},"reasons":[{"sign":"good","text":"99% response efficiency"},{"sign":"neutral","text":"110 reports in 90 days across 11 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.2 years"}]},{"id":"hackerone:coinmate","platform":"hackerone","slug":"coinmate","name":"CoinMate.io","url":"https://hackerone.com/coinmate","meta":{"reward_min":50,"reward_max":50,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-04-08T12:29:41.155Z","age_months":6.413596016360559,"reports_90d":38,"resolved_total":77,"response_efficiency":95,"response_indicator":"ok","paid_total":2795,"paid_90d":50,"last_resolved_at":"2026-08-10T15:44:26.802Z","days_since_resolved":71.07857820399306,"avg_bounty_low":50,"avg_bounty_high":50,"min_bounty":50,"scope_count":null},"scope":[],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["scope_count"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"95% response, pays, last resolved 71d ago"},"slop":{"risk":0.476,"label":"watch","experimental":true}},"derived":{"novelty":0.4487,"inverse_crowd":0.0454,"payout_reliability":0.8658,"value_per_competition":0.029,"triage_quality":0.95,"scope_breadth":0.0,"crowding_per_asset_month":12.6667,"slop_risk":0.476},"score":{"total":40.8,"parts":{"novelty":0.449,"inverse_crowd":0.045,"payout_reliability":0.866,"value_per_competition":0.029,"triage_quality":0.95,"scope_breadth":0.0},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":49.8},"reasons":[{"sign":"good","text":"paid $50 in the last 90 days"},{"sign":"good","text":"95% response efficiency"},{"sign":"neutral","text":"38 reports in 90 days"},{"sign":"neutral","text":"launched 6 months ago"}]},{"id":"hackerone:plaid","platform":"hackerone","slug":"plaid","name":"Plaid","url":"https://hackerone.com/plaid","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-03-05T15:28:42.582Z","age_months":103.52655463412616,"reports_90d":299,"resolved_total":114,"response_efficiency":90,"response_indicator":"ok","paid_total":100000,"paid_90d":10000,"last_resolved_at":"2026-08-20T22:25:22.836Z","days_since_resolved":60.80015188454862,"avg_bounty_low":250,"avg_bounty_high":500,"min_bounty":100,"scope_count":21},"scope":[{"asset":"cdn.plaid.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is on Amazon CloudFront, so the scope here is limited to our content and configuration issues."},{"asset":"dashboard.plaid.com","type":"URL","bounty":true,"severity":"critical","instruction":"Plaid's developer dashboard"},{"asset":"demo.plaid.com","type":"URL","bounty":true,"severity":"medium","instruction":"Demo Plaid developer integration"},{"asset":"https://github.com/plaid/plaid-link-android","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Plaid's drop-in client-side module for authentication. Available for web, mobile web and iOS."},{"asset":"https://github.com/plaid/plaid-link-ios","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Plaid's drop-in client-side module for authentication. Available for web, mobile web and iOS."},{"asset":"https://github.com/plaid/plaid-ruby","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The official Ruby bindings for the Plaid API. It's generated from our OpenAPI schema"},{"asset":"https://github.com/plaid/react-native-plaid-link-sdk","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Plaid Link for React Native"},{"asset":"https://github.com/plaid/react-plaid-link","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"React hooks and components for integrating with the Plaid Link drop module"},{"asset":"my.plaid.com","type":"URL","bounty":true,"severity":"critical","instruction":"Portal for customers to access their information as seen by Plaid apps they have permissioned. https://my.plaid.com"},{"asset":"plaid.com","type":"URL","bounty":true,"severity":"medium","instruction":"Plaid's marketing website, not full *.plaid.com"},{"asset":"production.plaid.com","type":"URL","bounty":true,"severity":"critical","instruction":"Plaid's developer API. Docs: https://plaid.com/docs"},{"asset":"secure.plaid.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is an alias for cdn.plaid.com"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"90% response, pays, last resolved 61d ago"},"slop":{"risk":0.276,"label":"none","experimental":true}},"derived":{"novelty":0.1557,"inverse_crowd":0.1337,"payout_reliability":0.8518,"value_per_competition":0.1092,"triage_quality":0.9,"scope_breadth":0.4972,"crowding_per_asset_month":4.746,"slop_risk":0.276},"score":{"total":40.2,"parts":{"novelty":0.156,"inverse_crowd":0.134,"payout_reliability":0.852,"value_per_competition":0.109,"triage_quality":0.9,"scope_breadth":0.497},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":49.3},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"299 reports in 90 days across 21 assets"},{"sign":"neutral","text":"running 8.6 years"}]},{"id":"hackerone:syfe_bbp","platform":"hackerone","slug":"syfe_bbp","name":"Syfe","url":"https://hackerone.com/syfe_bbp","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-03-19T07:11:14.588Z","age_months":19.069732059785917,"reports_90d":201,"resolved_total":23,"response_efficiency":86,"response_indicator":"ok","paid_total":10000,"paid_90d":5000,"last_resolved_at":"2026-08-19T06:25:07.192Z","days_since_resolved":62.466999616030094,"avg_bounty_low":75,"avg_bounty_high":150,"min_bounty":50,"scope_count":10},"scope":[{"asset":"alfred.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"Trading service APIs."},{"asset":"api-uat-bugbounty.nonprod.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"API domain for the test environment."},{"asset":"api.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"API domain for the user services."},{"asset":"com.syfe","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Syfe android application."},{"asset":"https://apps.apple.com/sg/app/syfe-stay-invested/id1497156434","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Syfe IOS application."},{"asset":"mark8.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"Market data API service."},{"asset":"uat-bugbounty.nonprod.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"The primary test environment for the research is provided. The credentials are only valid for this environment.\nNote: Findings on this environment should be applicable on production."},{"asset":"www.syfe.com","type":"URL","bounty":true,"severity":"critical","instruction":"Main domain for Syfe. \nPlease self sign-up for the accounts only using your ==@wearehackerone.com== address at [https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty](https://www"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"86% response, pays, last resolved 62d ago"},"slop":{"risk":0.591,"label":"watch","experimental":true}},"derived":{"novelty":0.3013,"inverse_crowd":0.0926,"payout_reliability":0.8299,"value_per_competition":0.0658,"triage_quality":0.86,"scope_breadth":0.3857,"crowding_per_asset_month":6.7,"slop_risk":0.591},"score":{"total":40.1,"parts":{"novelty":0.301,"inverse_crowd":0.093,"payout_reliability":0.83,"value_per_competition":0.066,"triage_quality":0.86,"scope_breadth":0.386},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":48.9},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"201 reports in 90 days across 10 assets"},{"sign":"neutral","text":"running 1.6 years"}]},{"id":"hackerone:pixiv","platform":"hackerone","slug":"pixiv","name":"pixiv","url":"https://hackerone.com/pixiv","meta":{"reward_min":200,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-09-17T05:55:16.752Z","age_months":85.10842619470111,"reports_90d":78,"resolved_total":181,"response_efficiency":72,"response_indicator":"missed","paid_total":161171,"paid_90d":13000,"last_resolved_at":"2026-10-08T01:28:59.042Z","days_since_resolved":12.672649500289351,"avg_bounty_low":200,"avg_bounty_high":500,"min_bounty":200,"scope_count":32},"scope":[{"asset":"*.fanbox.cc","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"* This site uses pixiv account (signup at https://accounts.pixiv.net)."},{"asset":"accounts.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"* Signin / signup site for many pixiv products (`*.pixiv.net`, `*.booth.pm`, etc)."},{"asset":"booth.pm","type":"URL","bounty":true,"severity":"critical","instruction":"* This site uses pixiv account (signup at https://accounts.pixiv.net).\n* PC: https://booth.pm"},{"asset":"coban.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"comic-indies.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"/submission is the only part excluded from vulnerability testing"},{"asset":"comic.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"This site is in Japanese.\nThis site uses pixiv account (signup at https://accounts.pixiv.net).\n- Web: https://comic.pixiv.net\n- iOS : https://apps.apple.com/jp/app/pixiv%E3%82%B3%E3%83%9F%E3%83%83%E3%"},{"asset":"dic.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://vroid.com/studio","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hub.vroid.com","type":"URL","bounty":true,"severity":"critical","instruction":"* This site uses pixiv account (signup at https://accounts.pixiv.net).\n* This is a site where users share their 3D characters in [VRM file format](https://vrm.dev/en/).\n* When testing with VRM, please"},{"asset":"neoket.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"novel.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"This site is in Japanese.\nThis site uses pixiv account (signup at https://accounts.pixiv.net).\n- Web: https://novel.pixiv.net"},{"asset":"pastela.app","type":"URL","bounty":true,"severity":"critical","instruction":"- This site uses pixiv account (signup at https://accounts.pixiv.net).\n- PC: https://pastela.app\n- iPadOS: https://apps.apple.com/app/pastela/id6478907270"},{"asset":"payment.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"premium.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sensei.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sketch.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"/lives/ is out of scope for scheduled to be discontinued.\n\n* This site is in Japanese.\n* This site uses pixiv account (signup at https://accounts.pixiv.net).\n* PC: https://sketch.pixiv.net/\n* iOS: htt"},{"asset":"vroid.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.pixiv.net","type":"URL","bounty":true,"severity":"critical","instruction":"* The core pixiv.\n* Signup at https://accounts.pixiv.net\n* PC: https://www.pixiv.net/\n* iOS: https://itunes.apple.com/app/pixiv/id337248563\n* Android:  https://play.google.com/store/apps/details?id=jp"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.046,"label":"none","experimental":true}},"derived":{"novelty":0.1683,"inverse_crowd":0.562,"payout_reliability":0.8337,"value_per_competition":0.3463,"triage_quality":0.54,"scope_breadth":0.5624,"crowding_per_asset_month":0.8125,"slop_risk":0.046},"score":{"total":39.8,"parts":{"novelty":0.168,"inverse_crowd":0.562,"payout_reliability":0.834,"value_per_competition":0.346,"triage_quality":0.54,"scope_breadth":0.562},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":48.4},"reasons":[{"sign":"good","text":"paid $13k in the last 90 days"},{"sign":"neutral","text":"78 reports in 90 days across 32 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 7.1 years"}]},{"id":"hackerone:playstation","platform":"hackerone","slug":"playstation","name":"PlayStation","url":"https://hackerone.com/playstation","meta":{"reward_min":50,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-06-24T15:48:38.189Z","age_months":75.86285564294813,"reports_90d":489,"resolved_total":579,"response_efficiency":79,"response_indicator":"ok","paid_total":1155300,"paid_90d":232950,"last_resolved_at":"2026-10-20T02:54:39.235Z","days_since_resolved":0.6131565257523148,"avg_bounty_low":400,"avg_bounty_high":400,"min_bounty":50,"scope_count":27},"scope":[{"asset":"*.api.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.playstation.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Issues targeting open source libraries or distributions may be redirected to their appropriate supporter depending on issue scope and impact analysis"},{"asset":"*.playstation.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sonyentertainmentnetwork.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"Android Playstation App","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Android PlayStation App\nhttps://play.google.com/store/apps/details?id=com.scee.psxandroid&utm_source=pdcexploreapp"},{"asset":"PlayStation 4","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Console system and operating system"},{"asset":"PlayStation 5","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Console system and operating system"},{"asset":"api.direct.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ca.account.sony.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"checkout.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"compete.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"direct.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iOS Playstation App","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"iOS PlayStation App\nhttps://apps.apple.com/app/apple-store/id410896080?pt=104940801&ct=pdcexploreapp&mt=8"},{"asset":"my.account.sony.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"my.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"profile.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ps5.np.playstation.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"session-share.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"social.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"store.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"transact.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wallets.api.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"web.np.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.playstation.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"79% response, pays"},"slop":{"risk":0.251,"label":"none","experimental":true}},"derived":{"novelty":0.1761,"inverse_crowd":0.1036,"payout_reliability":0.8936,"value_per_competition":0.086,"triage_quality":0.79,"scope_breadth":0.536,"crowding_per_asset_month":6.037,"slop_risk":0.251},"score":{"total":39.6,"parts":{"novelty":0.176,"inverse_crowd":0.104,"payout_reliability":0.894,"value_per_competition":0.086,"triage_quality":0.79,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":48.0},"reasons":[{"sign":"good","text":"paid $233k in the last 90 days"},{"sign":"neutral","text":"489 reports in 90 days across 27 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.3 years"}]},{"id":"hackerone:coinspot","platform":"hackerone","slug":"coinspot","name":"CoinSpot","url":"https://hackerone.com/coinspot","meta":{"reward_min":250,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-04-12T04:12:44.702Z","age_months":66.28530354278843,"reports_90d":63,"resolved_total":95,"response_efficiency":88,"response_indicator":"ok","paid_total":442000,"paid_90d":78000,"last_resolved_at":"2026-09-21T01:15:55.415Z","days_since_resolved":29.681719257233798,"avg_bounty_low":1000,"avg_bounty_high":1000,"min_bounty":250,"scope_count":4},"scope":[{"asset":"1541949985","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":null},{"asset":"com.coinspot.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":null},{"asset":"https://www.coinspot.com.au/v2/api","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.coinspot.com.au","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 30d ago"},"slop":{"risk":0.216,"label":"none","experimental":true}},"derived":{"novelty":0.1857,"inverse_crowd":0.1203,"payout_reliability":0.8838,"value_per_competition":0.1116,"triage_quality":0.88,"scope_breadth":0.2589,"crowding_per_asset_month":5.25,"slop_risk":0.216},"score":{"total":39.5,"parts":{"novelty":0.186,"inverse_crowd":0.12,"payout_reliability":0.884,"value_per_competition":0.112,"triage_quality":0.88,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":47.5},"reasons":[{"sign":"good","text":"paid $78k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"63 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.5 years"}]},{"id":"hackerone:palantir_public","platform":"hackerone","slug":"palantir_public","name":"Palantir Public","url":"https://hackerone.com/palantir_public","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-03-28T18:08:44.113Z","age_months":54.76725676698798,"reports_90d":48,"resolved_total":58,"response_efficiency":57,"response_indicator":"missed","paid_total":146875,"paid_90d":16500,"last_resolved_at":"2026-10-06T15:11:19.702Z","days_since_resolved":14.101577046585648,"avg_bounty_low":250,"avg_bounty_high":500,"min_bounty":50,"scope_count":25},"scope":[{"asset":"Any public (Internet-facing) infrastructure owned and operated by Palantir.","type":"OTHER","bounty":true,"severity":"critical","instruction":"This is an expansive scope to help you identify security issues in any Internet-facing infrastructure we run. \n\nAll domains and subdomains owned and operated by Palantir are included within the scope."},{"asset":"Any public cloud (e.g. Amazon AWS, Microsoft Azure) resource or infrastructure operated and managed by Palantir.","type":"OTHER","bounty":true,"severity":"critical","instruction":"- Public cloud storage accounts. (e.g. AWS S3 buckets, Azure data blobs)\n- Public cloud compute servers. (e.g. AWS EC2 instances, Azure Virtual Machines)"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.056,"label":"none","experimental":true}},"derived":{"novelty":0.2002,"inverse_crowd":0.6308,"payout_reliability":0.756,"value_per_competition":0.3828,"triage_quality":0.4275,"scope_breadth":0.5241,"crowding_per_asset_month":0.64,"slop_risk":0.056},"score":{"total":39.4,"parts":{"novelty":0.2,"inverse_crowd":0.631,"payout_reliability":0.756,"value_per_competition":0.383,"triage_quality":0.427,"scope_breadth":0.524},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":47.1},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"neutral","text":"48 reports in 90 days across 25 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.6 years"}]},{"id":"hackerone:logitech","platform":"hackerone","slug":"logitech","name":"Logitech","url":"https://hackerone.com/logitech","meta":{"reward_min":200,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-10-07T15:30:32.309Z","age_months":72.41357656469124,"reports_90d":356,"resolved_total":1309,"response_efficiency":71,"response_indicator":"missed","paid_total":309200,"paid_90d":15675,"last_resolved_at":"2026-10-14T13:41:15.463Z","days_since_resolved":6.164126109085648,"avg_bounty_low":350,"avg_bounty_high":500,"min_bounty":200,"scope_count":114},"scope":[{"asset":"*.cognitiveperformer.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":null},{"asset":"*.crossclip.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.harmonyremote.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.logi.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Other logi.com domains not explicitly listed."},{"asset":"*.logicool.co.jp","type":"WILDCARD","bounty":false,"severity":"medium","instruction":null},{"asset":"*.logitech-channel-marketing.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.logitech.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Other logitech websites not explicitly listed"},{"asset":"*.logitech.io","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"Other domains under logitech.io not explicitly listed."},{"asset":"*.logitechauthorization.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.logitechg.com*","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.logitechmusic.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This domain is for a legacy product. We will accept reports, but resolving times may be long for lower priority issues as there are limited customer's still using it."},{"asset":"*.lucra.live","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.lukwerks.com","type":"WILDCARD","bounty":false,"severity":"medium","instruction":null},{"asset":"*.melonapp.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.mevo.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.myharmony.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This domain is for a legacy product. We will accept reports, but resolving times may be long for lower priority issues as there are limited customer's still using it."},{"asset":"*.mysqueezebox.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.oslo.io","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.slimdevices.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This domain is for a legacy product. We will accept reports, but resolving times may be long for lower priority issues as there are limited customer's still using it."},{"asset":"*.streamlabs.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.streamlabscharity.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.uesmartradio.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":"This domain is for a legacy product. We will accept reports, but resolving times may be long for lower priority issues as there are limited customer's still using it."},{"asset":"*.ultimateearsuniversity.com","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*.wlo.link","type":"WILDCARD","bounty":false,"severity":"critical","instruction":null},{"asset":"*vc.logitech.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1018340690","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This is the iOS app for the Circle ecosystem of devices,"},{"asset":"1294578643","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This app is Streamlabs: Stream Live by Streamlabs"},{"asset":"1456293789","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"This app is Logi Tune by Logitech Inc."},{"asset":"1476615877","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This app is Streamlabs Deck by Streamlabs"},{"asset":"632344648","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"App: BOOM & MEGABOOM by Ultimate Ears"},{"asset":"Circle Cameras","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Please note exploits resulting from physical hacks to the device itself are out of scope, and any received reports will be marked N/A in accordance with HackerOne policy. Please refrain from submittin"},{"asset":"G Hub","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Only the latest version of GHub is in scope."},{"asset":"Harmony Remote Software","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"critical","instruction":"The Harmony Desktop software for PC / MAC."},{"asset":"Harmony Remotes","type":"HARDWARE","bounty":false,"severity":"high","instruction":"In scope products: Harmony Elite, Harmony 950, Harmony Companion, Harmony Hub, Harmony 665, Harmony 350 Control."},{"asset":"Logi Options+ PC/MAC","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Logi Options+ software lets you configure your Logitech device.\nThe latest version is eligible (PC & MAC)."},{"asset":"Logi Tune PC/MAC","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Logi Tune Desktop application for PC and MAC reports are eligible as long as they are on the latest version."},{"asset":"Logitech MIXLINE","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"Logitech Mice & Keyboards","type":"HARDWARE","bounty":true,"severity":"high","instruction":"The current generation of Logitech Keyboards and Mouses."},{"asset":"Logitech Options PC/MAC","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"high","instruction":"Logitech Options software lets you customize your Logitech device.\nThe latest version is eligible (PC & MAC)."},{"asset":"Logitech Sync","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"This is Sync Desktop Application by Logitech. The latest version is eligible."},{"asset":"Other Logitech Desktop and Mobile Application","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"critical","instruction":"This covers all Logitech Desktop and Mobile applications not specifically defined by other assets."},{"asset":"Other Logitech Hardware/IoT","type":"HARDWARE","bounty":false,"severity":"critical","instruction":"Other current generations Hardware/IoT devices not explicitly listed in the asset list.\nLogitech Security Team might reward a report up to their discretion."},{"asset":"Presentation Remotes","type":"HARDWARE","bounty":true,"severity":"high","instruction":"In-scope devices: R500 Laser Presentation Remote; Spotlight Presentation Remote; R400 Laser Presentation Remote; R700 Laser Presentation Remote"},{"asset":"Scope Questions: Items not explicitly listed here","type":"OTHER","bounty":false,"severity":"critical","instruction":"If you have a question about something that is not explicitly listed (or falls under a wildcard domain), please submit a report and we will provide clarification. We will allow you to self close that "},{"asset":"Streamlabs Desktop Application PC/MAC","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"The latest version is eligible"},{"asset":"USB Unifying and LightSpeed Receivers","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Ultimate Ears Speakers","type":"HARDWARE","bounty":true,"severity":"medium","instruction":"Products in scope are the current generation \nBLAST, MEGABLAST, BOOM 3, MEGABOOM 3, WONDERBOOM 2, HYPERBOOM, POWER UP"},{"asset":"Video Conferencing Products","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"All products running their latest firmware listed in the page below are eligible:\nhttps://www.logitech.com/en-us/video-collaboration/products"},{"asset":"accounts.logi.com","type":"URL","bounty":true,"severity":"critical","instruction":"Non production testing site exists under sandbox.accounts.logi.com"},{"asset":"alert.logitech.com","type":"URL","bounty":false,"severity":"high","instruction":null},{"asset":"buy.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":"The service hosted on buy.logitech.com is provided by a 3rd party called Digital River. We will forward reports to them."},{"asset":"circle.logi.com","type":"URL","bounty":true,"severity":"critical","instruction":"Also includes the *.video.logi.com and *.circle.logi.com\nSee developer documentation at https://developers.logitech.com/circle"},{"asset":"com.logitech.circle","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This app is part of the Circle ecosystem of camera devices."},{"asset":"com.logitech.logue","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"This App is Logi Tune for Zone Headsets by Logitech"},{"asset":"com.logitech.ueboom","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"App: BOOM & MEGABOOM by Ultimate Ears"},{"asset":"com.streamlabs","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is the \"Streamlabs: Live Streaming\" App by Streamlabs"},{"asset":"com.streamlabs.slobsrc","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"community.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"external.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":"Also includes: vcp-external.logitech.com and external-qa.logitech.com"},{"asset":"feedback.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"gaming.logicool.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.logitech.com/blog","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"id.logi.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"jira.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":"Also includes jira.logitech.io"},{"asset":"logilife.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"logiq.logitech.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"logitech.zendesk.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"logitechg.com.cn","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"logitechgchallenge.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"maintenance.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"outage.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"outagehistory.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"partner.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"select.logitech.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"support.logi.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"sync.logitech.com","type":"URL","bounty":true,"severity":"critical","instruction":"Cloud service associated with the Logitech Sync application"},{"asset":"www.astrogaming.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.jaybirdsport.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"www.logicool.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.logitech-partner.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"www.logitech.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.logitech.com.cn","type":"URL","bounty":true,"severity":"critical","instruction":"Ineligible for bounty: \nstore.logitech.com.cn is a hosted 3rd party service, so we will forward any reports onto the vendor."},{"asset":"www.logitechclub.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"www.logitechg.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.logitechstore.com.br","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"www.ultimateears.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.048,"label":"none","experimental":true}},"derived":{"novelty":0.1793,"inverse_crowd":0.488,"payout_reliability":0.8418,"value_per_competition":0.3076,"triage_quality":0.5325,"scope_breadth":0.7633,"crowding_per_asset_month":1.0409,"slop_risk":0.048},"score":{"total":39.3,"parts":{"novelty":0.179,"inverse_crowd":0.488,"payout_reliability":0.842,"value_per_competition":0.308,"triage_quality":0.532,"scope_breadth":0.763},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":46.6},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"neutral","text":"356 reports in 90 days across 114 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:sheer_bbp","platform":"hackerone","slug":"sheer_bbp","name":"Sheer","url":"https://hackerone.com/sheer_bbp","meta":{"reward_min":50,"reward_max":228,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-01-25T15:18:15.179Z","age_months":32.82453448164309,"reports_90d":41,"resolved_total":111,"response_efficiency":90,"response_indicator":"ok","paid_total":57038,"paid_90d":3310,"last_resolved_at":"2026-08-27T16:05:43.678Z","days_since_resolved":54.06379954658565,"avg_bounty_low":150,"avg_bounty_high":228,"min_bounty":50,"scope_count":2},"scope":[{"asset":"my.sheer.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.sheer.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"90% response, pays, last resolved 54d ago"},"slop":{"risk":0.261,"label":"none","experimental":true}},"derived":{"novelty":0.2445,"inverse_crowd":0.0906,"payout_reliability":0.8597,"value_per_competition":0.07,"triage_quality":0.9,"scope_breadth":0.1767,"crowding_per_asset_month":6.8333,"slop_risk":0.261},"score":{"total":38.5,"parts":{"novelty":0.245,"inverse_crowd":0.091,"payout_reliability":0.86,"value_per_competition":0.07,"triage_quality":0.9,"scope_breadth":0.177},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":46.2},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"41 reports in 90 days across 2 assets"},{"sign":"neutral","text":"running 2.7 years"}]},{"id":"hackerone:moneybird","platform":"hackerone","slug":"moneybird","name":"Moneybird","url":"https://hackerone.com/moneybird","meta":{"reward_min":50,"reward_max":50,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-04-13T12:16:10.666Z","age_months":126.23320605856908,"reports_90d":57,"resolved_total":209,"response_efficiency":84,"response_indicator":"ok","paid_total":10000,"paid_90d":5000,"last_resolved_at":"2026-10-19T07:04:36.079Z","days_since_resolved":1.4395819424189815,"avg_bounty_low":50,"avg_bounty_high":50,"min_bounty":50,"scope_count":4},"scope":[{"asset":"com.moneybird.Moneybird","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.moneybird.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"moneybird.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"moneybirdstorage.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"84% response, paid recently, resolved 1d ago"},"slop":{"risk":0.182,"label":"none","experimental":true}},"derived":{"novelty":0.1439,"inverse_crowd":0.1336,"payout_reliability":0.9168,"value_per_competition":0.069,"triage_quality":0.84,"scope_breadth":0.2589,"crowding_per_asset_month":4.75,"slop_risk":0.182},"score":{"total":38.4,"parts":{"novelty":0.144,"inverse_crowd":0.134,"payout_reliability":0.917,"value_per_competition":0.069,"triage_quality":0.84,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":45.7},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"57 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.5 years"}]},{"id":"hackerone:smtp2go","platform":"hackerone","slug":"smtp2go","name":"SMTP2GO BBP","url":"https://hackerone.com/smtp2go","meta":{"reward_min":100,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-03-15T02:22:33.486Z","age_months":55.21594892114419,"reports_90d":106,"resolved_total":312,"response_efficiency":86,"response_indicator":"ok","paid_total":95800,"paid_90d":9800,"last_resolved_at":"2026-10-13T07:49:06.380Z","days_since_resolved":7.408675680844907,"avg_bounty_low":150,"avg_bounty_high":300,"min_bounty":100,"scope_count":4},"scope":[{"asset":"api.smtp2go.com","type":"URL","bounty":true,"severity":"critical","instruction":"Most of the endpoints are handled by Flask on Python3 with Postgres as a main database.\nNewer endpoints use Go on Gin framework.\nRedis is mostly used for cache and ratelimitting.\n\nInstructions and doc"},{"asset":"app.smtp2go.com","type":"URL","bounty":true,"severity":"critical","instruction":"Flask based app running on Python 2.7, some pages are VueJS but most are scripted with custom JQuery.\nCreate a free account in order to gain login access."},{"asset":"smtp2go.com","type":"URL","bounty":true,"severity":"critical","instruction":"Standard Wordpress site hosted with WPEngine, scripting is all custom JQuery based."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 7d ago"},"slop":{"risk":0.332,"label":"none","experimental":true}},"derived":{"novelty":0.1996,"inverse_crowd":0.0682,"payout_reliability":0.9142,"value_per_competition":0.0586,"triage_quality":0.86,"scope_breadth":0.2589,"crowding_per_asset_month":8.8333,"slop_risk":0.332},"score":{"total":38.2,"parts":{"novelty":0.2,"inverse_crowd":0.068,"payout_reliability":0.914,"value_per_competition":0.059,"triage_quality":0.86,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":45.2},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"106 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.6 years"}]},{"id":"hackerone:evernote","platform":"hackerone","slug":"evernote","name":"Evernote","url":"https://hackerone.com/evernote","meta":{"reward_min":150,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-10-15T18:31:12.280Z","age_months":60.15483446605255,"reports_90d":185,"resolved_total":172,"response_efficiency":78,"response_indicator":"ok","paid_total":157175,"paid_90d":15850,"last_resolved_at":"2026-07-17T13:12:35.891Z","days_since_resolved":95.18402856278935,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":150,"scope_count":15},"scope":[{"asset":"281796108","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"406056744","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"MacOS"},{"asset":"9wzdncrfj3mb","type":"WINDOWS_APP_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.evernote.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.stage.evernote.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is the staging environment for accounts.evernote.com; vulnerabilities found here will not be eligible for bounty unless the vulnerability is also present in production."},{"asset":"api.evernote.com","type":"URL","bounty":true,"severity":"critical","instruction":"api.evernote.com is the API gateway into Evernote's microservice infrastructure. The microservice infrastructure is managed by Istio and is provisioned by Google Kubernetes Engine (GKE). Traffic is HT"},{"asset":"api.stage.evernote.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is the staging environment for api.evernote.com; vulnerabilities found in this staging environment are not eligible for bounty *unless the vulnerability is verified in the corresponding productio"},{"asset":"com.evernote","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"www.evernote.com","type":"URL","bounty":true,"severity":"critical","instruction":"www.evernote.com serves the main Evernote web app. It also exposes several HTTP and Thrift endpoints that the Evernote mobile/desktop apps use to communicate with the service. Almost all endpoints on "}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"78% response, pays, last resolved 95d ago"},"slop":{"risk":0.191,"label":"none","experimental":true}},"derived":{"novelty":0.1929,"inverse_crowd":0.1549,"payout_reliability":0.7595,"value_per_competition":0.1228,"triage_quality":0.78,"scope_breadth":0.446,"crowding_per_asset_month":4.1111,"slop_risk":0.191},"score":{"total":38.0,"parts":{"novelty":0.193,"inverse_crowd":0.155,"payout_reliability":0.759,"value_per_competition":0.123,"triage_quality":0.78,"scope_breadth":0.446},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":44.8},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"neutral","text":"185 reports in 90 days across 15 assets"},{"sign":"neutral","text":"running 5.0 years"}]},{"id":"hackerone:starbucks_japan","platform":"hackerone","slug":"starbucks_japan","name":"Starbucks Japan","url":"https://hackerone.com/starbucks_japan","meta":{"reward_min":50,"reward_max":530,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-11-06T18:12:27.800Z","age_months":23.424255897340103,"reports_90d":23,"resolved_total":20,"response_efficiency":70,"response_indicator":"missed","paid_total":11610,"paid_90d":1150,"last_resolved_at":"2026-10-17T03:02:33.712Z","days_since_resolved":3.60766489380787,"avg_bounty_low":500,"avg_bounty_high":530,"min_bounty":50,"scope_count":7},"scope":[{"asset":"Starbucks Japan Android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Download the App:\nhttps://play.google.com/store/apps/details?id=com.starbucks.jp"},{"asset":"Starbucks Japan iOS","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Download the App:\nhttps://apps.apple.com/jp/app/%E3%82%B9%E3%82%BF%E3%83%BC%E3%83%90%E3%83%83%E3%82%AF%E3%82%B9-%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3%E5%85%AC%E5%BC%8F%E3%83%A2%E3%83%90%E3%82%A4%E3%83%"},{"asset":"cart.starbucks.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gift.starbucks.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.starbucks.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.cart.starbucks.co.jp/","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks Japan"},{"asset":"www.starbucks.co.jp","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks Japan"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.085,"label":"none","experimental":true}},"derived":{"novelty":0.2785,"inverse_crowd":0.4727,"payout_reliability":0.8421,"value_per_competition":0.3024,"triage_quality":0.525,"scope_breadth":0.3345,"crowding_per_asset_month":1.0952,"slop_risk":0.085},"score":{"total":38.0,"parts":{"novelty":0.279,"inverse_crowd":0.473,"payout_reliability":0.842,"value_per_competition":0.302,"triage_quality":0.525,"scope_breadth":0.334},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":44.3},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"neutral","text":"23 reports in 90 days across 7 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.0 years"}]},{"id":"hackerone:sorare","platform":"hackerone","slug":"sorare","name":"Sorare","url":"https://hackerone.com/sorare","meta":{"reward_min":50,"reward_max":600,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-04-01T09:23:39.065Z","age_months":54.64781994593695,"reports_90d":86,"resolved_total":89,"response_efficiency":80,"response_indicator":"ok","paid_total":83407,"paid_90d":8300,"last_resolved_at":"2026-10-16T09:25:17.400Z","days_since_resolved":4.341881467881945,"avg_bounty_low":400,"avg_bounty_high":600,"min_bounty":50,"scope_count":4},"scope":[{"asset":"api.sorare.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Sorare's GraphQL Open API. More documentation about the API can be found on GitHub: https://github.com/sorare/api"},{"asset":"sorare.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Sorare's main application."},{"asset":"ws.sorare.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is Sorare's WebSocket domain, providing GraphQL subscriptions capabilities as described in https://github.com/sorare/api#subscribing-to-graphql-events"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"80% response, paid recently, resolved 4d ago"},"slop":{"risk":0.297,"label":"none","experimental":true}},"derived":{"novelty":0.2004,"inverse_crowd":0.086,"payout_reliability":0.8906,"value_per_competition":0.0791,"triage_quality":0.8,"scope_breadth":0.2589,"crowding_per_asset_month":7.1667,"slop_risk":0.297},"score":{"total":37.8,"parts":{"novelty":0.2,"inverse_crowd":0.086,"payout_reliability":0.891,"value_per_competition":0.079,"triage_quality":0.8,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[],"percentile":43.9},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"good","text":"80% response efficiency"},{"sign":"neutral","text":"86 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.6 years"}]},{"id":"hackerone:redox_bbp","platform":"hackerone","slug":"redox_bbp","name":"Redox","url":"https://hackerone.com/redox_bbp","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-07-11T16:06:51.389Z","age_months":39.328559042446194,"reports_90d":71,"resolved_total":44,"response_efficiency":90,"response_indicator":"ok","paid_total":38309,"paid_90d":2500,"last_resolved_at":"2026-01-23T19:22:18.037Z","days_since_resolved":269.9272907618634,"avg_bounty_low":150,"avg_bounty_high":200,"min_bounty":50,"scope_count":29},"scope":[{"asset":"10x.redoxengine.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"docs.redoxengine.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"explore.redoxengine.com","type":"URL","bounty":true,"severity":"medium","instruction":"This is a marketing site with all public information. Findings here have lesser security implication than our application"},{"asset":"fhir.redoxengine.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"help.redoxengine.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"test*.redoxengine.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"testapi.redoxengine.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"testapp.redoxengine.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.redoxengine.com","type":"URL","bounty":true,"severity":"medium","instruction":"This is our wordpress marketing site.  Findings here have lesser security implication than our application"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 270 days"},"slop":{"risk":0.094,"label":"none","experimental":true}},"derived":{"novelty":0.2279,"inverse_crowd":0.5607,"payout_reliability":0.76,"value_per_competition":0.2949,"triage_quality":0.9,"scope_breadth":0.5471,"crowding_per_asset_month":0.8161,"slop_risk":0.094},"score":{"total":37.5,"parts":{"novelty":0.228,"inverse_crowd":0.561,"payout_reliability":0.76,"value_per_competition":0.295,"triage_quality":0.9,"scope_breadth":0.547},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15}],"percentile":43.4},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"good","text":"90% response efficiency"},{"sign":"neutral","text":"71 reports in 90 days across 29 assets"},{"sign":"bad","text":"nothing resolved for 270 days"},{"sign":"neutral","text":"running 3.3 years"}]},{"id":"hackerone:payoneer","platform":"hackerone","slug":"payoneer","name":"Payoneer","url":"https://hackerone.com/payoneer","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-01-26T09:34:45.589Z","age_months":56.783090109447485,"reports_90d":50,"resolved_total":133,"response_efficiency":68,"response_indicator":"missed","paid_total":174500,"paid_90d":6350,"last_resolved_at":"2026-10-14T10:19:10.592Z","days_since_resolved":6.304460264178241,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":15},"scope":[{"asset":"*.payoneer.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://greenchannel.payoneer.com.cn/gcportal","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"myaccount-cn.payoneer.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please use @wearehackerone.com for test accounts."},{"asset":"myaccount.payoneer.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please sign-up (self-registration) and use the following test accounts: @wearehackerone.com"},{"asset":"payoneer.com.cn","type":"URL","bounty":true,"severity":"critical","instruction":"Payoneer China"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.055,"label":"none","experimental":true}},"derived":{"novelty":0.1974,"inverse_crowd":0.4684,"payout_reliability":0.8265,"value_per_competition":0.3167,"triage_quality":0.51,"scope_breadth":0.446,"crowding_per_asset_month":1.1111,"slop_risk":0.055},"score":{"total":36.6,"parts":{"novelty":0.197,"inverse_crowd":0.468,"payout_reliability":0.826,"value_per_competition":0.317,"triage_quality":0.51,"scope_breadth":0.446},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":43.0},"reasons":[{"sign":"good","text":"paid $6k in the last 90 days"},{"sign":"neutral","text":"50 reports in 90 days across 15 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.7 years"}]},{"id":"hackerone:1win_com","platform":"hackerone","slug":"1win_com","name":"1win","url":"https://hackerone.com/1win_com","meta":{"reward_min":50,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-04-01T10:19:05.111Z","age_months":6.646555193484295,"reports_90d":408,"resolved_total":20,"response_efficiency":100,"response_indicator":"ok","paid_total":53850,"paid_90d":21300,"last_resolved_at":"2026-09-29T10:18:17.038Z","days_since_resolved":21.305080102141204,"avg_bounty_low":225,"avg_bounty_high":400,"min_bounty":50,"scope_count":12},"scope":[{"asset":"1w.cash","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"1w.run","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"1win.com","type":"URL","bounty":true,"severity":"critical","instruction":"- Registration\n- Login\n- Deposit\n- Withdrawal\n- Personal account(settings, voucher, details, etc)\n\n**Here is an incomplete list of countries where the 1win.com website is available: Brazil, Albania, V"},{"asset":"1wintoken.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"1wtoken.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"Deposit/Withdraw","type":"OTHER","bounty":true,"severity":"critical","instruction":"In scope:\n- Payment forms and integrations hosted on 1win.com, including processing of redirect responses and callbacks.\n\nOut of scope:\n- Infrastructure and APIs of external payment providers (vulnera"},{"asset":"https://1win.com/betting","type":"URL","bounty":true,"severity":"critical","instruction":"Here is an incomplete list of countries where the 1win.com website is available: Brazil, Albania, Vietnam, Gibraltar, Zimbabwe, Israel, Indonesia, Malaysia, Kuwait, Jamaica, Japan, Panama, Thailand, T"},{"asset":"https://1win.com/casino","type":"URL","bounty":true,"severity":"critical","instruction":"All games available at https://1win.com/casino fall within the scope of the program."},{"asset":"https://solscan.io/account/B2RFzpckwjtHXHMrPMKarg6Cj6xkSdT6mru4gJiJE87L","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://solscan.io/account/GWvQinGBRa7ZUzhXY23MrLjdsx3KfRGxH8yXURBwrz1R","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://solscan.io/account/sxzuA7TuRvjVbrXkJUgrYq2hfjVf3RFd8WFaSxt2rYm","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 21d ago"},"slop":{"risk":0.808,"label":"elevated","experimental":true}},"derived":{"novelty":0.4432,"inverse_crowd":0.0515,"payout_reliability":0.9578,"value_per_competition":0.0491,"triage_quality":1.0,"scope_breadth":0.4126,"crowding_per_asset_month":11.3333,"slop_risk":0.808},"score":{"total":36.6,"parts":{"novelty":0.443,"inverse_crowd":0.052,"payout_reliability":0.958,"value_per_competition":0.049,"triage_quality":1.0,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":42.5},"reasons":[{"sign":"good","text":"paid $21k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"408 reports in 90 days across 12 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 7 months ago"}]},{"id":"hackerone:cs_money","platform":"hackerone","slug":"cs_money","name":"CS Money","url":"https://hackerone.com/cs_money","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-09-28T08:05:19.179Z","age_months":72.71942230581223,"reports_90d":27,"resolved_total":151,"response_efficiency":56,"response_indicator":"missed","paid_total":123449,"paid_90d":3800,"last_resolved_at":"2026-10-16T09:58:07.899Z","days_since_resolved":4.319074766493055,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":50,"scope_count":12},"scope":[{"asset":"3d.cs.money","type":"URL","bounty":true,"severity":"medium","instruction":"[3d.cs.money](https://3d.cs.money/) is a skin model generator.\n\n## What to look for:\n\n* Vulnerabilities related to user privacy violations\n* Vulnerabilities directly affecting `cs.money`"},{"asset":"blog.cs.money","type":"URL","bounty":true,"severity":"critical","instruction":"By visiting this domain you will be redirected to our blog at [cs.money/blog/](https://cs.money/blog/). This is a web application built on Wordpress. \n\nOut of Scope\nWordPress Core Vulnerabilities\nAny "},{"asset":"cs.money","type":"URL","bounty":true,"severity":"critical","instruction":"[cs.money](https://cs.money/) is our primary web application where users can trade, sell and buy in-game items.\n\n## What to look for:\n* Besides the described scope on our policy tab, please pay attent"},{"asset":"support.cs.money","type":"URL","bounty":true,"severity":"critical","instruction":"This is our [web client](https://support.cs.money/) for providing technical support.\n\n## What to look for:\n* Direct access to the client, authentication bypass\n* Vulnerabilities related to user privac"},{"asset":"wiki.cs.money","type":"URL","bounty":true,"severity":"medium","instruction":"[wiki.cs.money](https://wiki.cs.money/) contains detailed description and characteristics of all CS2 skins as well as a unique 3D viewing system.\n\n## What to look for:\n* Vulnerabilities related to use"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.034,"label":"none","experimental":true}},"derived":{"novelty":0.179,"inverse_crowd":0.5855,"payout_reliability":0.7706,"value_per_competition":0.3293,"triage_quality":0.42,"scope_breadth":0.4126,"crowding_per_asset_month":0.75,"slop_risk":0.034},"score":{"total":36.5,"parts":{"novelty":0.179,"inverse_crowd":0.585,"payout_reliability":0.771,"value_per_competition":0.329,"triage_quality":0.42,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":42.1},"reasons":[{"sign":"good","text":"paid $4k in the last 90 days"},{"sign":"neutral","text":"27 reports in 90 days across 12 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.1 years"}]},{"id":"hackerone:common_codes","platform":"hackerone","slug":"common_codes","name":"d-you App & German EUDI Wallet Ecosystem","url":"https://hackerone.com/common_codes","meta":{"reward_min":50,"reward_max":4000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-09-16T08:59:36.065Z","age_months":1.128861470007225,"reports_90d":913,"resolved_total":0,"response_efficiency":84,"response_indicator":"ok","paid_total":10000,"paid_90d":10000,"last_resolved_at":null,"days_since_resolved":null,"avg_bounty_low":3000,"avg_bounty_high":4000,"min_bounty":50,"scope_count":19},"scope":[{"asset":"d-you Wallet Android Test","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"d-you Wallet iOS Test","type":"TESTFLIGHT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/status-lists","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/mdvm","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/pns","type":"API","bounty":true,"severity":"high","instruction":null},{"asset":"https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/rwsca","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/wpb","type":"API","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["last_resolved_at"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"84% response, pays"},"slop":{"risk":0.977,"label":"elevated","experimental":true}},"derived":{"novelty":0.7392,"inverse_crowd":0.0346,"payout_reliability":0.7235,"value_per_competition":0.0492,"triage_quality":0.84,"scope_breadth":0.4819,"crowding_per_asset_month":16.0175,"slop_risk":0.977},"score":{"total":36.3,"parts":{"novelty":0.739,"inverse_crowd":0.035,"payout_reliability":0.723,"value_per_competition":0.049,"triage_quality":0.84,"scope_breadth":0.482},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":41.6},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"913 reports in 90 days across 19 assets"},{"sign":"neutral","text":"launched 1 months ago"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:goodrx","platform":"hackerone","slug":"goodrx","name":"GoodRx","url":"https://hackerone.com/goodrx","meta":{"reward_min":100,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-01-30T00:17:24.016Z","age_months":80.68081677041029,"reports_90d":25,"resolved_total":216,"response_efficiency":84,"response_indicator":"ok","paid_total":70000,"paid_90d":null,"last_resolved_at":"2026-03-18T13:11:37.185Z","days_since_resolved":216.18470803038196,"avg_bounty_low":250,"avg_bounty_high":300,"min_bounty":100,"scope_count":26},"scope":[{"asset":"com.goodrx","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Playstore Download: https://play.google.com/store/apps/details?id=com.goodrx"},{"asset":"com.goodrx.iphone","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"iOS Download: https://itunes.apple.com/app/id485357017"},{"asset":"www.goodrx.com","type":"URL","bounty":true,"severity":"critical","instruction":"This our primary site. Our mobile site m.goodrx.com is also covered by this scope. Only issues regarding the frontend of https://www.goodrx.com/care will be considered in-scope. Any backend issue is b"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 216 days"},"slop":{"risk":0.016,"label":"none","experimental":true}},"derived":{"novelty":0.1719,"inverse_crowd":0.7966,"payout_reliability":0.4381,"value_per_competition":0.4364,"triage_quality":0.84,"scope_breadth":0.5302,"crowding_per_asset_month":0.3205,"slop_risk":0.016},"score":{"total":35.9,"parts":{"novelty":0.172,"inverse_crowd":0.797,"payout_reliability":0.438,"value_per_competition":0.436,"triage_quality":0.84,"scope_breadth":0.53},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15}],"percentile":41.2},"reasons":[{"sign":"good","text":"84% response efficiency"},{"sign":"neutral","text":"25 reports in 90 days across 26 assets"},{"sign":"bad","text":"nothing resolved for 216 days"},{"sign":"neutral","text":"running 6.7 years"}]},{"id":"hackerone:pingidentity","platform":"hackerone","slug":"pingidentity","name":"Ping Identity","url":"https://hackerone.com/pingidentity","meta":{"reward_min":125,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-01-08T21:37:21.516Z","age_months":81.37440658712639,"reports_90d":86,"resolved_total":131,"response_efficiency":60,"response_indicator":"missed","paid_total":148900,"paid_90d":12650,"last_resolved_at":"2026-09-24T16:17:58.639Z","days_since_resolved":26.055293053530093,"avg_bounty_low":300,"avg_bounty_high":300,"min_bounty":125,"scope_count":31},"scope":[{"asset":"api.ort-one-pingone.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"apps.ort-one-pingone.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth.ort-one-pingone.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"console.ort-one-pingone.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://console.ort-one-pingone.com/?env=361b34ef-2725-4fd9-af1b-a2b189df3d05","type":"URL","bounty":true,"severity":"critical","instruction":"You will need to reset the one-time-use password upon your first login, and possibly to register your HackerOne email address as a MFA method."},{"asset":"https://console.ort-one-pingone.com/?env=7f327541-54e0-4ba4-8335-65eac2a25b5e","type":"URL","bounty":true,"severity":"critical","instruction":"You will need to reset the one-time-use password upon your first login, and possibly to register your HackerOne email address as a MFA method."},{"asset":"https://openam-bug-bounty-stag.forgeblocks.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"* **What it is:**\n   * Administrative console for the single-tenant SAAS PingOne Advaced Identity Cloud platform which manages IAM functionality for Enterprise customers.\n   * Staging environment - Us"},{"asset":"https://ort-admin.pingone.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"* **What it is:**\n   * Administrative web portal for PingOne For Enterprise (P14E)\n* **What it does:**\n   * Allows P14E administrators to manage all aspects of their enterprise user accounts"},{"asset":"https://ort-authenticator.pingone.com/*","type":"WILDCARD","bounty":true,"severity":"high","instruction":"* **What it is:**\n   * Multi-factor Authentication (MFA) authenticator service\n   * MFA is configured via the PingOne Desktop > Devices > My Device > Add.\n   * Ping Authenticator used for Multi-Factor"},{"asset":"https://ort-desktop.pingone.com/*","type":"WILDCARD","bounty":true,"severity":"high","instruction":"* **What it is:** \n   * Central hub of Ping One For Enterprise, a cloud-based dock that provides users with secure SSO access to an expansive library of applications\n* **What it does:** \n   * Provides"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.06,"label":"none","experimental":true}},"derived":{"novelty":0.1713,"inverse_crowd":0.5235,"payout_reliability":0.7497,"value_per_competition":0.2994,"triage_quality":0.45,"scope_breadth":0.5575,"crowding_per_asset_month":0.9247,"slop_risk":0.06},"score":{"total":35.4,"parts":{"novelty":0.171,"inverse_crowd":0.523,"payout_reliability":0.75,"value_per_competition":0.299,"triage_quality":0.45,"scope_breadth":0.557},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":40.7},"reasons":[{"sign":"good","text":"paid $13k in the last 90 days"},{"sign":"neutral","text":"86 reports in 90 days across 31 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.8 years"}]},{"id":"hackerone:inspectorio","platform":"hackerone","slug":"inspectorio","name":"Inspectorio","url":"https://hackerone.com/inspectorio","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-01-28T14:59:42.401Z","age_months":20.701754337905925,"reports_90d":65,"resolved_total":123,"response_efficiency":65,"response_indicator":"missed","paid_total":31787,"paid_90d":650,"last_resolved_at":"2026-08-08T09:18:07.160Z","days_since_resolved":73.34686109751158,"avg_bounty_low":150,"avg_bounty_high":150,"min_bounty":50,"scope_count":20},"scope":[{"asset":"api.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"app.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":"**This is our Application “SIGHT”**\n\nPlease register [here](https://h1way.stg.inspectorio.com/) to get your account for access."},{"asset":"docuflow.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"files-stg.inspectorio.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is our File Management Service and it has multiple known vulnerabilities. We will set it eligible for bounty after security hardening which is in progress now."},{"asset":"https://app.bitrise.io/app/51a95edaab331ec5/installable-artifacts/e5213e1a814bf0ba/public-install-page/bed0d33f048271d6828c5a4a979ecc96","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":"Sign up [here](https://h1way.stg.inspectorio.com) to get your account credentials."},{"asset":"https://collabora.stg.inspectorio.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is a distinct component of our product, but we do not reward reports for it since we are not actively developing its codebase."},{"asset":"https://testflight.apple.com/join/vwFxXX7t","type":"TESTFLIGHT","bounty":true,"severity":"critical","instruction":"Sign up [here](https://h1way.stg.inspectorio.com) to get your account credentials."},{"asset":"id.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"report-html-sight.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":"**This is our SIGHT report service**\n\nPlease register [here](https://h1way.stg.inspectorio.com/) to get your account for access."},{"asset":"rise-api.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rise.stg.inspectorio.com","type":"URL","bounty":true,"severity":"critical","instruction":"**This is our Application “RISE”**\n\nPlease register [here](https://h1way.stg.inspectorio.com/) to get your account for access."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.06,"label":"none","experimental":true}},"derived":{"novelty":0.292,"inverse_crowd":0.476,"payout_reliability":0.7135,"value_per_competition":0.2432,"triage_quality":0.4875,"scope_breadth":0.4897,"crowding_per_asset_month":1.0833,"slop_risk":0.06},"score":{"total":35.3,"parts":{"novelty":0.292,"inverse_crowd":0.476,"payout_reliability":0.714,"value_per_competition":0.243,"triage_quality":0.488,"scope_breadth":0.49},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":40.3},"reasons":[{"sign":"good","text":"paid $650 in the last 90 days"},{"sign":"neutral","text":"65 reports in 90 days across 20 assets"},{"sign":"neutral","text":"running 1.7 years"}]},{"id":"hackerone:meesho_bbp","platform":"hackerone","slug":"meesho_bbp","name":"Meesho","url":"https://hackerone.com/meesho_bbp","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-02-11T07:20:03.331Z","age_months":8.260496093932998,"reports_90d":198,"resolved_total":55,"response_efficiency":67,"response_indicator":"missed","paid_total":19890,"paid_90d":2500,"last_resolved_at":"2026-09-02T09:38:12.900Z","days_since_resolved":48.3329057734375,"avg_bounty_low":150,"avg_bounty_high":200,"min_bounty":50,"scope_count":35},"scope":[{"asset":"1457958492","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"admin.meeshosupply.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"affiliate.meesho.com","type":"URL","bounty":true,"severity":"critical","instruction":"The Affiliate Panel is accessible via Meesho Mobile Apps (Android & iOS) and Web. Please review the updated Out of Scope section for exclusions."},{"asset":"com.meesho.supply","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.valmo.valmo","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is the Android App for Valmo Partners"},{"asset":"investor.meesho.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"meesho.io","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"prod.meeshoapi.com","type":"API","bounty":true,"severity":"critical","instruction":"prod.meeshoapi.com is accessible via Meesho Mobile Apps (Android & iOS)"},{"asset":"superstoreapp.meesho.com","type":"URL","bounty":true,"severity":"high","instruction":"Meesho Grocery/Superstore is part of the Meesho android app and is not a standalone service. To test this feature, please update the delivery PIN code to Nagpur (PIN: 440002), after which the Grocery/"},{"asset":"supplier.meesho.com","type":"URL","bounty":true,"severity":"critical","instruction":"The Supplier Panel is accessible via Meesho Mobile Apps (Android & iOS) and is in scope. Please review the updated Out of Scope section for exclusions."},{"asset":"www.meesho.com","type":"URL","bounty":true,"severity":"critical","instruction":"The defined scope covers Meesho’s production web application and mobile applications (iOS and Android) that facilitate customer transactions, seller workflows, and core marketplace services. Please re"},{"asset":"www.valmo.in","type":"URL","bounty":true,"severity":"critical","instruction":"Valmo is the in-house logistics arm of Meesho, launched to manage the company's shipping operations"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.212,"label":"none","experimental":true}},"derived":{"novelty":0.4105,"inverse_crowd":0.3184,"payout_reliability":0.7519,"value_per_competition":0.1856,"triage_quality":0.5025,"scope_breadth":0.5764,"crowding_per_asset_month":1.8857,"slop_risk":0.212},"score":{"total":35.1,"parts":{"novelty":0.411,"inverse_crowd":0.318,"payout_reliability":0.752,"value_per_competition":0.186,"triage_quality":0.503,"scope_breadth":0.576},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":39.8},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"neutral","text":"198 reports in 90 days across 35 assets"},{"sign":"neutral","text":"launched 8 months ago"}]},{"id":"hackerone:ring","platform":"hackerone","slug":"ring","name":"Ring","url":"https://hackerone.com/ring","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-05-16T16:01:10.706Z","age_months":41.168524318512816,"reports_90d":149,"resolved_total":119,"response_efficiency":66,"response_indicator":"missed","paid_total":369625,"paid_90d":12000,"last_resolved_at":"2026-10-19T20:31:41.987Z","days_since_resolved":0.8790968961226852,"avg_bounty_low":200,"avg_bounty_high":500,"min_bounty":50,"scope_count":33},"scope":[{"asset":"1013961111","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1218902777","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/id1218902777"},{"asset":"926252661","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"Blink Indoor","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B086DL32QX"},{"asset":"Blink Mini","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B07X27VK3D"},{"asset":"Blink Outdoor","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B086DKMSSM"},{"asset":"Blink Sync Module 2","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B084RQ6MHJ"},{"asset":"Blink Video Doorbell","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"https://www.amazon.com/dp/B08SG2MS3V"},{"asset":"Chime","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Gen 2 and 2 Pro, ASIN: B07WML2XTD, B07WML1QM4"},{"asset":"Indoor Cam","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B07Q9VBYV8"},{"asset":"Peephole Cam","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"ASIN: B07WHMQNPC"},{"asset":"Ring Alarm","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Gen 2, ASIN: B07ZPMCW64"},{"asset":"Ring Smart Lighting Bridge","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Gen 1"},{"asset":"Stickup Cam","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Gen 3, ASIN: B07Q3T177V"},{"asset":"Video Doorbell","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"2nd Gen, 3 & 3 Plus, ASINs: B0849J7W5X, B08N5NQ869, B07WLP395R"},{"asset":"com.immediasemi.android.blink","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ring.neighborhoods","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ringapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.blinkforhome.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.immedia-semi.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://admin.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://api.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://app.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://billing.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://fw.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://nw.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://oauth.ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://ring.com/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"prd-ring-web-us.prd.rings.solutions","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"publicsafety.ring.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.104,"label":"none","experimental":true}},"derived":{"novelty":0.2239,"inverse_crowd":0.3798,"payout_reliability":0.8281,"value_per_competition":0.2506,"triage_quality":0.495,"scope_breadth":0.5672,"crowding_per_asset_month":1.5051,"slop_risk":0.104},"score":{"total":34.9,"parts":{"novelty":0.224,"inverse_crowd":0.38,"payout_reliability":0.828,"value_per_competition":0.251,"triage_quality":0.495,"scope_breadth":0.567},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":39.4},"reasons":[{"sign":"good","text":"paid $12k in the last 90 days"},{"sign":"neutral","text":"149 reports in 90 days across 33 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.4 years"}]},{"id":"hackerone:banco_plata","platform":"hackerone","slug":"banco_plata","name":"Banco Plata","url":"https://hackerone.com/banco_plata","meta":{"reward_min":50,"reward_max":350,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-01-08T09:41:33.655Z","age_months":9.374310709493116,"reports_90d":925,"resolved_total":11,"response_efficiency":98,"response_indicator":"ok","paid_total":7178,"paid_90d":1200,"last_resolved_at":"2026-10-13T13:39:35.498Z","days_since_resolved":7.165283111400463,"avg_bounty_low":250,"avg_bounty_high":350,"min_bounty":50,"scope_count":13},"scope":[{"asset":"*.bancoplata.mx","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.platacard.mx","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"dif.tech.plata","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"id6443932656","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"people.plata.team","type":"URL","bounty":true,"severity":"critical","instruction":"We are particularly interested in vulnerabilities that could lead to unauthorized access to employee data or HR functions, such as authentication and session management weaknesses, broken access contr"},{"asset":"plata.co","type":"URL","bounty":true,"severity":"critical","instruction":"Primary public website of Banco Plata, accessible from the internet and used by customers and prospective customers to learn about and access Plata’s banking products and services. As the main public-"},{"asset":"prime.plata.co","type":"API","bounty":true,"severity":"critical","instruction":"We are particularly interested in vulnerabilities that could lead to unauthorized access to customer accounts, data, or banking functions, such as authentication and token handling weaknesses, broken "}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"98% response, paid recently, resolved 7d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.3923,"inverse_crowd":0.0219,"payout_reliability":0.9747,"value_per_competition":0.0239,"triage_quality":0.98,"scope_breadth":0.4245,"crowding_per_asset_month":23.7179,"slop_risk":1.0},"score":{"total":34.7,"parts":{"novelty":0.392,"inverse_crowd":0.022,"payout_reliability":0.975,"value_per_competition":0.024,"triage_quality":0.98,"scope_breadth":0.425},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":38.9},"reasons":[{"sign":"good","text":"paid $1k in the last 90 days"},{"sign":"good","text":"98% response efficiency"},{"sign":"neutral","text":"925 reports in 90 days across 13 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 9 months ago"}]},{"id":"hackerone:bykea","platform":"hackerone","slug":"bykea","name":"Bykea","url":"https://hackerone.com/bykea","meta":{"reward_min":50,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-12-09T13:24:52.592Z","age_months":22.346628400192028,"reports_90d":137,"resolved_total":112,"response_efficiency":100,"response_indicator":"ok","paid_total":10000,"paid_90d":5000,"last_resolved_at":"2026-04-22T11:00:39.712Z","days_since_resolved":181.27565100491898,"avg_bounty_low":50,"avg_bounty_high":100,"min_bounty":50,"scope_count":25},"scope":[{"asset":"*.bykea.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1351179184","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The customer iOS app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services."},{"asset":"bykea.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.bykea.pk","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"The customer android app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services."},{"asset":"com.bykea.pk.partner","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"The driver app offers core features such as wallet management, invoicing, booking visibility, and acceptance, supporting seamless driver operations on the platform."},{"asset":"https://*test*.bykea.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://api.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":"This core microservice handles booking creation and facilitates communication between critical microservices, powering both the apps and overall business operations."},{"asset":"https://geocode-beta.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://googleplace*.bykea.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://kronos*.bykea.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This API-based microservice manages invoicing functionalities, playing a vital role in our platform’s financial operations."},{"asset":"https://leaflet-map.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://loadboard*.bykea.net/","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This asset is an API-based microservice that allows drivers to view and accept customer bookings."},{"asset":"https://maps.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://nominatim.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://raptor*.bykea.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"This asset is an API-based microservice responsible for authentication processes."},{"asset":"tomoe.bykea.net","type":"URL","bounty":true,"severity":"critical","instruction":"Kong API Gateway serving as the backend gateway for all mobile application traffic."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 181 days"},"slop":{"risk":0.115,"label":"none","experimental":true}},"derived":{"novelty":0.2836,"inverse_crowd":0.3267,"payout_reliability":0.8267,"value_per_competition":0.1649,"triage_quality":1.0,"scope_breadth":0.5241,"crowding_per_asset_month":1.8267,"slop_risk":0.115},"score":{"total":33.9,"parts":{"novelty":0.284,"inverse_crowd":0.327,"payout_reliability":0.827,"value_per_competition":0.165,"triage_quality":1.0,"scope_breadth":0.524},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15}],"percentile":38.5},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"137 reports in 90 days across 25 assets"},{"sign":"bad","text":"nothing resolved for 181 days"},{"sign":"neutral","text":"running 1.9 years"}]},{"id":"hackerone:instacart","platform":"hackerone","slug":"instacart","name":"Instacart","url":"https://hackerone.com/instacart","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-02-17T21:48:55.830Z","age_months":56.04354708678417,"reports_90d":275,"resolved_total":544,"response_efficiency":73,"response_indicator":"missed","paid_total":582345,"paid_90d":48650,"last_resolved_at":"2026-10-16T18:03:39.082Z","days_since_resolved":3.981908296585648,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":50,"scope_count":49},"scope":[{"asset":"*.instacart.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.instacart.tools","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"545599256","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Instacart’s iOS application for online grocery delivery.\npackage name: com.instacart"},{"asset":"Android & iOS App for Instacart Shoppers","type":"OTHER","bounty":true,"severity":"critical","instruction":"To download the shoppers app please visit https://shoppers.instacart.com/apps and enter your phone number to get the download link\nWhat it does?\nShoppers receive orders through the app on their smartp"},{"asset":"admin.instacart.com","type":"URL","bounty":true,"severity":"critical","instruction":"An admin page that lets our internal users access tools, reports. It is used by customer support for order refunds, redelivery. Internal corporate employees can use it for editing store configuration "},{"asset":"api.instacart.com","type":"URL","bounty":true,"severity":"critical","instruction":"A service that allows Instacart's retailers to connect to Instacart's API to do fulfillment through their apps/websites."},{"asset":"com.instacart.client","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Instacart’s Android application for online grocery delivery."},{"asset":"shoppers.instacart.com","type":"URL","bounty":true,"severity":"critical","instruction":"A service that allows people to apply for the shoppers position at Instacart"},{"asset":"template.uat.foodstorm.com","type":"URL","bounty":true,"severity":"critical","instruction":"You can create your own test account in template.uat.foodstorm.com for testing"},{"asset":"www.instacart.com","type":"URL","bounty":true,"severity":"critical","instruction":"Web application to provide online ordering of groceries for either delivery or in store pick up."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.088,"label":"none","experimental":true}},"derived":{"novelty":0.1984,"inverse_crowd":0.3205,"payout_reliability":0.8563,"value_per_competition":0.1943,"triage_quality":0.5475,"scope_breadth":0.6293,"crowding_per_asset_month":1.8707,"slop_risk":0.088},"score":{"total":33.8,"parts":{"novelty":0.198,"inverse_crowd":0.32,"payout_reliability":0.856,"value_per_competition":0.194,"triage_quality":0.547,"scope_breadth":0.629},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":38.0},"reasons":[{"sign":"good","text":"paid $49k in the last 90 days"},{"sign":"neutral","text":"275 reports in 90 days across 49 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.7 years"}]},{"id":"hackerone:udemy","platform":"hackerone","slug":"udemy","name":"Udemy","url":"https://hackerone.com/udemy","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-05-06T23:54:46.540Z","age_months":137.48626109165144,"reports_90d":67,"resolved_total":501,"response_efficiency":71,"response_indicator":"missed","paid_total":170000,"paid_90d":5000,"last_resolved_at":"2026-05-26T01:24:11.134Z","days_since_resolved":147.67598176880787,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":24},"scope":[{"asset":"www.udemy.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"yourcompany.udemy.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.039,"label":"none","experimental":true}},"derived":{"novelty":0.1391,"inverse_crowd":0.5216,"payout_reliability":0.6938,"value_per_competition":0.2624,"triage_quality":0.5325,"scope_breadth":0.5178,"crowding_per_asset_month":0.9306,"slop_risk":0.039},"score":{"total":33.5,"parts":{"novelty":0.139,"inverse_crowd":0.522,"payout_reliability":0.694,"value_per_competition":0.262,"triage_quality":0.532,"scope_breadth":0.518},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":37.6},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"67 reports in 90 days across 24 assets"},{"sign":"neutral","text":"running 11.5 years"}]},{"id":"hackerone:privy-bbp","platform":"hackerone","slug":"privy-bbp","name":"Privy (Bounty)","url":"https://hackerone.com/privy-bbp","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-01-13T15:42:08.604Z","age_months":21.193599267938627,"reports_90d":411,"resolved_total":null,"response_efficiency":93,"response_indicator":"ok","paid_total":80000,"paid_90d":15000,"last_resolved_at":"2026-10-15T18:16:30.012Z","days_since_resolved":4.972985495659722,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":100,"scope_count":17},"scope":[{"asset":"@privy-io controlled namespace dependencies","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.privy.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auth.privy.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dashboard.privy.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"home.privy.io","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/cross-app-connect","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/cross-app-provider","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/expo","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/js-sdk-core","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/react-auth","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.npmjs.com/package/@privy-io/wagmi","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"recovery.privy.io","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 5d ago"},"slop":{"risk":0.69,"label":"elevated","experimental":true}},"derived":{"novelty":0.2894,"inverse_crowd":0.0756,"payout_reliability":0.9542,"value_per_competition":0.0616,"triage_quality":0.93,"scope_breadth":0.4649,"crowding_per_asset_month":8.0588,"slop_risk":0.69},"score":{"total":33.5,"parts":{"novelty":0.289,"inverse_crowd":0.076,"payout_reliability":0.954,"value_per_competition":0.062,"triage_quality":0.93,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":37.1},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"neutral","text":"411 reports in 90 days across 17 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.8 years"}]},{"id":"hackerone:twilio","platform":"hackerone","slug":"twilio","name":"Twilio","url":"https://hackerone.com/twilio","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-01-21T18:24:24.227Z","age_months":8.935277105416763,"reports_90d":1113,"resolved_total":3089,"response_efficiency":88,"response_indicator":"ok","paid_total":124382,"paid_90d":53375,"last_resolved_at":"2026-10-19T17:37:43.354Z","days_since_resolved":0.9999144076967593,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":50,"scope_count":156},"scope":[{"asset":"*.sip.*.twilio.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Twilio Primary Targets\n\nMany of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information"},{"asset":"1console.twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"Any host/web property verified to be owned by Twilio et al.","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any host/web property verified to be owned by Twilio (domains/IP space/etc.) but not listed in the previous target groups and not listed as Out of Scope."},{"asset":"accounts.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api.authy.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api.segment.io","type":"API","bounty":true,"severity":"critical","instruction":"### Access & Testing (Segment)\nLimit your use of scanner tests based on our technology stack. Our application is primarily powered by Node.js, React, and GraphQL.\nTo test Segment you'll need to create"},{"asset":"api.segmentapis.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api.sendgrid.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api.stytch.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"api.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":"Twilio Primary Targets\n\nMany of our Twilio APIs are available in our Postman collection. Please confirm that your target is within scope before testing. Do not publicly store any sensitive information"},{"asset":"app.segment.com","type":"URL","bounty":true,"severity":"critical","instruction":"###Access & Testing (Segment)\nLimit your use of scanner tests based on our technology stack. Our application is primarily powered by Node.js, React, and GraphQL.\nTo test Segment you'll need to create "},{"asset":"app.sendgrid.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"assistants.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"blog.twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bulkexports.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"client.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.authy","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.authy.authy","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"connectedapps.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"console.twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"conversations.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"events.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"flex-api.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"frontline-api.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/segmentio","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/sendgrid","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/is-agent","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/samlshield","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-android","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-browser","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-dotnet","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-go","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-ios","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-ios-dfp","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-java","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-management-go","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-management-python","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-mobile","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-node","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-php","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-python","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-ruby","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/stytch-rust","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/stytchauth/terraform-provider-stytch","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/twilio","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/twilio-labs","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"help.twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/stytchauth","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://stytch.com/blog","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://stytch.com/dashboard","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"iam.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"insights.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"intelligence.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"isagent.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"knowledge.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"lookups.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"management.stytch.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"marketplace.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"mc.sendgrid.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"memory.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"messaging.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"monitor.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"notify.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"numbers.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"oauth.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"platform.segmentapis.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"preview.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"pricing.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"profile.segment.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"proxy.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"routes.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"sendgrid.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"serverless.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"signup.sendgrid.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"smtp.sendgrid.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"static*.twilio.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Twilio CDNs"},{"asset":"studio.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"sync.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"taskrouter.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"telemetry.stytch.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"test.stytch.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"trunking.twilio.com","type":"API","bounty":true,"severity":"critical","instruction":null},{"asset":"tsock.us1.twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"twilio.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"88% response, paid recently, resolved 1d ago"},"slop":{"risk":0.1,"label":"none","experimental":true}},"derived":{"novelty":0.3991,"inverse_crowd":0.2612,"payout_reliability":0.9378,"value_per_competition":0.1706,"triage_quality":0.88,"scope_breadth":0.8133,"crowding_per_asset_month":2.3782,"slop_risk":0.1},"score":{"total":33.3,"parts":{"novelty":0.399,"inverse_crowd":0.261,"payout_reliability":0.938,"value_per_competition":0.171,"triage_quality":0.88,"scope_breadth":0.813},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":36.7},"reasons":[{"sign":"good","text":"paid $53k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"bad","text":"1,113 reports in 90 days across 156 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 9 months ago"}]},{"id":"hackerone:tinder","platform":"hackerone","slug":"tinder","name":"Tinder","url":"https://hackerone.com/tinder","meta":{"reward_min":250,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-09-27T16:01:10.180Z","age_months":60.74963334809682,"reports_90d":59,"resolved_total":130,"response_efficiency":61,"response_indicator":"missed","paid_total":188700,"paid_90d":15000,"last_resolved_at":"2026-10-07T20:54:20.155Z","days_since_resolved":12.863377359085648,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":250,"scope_count":15},"scope":[{"asset":"*.gotinder.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tinder.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tinderops.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tinderwebstaging.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.tstaging.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.tstaging.tools","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"547702041","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.tinder","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.065,"label":"none","experimental":true}},"derived":{"novelty":0.1922,"inverse_crowd":0.4194,"payout_reliability":0.7784,"value_per_competition":0.2716,"triage_quality":0.4575,"scope_breadth":0.446,"crowding_per_asset_month":1.3111,"slop_risk":0.065},"score":{"total":33.1,"parts":{"novelty":0.192,"inverse_crowd":0.419,"payout_reliability":0.778,"value_per_competition":0.272,"triage_quality":0.458,"scope_breadth":0.446},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":36.2},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"neutral","text":"59 reports in 90 days across 15 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.1 years"}]},{"id":"hackerone:whatnot","platform":"hackerone","slug":"whatnot","name":"Whatnot","url":"https://hackerone.com/whatnot","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-03-17T13:44:09.799Z","age_months":7.134689390761655,"reports_90d":537,"resolved_total":null,"response_efficiency":87,"response_indicator":"ok","paid_total":338312,"paid_90d":2600,"last_resolved_at":"2026-10-06T10:38:53.180Z","days_since_resolved":14.290772903067129,"avg_bounty_low":500,"avg_bounty_high":1000,"min_bounty":50,"scope_count":9},"scope":[{"asset":"*.whatnot.com","type":"WILDCARD","bounty":true,"severity":"high","instruction":"We also welcome reports concerning other Whatnot-owned assets where the findings provide meaningful value to the business. In most cases, this includes services operating under the *.whatnot.com domai"},{"asset":"Whatnot: Shop, Sell, Connect","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/pl/app/whatnot-shop-sell-connect/id1488269261\n\nAll researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards t"},{"asset":"api.whatnot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"auction-service.whatnot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.whatnot_mobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.whatnot_mobile&pcampaignid=web_share\n\nAll researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automa"},{"asset":"live-service.whatnot.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.whatnot.com","type":"URL","bounty":true,"severity":"critical","instruction":"All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards to their registered email address.\nIf you need additional test accounts"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 14d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.4324,"inverse_crowd":0.0269,"payout_reliability":0.9056,"value_per_competition":0.0334,"triage_quality":0.87,"scope_breadth":0.3704,"crowding_per_asset_month":19.8889,"slop_risk":1.0},"score":{"total":32.7,"parts":{"novelty":0.432,"inverse_crowd":0.027,"payout_reliability":0.906,"value_per_competition":0.033,"triage_quality":0.87,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":35.7},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"neutral","text":"537 reports in 90 days across 9 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 7 months ago"}]},{"id":"hackerone:deribit","platform":"hackerone","slug":"deribit","name":"Deribit","url":"https://hackerone.com/deribit","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-10-18T15:42:20.797Z","age_months":48.06833795795308,"reports_90d":65,"resolved_total":46,"response_efficiency":73,"response_indicator":"missed","paid_total":30000,"paid_90d":5000,"last_resolved_at":"2026-04-28T14:55:54.060Z","days_since_resolved":175.11229049565972,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":50,"scope_count":17},"scope":[{"asset":"*.deribit.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"1293674041","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 1","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Tier 2","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"com.deribit","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"insights.deribit.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"pb.deribit.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"test.deribit.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.102,"label":"none","experimental":true}},"derived":{"novelty":0.2107,"inverse_crowd":0.4277,"payout_reliability":0.6936,"value_per_competition":0.2453,"triage_quality":0.5475,"scope_breadth":0.4649,"crowding_per_asset_month":1.2745,"slop_risk":0.102},"score":{"total":32.5,"parts":{"novelty":0.211,"inverse_crowd":0.428,"payout_reliability":0.694,"value_per_competition":0.245,"triage_quality":0.547,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":35.3},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"65 reports in 90 days across 17 assets"},{"sign":"neutral","text":"running 4.0 years"}]},{"id":"hackerone:circle-bbp","platform":"hackerone","slug":"circle-bbp","name":"Circle","url":"https://hackerone.com/circle-bbp","meta":{"reward_min":50,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-28T20:29:32.177Z","age_months":28.74351045015781,"reports_90d":781,"resolved_total":80,"response_efficiency":91,"response_indicator":"ok","paid_total":101219,"paid_90d":15995,"last_resolved_at":"2026-10-01T14:53:33.600Z","days_since_resolved":19.113916190104167,"avg_bounty_low":300,"avg_bounty_high":400,"min_bounty":50,"scope_count":32},"scope":[{"asset":"api.circle.com","type":"URL","bounty":true,"severity":"critical","instruction":"Testing should be done on api-sandbox.circle.com."},{"asset":"app.circle.com","type":"URL","bounty":true,"severity":"critical","instruction":"Testing should be done on app-sandbox.circle.com."},{"asset":"console.circle.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only the web2 portion of console.circle.com is in scope. Anything smart contract/smart contract platform or otherwise web3 related is not in scope. \n\nResearchers should make it clear they're HackerOne"},{"asset":"http://github.com/circlefin/noble-cctp","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/aptos-cctp","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/buidl-wallet-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/evm-cctp-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/evm-cpn-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/evm-gateway-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/evm-xreserve-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/noble-fiattokenfactory","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/solana-cctp-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/solana-gateway-contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-aptos","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-evm","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-near","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-starknet","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-sui","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stablecoin-xlm","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/starknet-cctp","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/stellar-cctp","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/sui-cctp","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"91% response, paid recently, resolved 19d ago"},"slop":{"risk":0.683,"label":"elevated","experimental":true}},"derived":{"novelty":0.2574,"inverse_crowd":0.0748,"payout_reliability":0.9167,"value_per_competition":0.0663,"triage_quality":0.91,"scope_breadth":0.5624,"crowding_per_asset_month":8.1354,"slop_risk":0.683},"score":{"total":32.5,"parts":{"novelty":0.257,"inverse_crowd":0.075,"payout_reliability":0.917,"value_per_competition":0.066,"triage_quality":0.91,"scope_breadth":0.562},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":34.8},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"781 reports in 90 days across 32 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.4 years"}]},{"id":"hackerone:kong","platform":"hackerone","slug":"kong","name":"Kong","url":"https://hackerone.com/kong","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-10-21T18:25:43.913Z","age_months":11.957834073247016,"reports_90d":977,"resolved_total":58,"response_efficiency":79,"response_indicator":"ok","paid_total":32750,"paid_90d":18350,"last_resolved_at":"2026-10-20T13:40:49.136Z","days_since_resolved":0.16443081973379628,"avg_bounty_low":100,"avg_bounty_high":250,"min_bounty":50,"scope_count":31},"scope":[{"asset":"GitHub Actions in our Public Repositories ","type":"OTHER","bounty":true,"severity":"none","instruction":"Our security program covers GitHub Actions on a case-by-case basis. We don't maintain a comprehensive list of in-scope repositories as relevance varies.\nWhen reporting GitHub Actions vulnerabilities, "},{"asset":"Kong Gateway Enterprise","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"Kong Gateway OSS","type":"DOWNLOADABLE_EXECUTABLES","bounty":false,"severity":"medium","instruction":null},{"asset":"Kong Gateway Plugins (Kong-Supported Only)","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Kong Gateway Plugins extend the core functionality of Kong Gateway by providing modular support for authentication, traffic control, logging, transformation, observability, and security features. This"},{"asset":"Kong Mesh","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Kong Mesh is an enterprise-grade service mesh built on top of Kuma, designed to provide secure, observable, and resilient service-to-service communication across modern, distributed environments. It e"},{"asset":"Subdomain Takeover - konghq.com","type":"OTHER","bounty":true,"severity":"high","instruction":"Subdomain takeover vulnerabilities on Kong's domain infrastructure (\\*.konghq.com). This includes documentation sites, API endpoints, marketing pages, developer portals, and service integrations. Succ"},{"asset":"developer.konghq.com","type":"URL","bounty":true,"severity":"high","instruction":"This is a static documentation site for the Kong developer ecosystem. It does **not** include authentication, private data, or customer records. However, it is a high-visibility property used by prosp"},{"asset":"http://cloud.konghq.com","type":"URL","bounty":true,"severity":"critical","instruction":"Kong Konnect is a unified SaaS control plane that allows organizations to manage their API Gateway, Service Mesh, and Ingress Controller deployments globally. The `cloud.konghq.com` application serves"},{"asset":"https://*.api.konghq.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"The Kong Konnect API is a set of RESTful APIs used to programmatically interact with Kong Konnect's SaaS control plane. These endpoints enable users to automate and manage API gateway configurations, "},{"asset":"https://app.insomnia.rest/","type":"URL","bounty":true,"severity":"critical","instruction":"https://app.insomnia.rest/ is the web-based platform for managing user accounts, API project sync, and collaboration features within Insomnia. It provides authenticated access to synced workspaces, te"},{"asset":"https://us.identity.konghq.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Kong Identity is the authentication and identity management service for Kong Konnect. \nThis service provides OAuth 2.0 and OpenID Connect (OIDC) compliant endpoints for token \nissuance, introspection,"},{"asset":"konghq.com","type":"URL","bounty":true,"severity":"high","instruction":"Description:\nThis domain hosts Kong’s primary marketing site, built with Next.js and backed by a headless CMS. It includes content for prospective customers, product landing pages, documentation links"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"79% response, pays"},"slop":{"risk":0.778,"label":"elevated","experimental":true}},"derived":{"novelty":0.3589,"inverse_crowd":0.0561,"payout_reliability":0.8946,"value_per_competition":0.0485,"triage_quality":0.79,"scope_breadth":0.5575,"crowding_per_asset_month":10.5054,"slop_risk":0.778},"score":{"total":32.2,"parts":{"novelty":0.359,"inverse_crowd":0.056,"payout_reliability":0.895,"value_per_competition":0.048,"triage_quality":0.79,"scope_breadth":0.557},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":34.4},"reasons":[{"sign":"good","text":"paid $18k in the last 90 days"},{"sign":"neutral","text":"977 reports in 90 days across 31 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 12 months ago"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:anduril_industries","platform":"hackerone","slug":"anduril_industries","name":"Anduril Industries","url":"https://hackerone.com/anduril_industries","meta":{"reward_min":50,"reward_max":760,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-01-20T15:04:21.018Z","age_months":8.972695619752454,"reports_90d":396,"resolved_total":23,"response_efficiency":88,"response_indicator":"ok","paid_total":62230,"paid_90d":10415,"last_resolved_at":"2026-09-10T21:59:36.650Z","days_since_resolved":39.818047555844906,"avg_bounty_low":500,"avg_bounty_high":760,"min_bounty":50,"scope_count":9},"scope":[{"asset":"*.anduril.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.anduril.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.anduril.com.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.anduril.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.andurildev.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.andurildev.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"88% response, pays, last resolved 40d ago"},"slop":{"risk":0.928,"label":"elevated","experimental":true}},"derived":{"novelty":0.3985,"inverse_crowd":0.0383,"payout_reliability":0.8685,"value_per_competition":0.0428,"triage_quality":0.88,"scope_breadth":0.3704,"crowding_per_asset_month":14.6667,"slop_risk":0.928},"score":{"total":31.7,"parts":{"novelty":0.399,"inverse_crowd":0.038,"payout_reliability":0.868,"value_per_competition":0.043,"triage_quality":0.88,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":33.9},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"396 reports in 90 days across 9 assets"},{"sign":"neutral","text":"launched 9 months ago"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:eufy_security","platform":"hackerone","slug":"eufy_security","name":"eufy Security","url":"https://hackerone.com/eufy_security","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-12-21T09:24:39.836Z","age_months":33.98249909606244,"reports_90d":159,"resolved_total":118,"response_efficiency":52,"response_indicator":"missed","paid_total":80940,"paid_90d":12500,"last_resolved_at":"2026-10-08T07:20:50.381Z","days_since_resolved":12.428305298900463,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":50,"scope_count":33},"scope":[{"asset":"Anker","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"The App to connect, control, view, and update supported Anker products.\nhttps://apps.apple.com/us/app/anker/id1635029057"},{"asset":"Anker soundcore Work D3200","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Liberty 5 Pro Max D1204","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Solarbank 2 E1600 Pro","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"All-in-One Home Balcony Solar System with Power Storage"},{"asset":"anker-nebula/id1319092174","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.anker.AnkerMake","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"The App for AnkerMake 3D Printer"},{"asset":"com.anker.charging","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"The Android App to connect, control, view, and update supported Anker products."},{"asset":"com.oceanwing.FDMPrint","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"The Android App for AnkerMake 3D Printer"},{"asset":"com.oceanwing.battery.cam","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"Most features shall use the eufy Security hardware devices."},{"asset":"com.security.BatteryCam","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"The major features shall connect with the hardware devices of eufy Security."},{"asset":"eufyMake E1","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"A Personal 3D-Texture UV Printer made by eufyMake."},{"asset":"eufyMake Studio(2D UV)","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://www.eufymake.com/eufymake-studio:\nDownload for Windows (UV)\nDownload for MacOS (UV)"},{"asset":"https://us.eufy.com/products/e8213181","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"S330 Video Doorbell-Battery"},{"asset":"https://us.eufy.com/products/t8410121","type":"HARDWARE","bounty":true,"severity":"high","instruction":"S220 Indoor Cam"},{"asset":"https://us.eufy.com/products/t88511d1","type":"HARDWARE","bounty":true,"severity":"high","instruction":"eufyCam 2 Pro"},{"asset":"https://us.eufy.com/products/t88711w1","type":"HARDWARE","bounty":true,"severity":"high","instruction":null},{"asset":"id=com.oceanwing.soundcore","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"id=com.zhixin.controller","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"soundcore/id1331876603","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.112,"label":"none","experimental":true}},"derived":{"novelty":0.2412,"inverse_crowd":0.3616,"payout_reliability":0.7342,"value_per_competition":0.2211,"triage_quality":0.39,"scope_breadth":0.5672,"crowding_per_asset_month":1.6061,"slop_risk":0.112},"score":{"total":31.2,"parts":{"novelty":0.241,"inverse_crowd":0.362,"payout_reliability":0.734,"value_per_competition":0.221,"triage_quality":0.39,"scope_breadth":0.567},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":33.5},"reasons":[{"sign":"good","text":"paid $12k in the last 90 days"},{"sign":"neutral","text":"159 reports in 90 days across 33 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.8 years"}]},{"id":"hackerone:varonis","platform":"hackerone","slug":"varonis","name":"Varonis","url":"https://hackerone.com/varonis","meta":{"reward_min":50,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-05-21T16:16:52.342Z","age_months":28.979254550469616,"reports_90d":109,"resolved_total":null,"response_efficiency":64,"response_indicator":"missed","paid_total":20000,"paid_90d":10000,"last_resolved_at":"2026-10-07T18:42:00.278Z","days_since_resolved":12.955274083622685,"avg_bounty_low":320,"avg_bounty_high":400,"min_bounty":50,"scope_count":17},"scope":[{"asset":"*.varonis.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.varonis.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"downloads.varonis.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"licensemgmt.varonis.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"my.varonis.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"support.varonis.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.477,"label":"watch","experimental":true}},"derived":{"novelty":0.2566,"inverse_crowd":0.2867,"payout_reliability":0.7932,"value_per_competition":0.1929,"triage_quality":0.48,"scope_breadth":0.4649,"crowding_per_asset_month":2.1373,"slop_risk":0.477},"score":{"total":31.0,"parts":{"novelty":0.257,"inverse_crowd":0.287,"payout_reliability":0.793,"value_per_competition":0.193,"triage_quality":0.48,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":33.0},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"neutral","text":"109 reports in 90 days across 17 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.4 years"}]},{"id":"hackerone:flickr","platform":"hackerone","slug":"flickr","name":"Flickr","url":"https://hackerone.com/flickr","meta":{"reward_min":200,"reward_max":341,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-11-02T03:16:59.539Z","age_months":95.59253039007719,"reports_90d":86,"resolved_total":175,"response_efficiency":59,"response_indicator":"missed","paid_total":165867,"paid_90d":11026,"last_resolved_at":"2026-08-20T22:34:24.119Z","days_since_resolved":60.79388703501157,"avg_bounty_low":300,"avg_bounty_high":341,"min_bounty":200,"scope_count":22},"scope":[{"asset":"*.flickr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All flickr.com are in scope unless otherwise listed as specifically out of scope. All third-party assets are out of scope."},{"asset":"328407587","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.yahoo.mobile.client.android.flickr","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"modefestival.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.whatismode.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.067,"label":"none","experimental":true}},"derived":{"novelty":0.1607,"inverse_crowd":0.4213,"payout_reliability":0.6968,"value_per_competition":0.2558,"triage_quality":0.4425,"scope_breadth":0.5044,"crowding_per_asset_month":1.303,"slop_risk":0.067},"score":{"total":30.6,"parts":{"novelty":0.161,"inverse_crowd":0.421,"payout_reliability":0.697,"value_per_competition":0.256,"triage_quality":0.443,"scope_breadth":0.504},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":32.6},"reasons":[{"sign":"good","text":"paid $11k in the last 90 days"},{"sign":"neutral","text":"86 reports in 90 days across 22 assets"},{"sign":"neutral","text":"running 8.0 years"}]},{"id":"hackerone:agoda-public","platform":"hackerone","slug":"agoda-public","name":"Agoda Public","url":"https://hackerone.com/agoda-public","meta":{"reward_min":50,"reward_max":2632,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-06-18T08:51:59.714Z","age_months":4.085913850796638,"reports_90d":387,"resolved_total":0,"response_efficiency":91,"response_indicator":"ok","paid_total":3208,"paid_90d":3208,"last_resolved_at":null,"days_since_resolved":null,"avg_bounty_low":576,"avg_bounty_high":2632,"min_bounty":50,"scope_count":3},"scope":[{"asset":"https://www.agoda.com/account/agodacash","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.agoda.com/account/cashback","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://www.agoda.com/book/","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["last_resolved_at"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"91% response, pays"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.5217,"inverse_crowd":0.0108,"payout_reliability":0.7585,"value_per_competition":0.0181,"triage_quality":0.91,"scope_breadth":0.223,"crowding_per_asset_month":43.0,"slop_risk":1.0},"score":{"total":30.3,"parts":{"novelty":0.522,"inverse_crowd":0.011,"payout_reliability":0.758,"value_per_competition":0.018,"triage_quality":0.91,"scope_breadth":0.223},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":32.1},"reasons":[{"sign":"good","text":"paid $3k in the last 90 days"},{"sign":"good","text":"91% response efficiency"},{"sign":"neutral","text":"387 reports in 90 days across 3 assets"},{"sign":"neutral","text":"launched 4 months ago"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:dynatrace","platform":"hackerone","slug":"dynatrace","name":"Dynatrace","url":"https://hackerone.com/dynatrace","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-01-10T09:00:42.210Z","age_months":33.32596157457792,"reports_90d":332,"resolved_total":433,"response_efficiency":72,"response_indicator":"missed","paid_total":230406,"paid_90d":44956,"last_resolved_at":"2026-10-14T07:26:43.326Z","days_since_resolved":6.4242202873263885,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":100,"scope_count":30},"scope":[{"asset":"*.sprint.apps.dynatracelabs.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Wildcard domain for your Dynatrace Platform environment, sometimes also called 3rd gen. \nThis is your default testing environment. Once you request your testing environment you will be redirected to t"},{"asset":"*.sprint.dynatracelabs.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Wildcard domain for your 2nd gen testing environments - an older but fully supported and regularly updated version of our product.\n\nTo get there, follow the steps described in our Policy page under \"h"},{"asset":"Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":"Used for asset classification only, please have a look at the policy page or the rewards section."},{"asset":"Dynatrace ActiveGate","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"ActiveGate is a secure proxy that connects Dynatrace OneAgents to Dynatrace Clusters or other ActiveGates. For more details please have a look at the Useful tips section of the policy or our [support "},{"asset":"Dynatrace MobileAgent","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"The MobileAgent can be used to monitor Android or IOs apps. \nFor more details please have a look at the \"Useful tips\" section of the policy or our [support page](https://www.dynatrace.com/support/help"},{"asset":"Dynatrace OneAgent","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"OneAgent is responsible for collecting all monitoring data within your environment. \nFor more details please have a look at the \"Useful tips\" section of the policy or our [support page](https://www.dy"},{"asset":"account-sprint.dynatracelabs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the old domain for our account management, the new domain is myaccount-hardening.dynatracelabs.com. Since the domain is still used in some parts of our software, it is still in scope."},{"asset":"https://github.com/Dynatrace","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"⚠️ **Minimum Reputation Requirement:** Only reporters with at least **150 reputation** are eligible to submit reports for assets in this scope. For more information see our [policy page](https://hacke"},{"asset":"myaccount-hardening.dynatracelabs.com","type":"URL","bounty":true,"severity":"critical","instruction":"Myaccount is the place where you can manage your license, subscriptions, users, groups, policies and more. \nFor more details please have a look at the \"Useful tips\" section of the policy or our [suppo"},{"asset":"sso-sprint.dynatracelabs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This domain is used in our single sign on solution, you will see the domain for example during the login process."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.163,"label":"none","experimental":true}},"derived":{"novelty":0.2431,"inverse_crowd":0.1727,"payout_reliability":0.8462,"value_per_competition":0.119,"triage_quality":0.54,"scope_breadth":0.5524,"crowding_per_asset_month":3.6889,"slop_risk":0.163},"score":{"total":29.5,"parts":{"novelty":0.243,"inverse_crowd":0.173,"payout_reliability":0.846,"value_per_competition":0.119,"triage_quality":0.54,"scope_breadth":0.552},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":31.7},"reasons":[{"sign":"good","text":"paid $45k in the last 90 days"},{"sign":"neutral","text":"332 reports in 90 days across 30 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.8 years"}]},{"id":"hackerone:yuga_labs","platform":"hackerone","slug":"yuga_labs","name":"Yuga Labs","url":"https://hackerone.com/yuga_labs","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-12-12T17:30:33.960Z","age_months":46.25888736741387,"reports_90d":56,"resolved_total":null,"response_efficiency":71,"response_indicator":"missed","paid_total":115370,"paid_90d":0,"last_resolved_at":"2026-07-13T20:09:04.261Z","days_since_resolved":98.89481131741898,"avg_bounty_low":500,"avg_bounty_high":1000,"min_bounty":50,"scope_count":18},"scope":[{"asset":"*.boredapeyachtclub.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.otherside.xyz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"NOTE: all hosts with CNAME records pointed to out-of-scope, or partner websites, will be considered out of scope. This includes \"odk.otherside.xyz\", and additionally, all development domains that are "},{"asset":"*.yuga.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.yugalabs.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"831287358355275877","type":"OTHER","bounty":true,"severity":"critical","instruction":"Bored Ape Yacht Club Discord Server\nCanary Channel ID: 999376248943943813"},{"asset":"961114489414094898","type":"OTHER","bounty":true,"severity":"critical","instruction":"Otherside Discord Server\nCanary Channel ID: 999375944731082923"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.437,"label":"watch","experimental":true}},"derived":{"novelty":0.2139,"inverse_crowd":0.4891,"payout_reliability":0.4217,"value_per_competition":0.3425,"triage_quality":0.5325,"scope_breadth":0.4736,"crowding_per_asset_month":1.037,"slop_risk":0.437},"score":{"total":29.4,"parts":{"novelty":0.214,"inverse_crowd":0.489,"payout_reliability":0.422,"value_per_competition":0.342,"triage_quality":0.532,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":31.2},"reasons":[{"sign":"neutral","text":"56 reports in 90 days across 18 assets"},{"sign":"neutral","text":"running 3.9 years"}]},{"id":"hackerone:uber","platform":"hackerone","slug":"uber","name":"Uber","url":"https://hackerone.com/uber","meta":{"reward_min":500,"reward_max":700,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-03-22T15:00:13.258Z","age_months":126.9522559513366,"reports_90d":426,"resolved_total":2696,"response_efficiency":69,"response_indicator":"missed","paid_total":4530763,"paid_90d":94152,"last_resolved_at":"2026-10-05T18:06:12.795Z","days_since_resolved":14.9801292109375,"avg_bounty_low":500,"avg_bounty_high":700,"min_bounty":500,"scope_count":52},"scope":[{"asset":"*.uberinternal.com","type":"OTHER","bounty":true,"severity":"none","instruction":null},{"asset":"*ubereats.com","type":"OTHER","bounty":true,"severity":"none","instruction":"Includes all subdomains (*.ubereats.com) except subdomains listed in out of scope."},{"asset":"Recon Data","type":"OTHER","bounty":true,"severity":"none","instruction":"Uber provides endpoints to determine whether an asset belongs to Uber:\n\nhttps://appsec-analysis.uber.com/public/bugbounty/ListDomains\nhttps://appsec-analysis.uber.com/public/bugbounty/ListIPs\n\nAll of "},{"asset":"uber.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.105,"label":"none","experimental":true}},"derived":{"novelty":0.1436,"inverse_crowd":0.2305,"payout_reliability":0.8143,"value_per_competition":0.1773,"triage_quality":0.5175,"scope_breadth":0.6387,"crowding_per_asset_month":2.7308,"slop_risk":0.105},"score":{"total":29.1,"parts":{"novelty":0.144,"inverse_crowd":0.23,"payout_reliability":0.814,"value_per_competition":0.177,"triage_quality":0.517,"scope_breadth":0.639},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":30.8},"reasons":[{"sign":"good","text":"paid $94k in the last 90 days"},{"sign":"neutral","text":"426 reports in 90 days across 52 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.6 years"}]},{"id":"hackerone:modern_treasury","platform":"hackerone","slug":"modern_treasury","name":"Modern Treasury","url":"https://hackerone.com/modern_treasury","meta":{"reward_min":50,"reward_max":358,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-09-25T15:41:59.671Z","age_months":36.83220636087345,"reports_90d":72,"resolved_total":74,"response_efficiency":69,"response_indicator":"missed","paid_total":76044,"paid_90d":5332,"last_resolved_at":"2026-10-06T05:52:31.056Z","days_since_resolved":14.489640078993055,"avg_bounty_low":300,"avg_bounty_high":358,"min_bounty":50,"scope_count":9},"scope":[{"asset":"app.moderntreasury.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cdn.moderntreasury.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.135,"label":"none","experimental":true}},"derived":{"novelty":0.2338,"inverse_crowd":0.2356,"payout_reliability":0.8153,"value_per_competition":0.162,"triage_quality":0.5175,"scope_breadth":0.3704,"crowding_per_asset_month":2.6667,"slop_risk":0.135},"score":{"total":29.1,"parts":{"novelty":0.234,"inverse_crowd":0.236,"payout_reliability":0.815,"value_per_competition":0.162,"triage_quality":0.517,"scope_breadth":0.37},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":30.3},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"neutral","text":"72 reports in 90 days across 9 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.1 years"}]},{"id":"hackerone:judgeme","platform":"hackerone","slug":"judgeme","name":"Judge.me ","url":"https://hackerone.com/judgeme","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-10-20T08:01:26.206Z","age_months":60.00493183999733,"reports_90d":55,"resolved_total":140,"response_efficiency":72,"response_indicator":"missed","paid_total":72050,"paid_90d":2000,"last_resolved_at":"2026-10-06T11:46:43.418Z","days_since_resolved":14.243663666956019,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":7},"scope":[{"asset":"bigcommerce-adapter.judge.me","type":"URL","bounty":true,"severity":"critical","instruction":"This is a simple, lightweight server, basically just to connect BigCommerce websites to our main asset ​https://judge.me/.\n\nIts entry point is from installing our BigCommerce  app: https://www.bigcomm"},{"asset":"cache.judge.me","type":"URL","bounty":true,"severity":"critical","instruction":"This is a simple NodeJS server, using Hapi framework. It's basically to store and cache our public widgets' HTML content, so that when end users want to fetch our widget content, they can fetch from t"},{"asset":"https://judge.me/reviews","type":"URL","bounty":true,"severity":"critical","instruction":"This is our new product. It is user (reviewer) facing, unlike the other assets, which are merchant facing. Its entry point is https://judge.me/reviews, and its pages are prefixed with https://judge.me"},{"asset":"insights.judgeme.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"judge.me","type":"URL","bounty":true,"severity":"critical","instruction":"This is the core part of our system. It hosts our main app [Judge.me Product Reviews](https://apps.shopify.com/judgeme) and is also the central point of communication for other assets."},{"asset":"shop.judge.me","type":"URL","bounty":true,"severity":"critical","instruction":"This is lightweight, basically just to connect our other Shopify apps to our main asset ​https://judge.me/.\n\nIts entry point is https://shop.judge.me/login?app_key=ali_reviews or https://apps.shopify."},{"asset":"woocommerce-adapter.judge.me","type":"URL","bounty":true,"severity":"critical","instruction":"This is a simple, lightweight server, basically just to connect Wordpress websites (specifically WooCommerce websites) to our main asset ​https://judge.me/.\n\nIts entry point is from installing our Wor"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.11,"label":"none","experimental":true}},"derived":{"novelty":0.1931,"inverse_crowd":0.2395,"payout_reliability":0.8307,"value_per_competition":0.1734,"triage_quality":0.54,"scope_breadth":0.3345,"crowding_per_asset_month":2.619,"slop_risk":0.11},"score":{"total":28.9,"parts":{"novelty":0.193,"inverse_crowd":0.24,"payout_reliability":0.831,"value_per_competition":0.173,"triage_quality":0.54,"scope_breadth":0.334},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":29.9},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"neutral","text":"55 reports in 90 days across 7 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.0 years"}]},{"id":"hackerone:files","platform":"hackerone","slug":"files","name":"Files.com","url":"https://hackerone.com/files","meta":{"reward_min":250,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-02-21T16:54:52.941Z","age_months":115.91062552963153,"reports_90d":766,"resolved_total":499,"response_efficiency":89,"response_indicator":"ok","paid_total":331199,"paid_90d":129550,"last_resolved_at":"2026-10-20T12:18:10.879Z","days_since_resolved":0.2218180535300926,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":250,"scope_count":17},"scope":[{"asset":"FIles.com REST API","type":"OTHER","bounty":true,"severity":"critical","instruction":"## REST API\nFull documentation for the REST API can be found here:  https://developers.files.com/\n\nThe REST API URL is tied to your specific site (https://*sitename*.files.com) that was generated when"},{"asset":"Files.com Command Line Interface (CLI) App","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"medium","instruction":"Files.com Command Line Interface (CLI) App\n\nFull documentation for the Files.com Command Line Interface (CLI) App can be found here: https://www.files.com/docs/client-apps/command-line-interface-cli-a"},{"asset":"Files.com Desktop v6 App","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"medium","instruction":"Files.com Desktop v6 App\n\nFull documentation for the Files.com Desktop v6 App can be found here: https://www.files.com/docs/client-apps/desktop-v6-app.\n\nThe Files.com Desktop v6 App is tied to your sp"},{"asset":"Files.com Mobile App","type":"OTHER","bounty":true,"severity":"medium","instruction":"Files.com Mobile App\n\nFull documentation for the Files.com Mobile App App can be found here: https://www.files.com/docs/client-apps/mobile-app.\n\nThe mobile app will be installed locally from the App S"},{"asset":"Files.com On-Premise Agent","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"medium","instruction":"Files.com On-Premise Agent\n\nFull documentation for the Files.com On-Premise Agent can be found here: https://www.files.com/docs/on-premise/agent.\n\nThe Files.com On-Premise Agent is tied to your specif"},{"asset":"Files.com SDKs and MCP","type":"OTHER","bounty":true,"severity":"medium","instruction":"Full documentation for the Files.com SDK’s can be found here: \nhttps://developers.files.com/#per-language-sdks"},{"asset":"app.files.com","type":"URL","bounty":true,"severity":"critical","instruction":"Files.com Web Application"},{"asset":"www.files.com","type":"URL","bounty":true,"severity":"low","instruction":"This is the main marketing site for Files.com.  \n\nOn the marketing site asset (https://www.files.com) we will only accept vulnerabilities that lead to a vulnerability on the main *.files.com platform."},{"asset":"your-assigned-subdomain.files.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Files.com Web Application** \n\n**Please review the Out of Scope assets** -- note that not all subdomains of https://*.files.com are in scope for this asset.  Please review the listing of assets marke"},{"asset":"your-assigned-subdomain.hosted-by-files.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Files.com Public Hosting**\n\nPublic Hosting serves the contents of a folder over the web at https://*your-assigned-subdomain*.hosted-by-files.com/, on a domain kept separate from your site's primary "}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"89% response, paid recently, resolved 0d ago"},"slop":{"risk":0.602,"label":"elevated","experimental":true}},"derived":{"novelty":0.1489,"inverse_crowd":0.0373,"payout_reliability":0.9445,"value_per_competition":0.0348,"triage_quality":0.89,"scope_breadth":0.4649,"crowding_per_asset_month":15.0196,"slop_risk":0.602},"score":{"total":28.5,"parts":{"novelty":0.149,"inverse_crowd":0.037,"payout_reliability":0.945,"value_per_competition":0.035,"triage_quality":0.89,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":29.4},"reasons":[{"sign":"good","text":"paid $130k in the last 90 days"},{"sign":"good","text":"89% response efficiency"},{"sign":"neutral","text":"766 reports in 90 days across 17 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.7 years"}]},{"id":"hackerone:hubspot","platform":"hackerone","slug":"hubspot","name":"HubSpot","url":"https://hackerone.com/hubspot","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-05-13T16:52:20.565Z","age_months":17.249492506587956,"reports_90d":582,"resolved_total":276,"response_efficiency":73,"response_indicator":"missed","paid_total":440700,"paid_90d":206800,"last_resolved_at":"2026-10-20T17:12:24.798Z","days_since_resolved":0.01749028732638889,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":25},"scope":[{"asset":"*.hs-sites(-eu1)?.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"*.hubspotemail.net","type":"WILDCARD","bounty":true,"severity":"medium","instruction":null},{"asset":"*.hubspotpagebuilder.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"*.hubspotpagebuilder.eu","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"Customer Connected Domain","type":"OTHER","bounty":true,"severity":"medium","instruction":"Refers to domains connected within a HubSpot portal. For example, an XSS vulnerability identified on a HubSpot hosted page (where customer domain is connected in the HubSpot portal)."},{"asset":"Customer Portal","type":"OTHER","bounty":true,"severity":"low","instruction":"Instructions on setting up a customer portal linked below:\nhttps://knowledge.hubspot.com/inbox/set-up-a-customer-portal"},{"asset":"HubSpot Android Mobile App","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"You can download the app at the link below:\nhttps://play.google.com/store/apps/details?id=com.hubspot.android&hl=en_US&gl=US&pli=1"},{"asset":"HubSpot Sales Office 365 add-in","type":"OTHER","bounty":true,"severity":"medium","instruction":"Setup instructions linked below:\nhttps://knowledge.hubspot.com/connected-email/get-started-with-the-hubspot-sales-office-365-add-in"},{"asset":"HubSpot iOS Mobile App","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"You can download the app at the link below:\nhttps://apps.apple.com/us/app/hubspot-crm-grow-better/id1107711722"},{"asset":"Other HubSpot-owned (sub)domains not listed as Out of Scope","type":"OTHER","bounty":true,"severity":"low","instruction":"Other HubSpot-owned (sub)domains not listed as Out of Scope . Please make sure to exercise due diligence before testing. You must include proof that the subdomain is registered to HubSpot to be eligib"},{"asset":"api*.hubapi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"api*.hubspot.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"app*.hubspot.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"chatspot.ai","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"hubspot.net","type":"URL","bounty":true,"severity":"medium","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.364,"label":"watch","experimental":true}},"derived":{"novelty":0.313,"inverse_crowd":0.0788,"payout_reliability":0.865,"value_per_competition":0.0637,"triage_quality":0.5475,"scope_breadth":0.5241,"crowding_per_asset_month":7.76,"slop_risk":0.364},"score":{"total":28.4,"parts":{"novelty":0.313,"inverse_crowd":0.079,"payout_reliability":0.865,"value_per_competition":0.064,"triage_quality":0.547,"scope_breadth":0.524},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":29.0},"reasons":[{"sign":"good","text":"paid $207k in the last 90 days"},{"sign":"neutral","text":"582 reports in 90 days across 25 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.4 years"}]},{"id":"hackerone:xiaomi","platform":"hackerone","slug":"xiaomi","name":"Xiaomi","url":"https://hackerone.com/xiaomi","meta":{"reward_min":50,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-05-19T09:02:59.466Z","age_months":77.05486215408966,"reports_90d":637,"resolved_total":1242,"response_efficiency":56,"response_indicator":"missed","paid_total":217153,"paid_90d":10010,"last_resolved_at":"2026-10-14T08:30:30.056Z","days_since_resolved":6.379929430844907,"avg_bounty_low":80,"avg_bounty_high":100,"min_bounty":50,"scope_count":89},"scope":[{"asset":"*.airstar-finance.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.airstar.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.airstarfinance.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.aleenote.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.aleenote.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.baoliyun.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.duokan.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hongyuanib.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mi.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mifile.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.migames.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miinsurtech.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miinsurtech.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miinsurtech.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mijiayoupin.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mioffice.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mios.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miot-spec.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mipay.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mipay.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miui.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miui.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.miwifi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.oktukids.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.openvela.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.wali.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiangkankeji.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiangkankeji.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiangkannews.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomi.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomi.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomiev.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomimimo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomimobile.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomiprint.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomiwear.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xiaomiyoupin.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xunkid.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.xunkids.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.youpin.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.zmifi.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"MIUI OS for Xiaomi Phone","type":"OTHER","bounty":true,"severity":"critical","instruction":"MIUI is Xiaomi's phone operating system (OS), customized on stock Android. The scope includes pre-installed apps signed with a Xiaomi certification."},{"asset":"Mi Band","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/hk/wearables/"},{"asset":"Mi Electric Scooter ","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/us/mi-electric-scooter/"},{"asset":"Mi Home Webcam ","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/us/mi-home-security-camera/ , https://www.mi.com/in/camera-360/"},{"asset":"Mi Laser Projector","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/us/mi-laser-projector-150/"},{"asset":"Mi Robot Vacuum","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/hk/mi-robot-vacuum/"},{"asset":"Mi TV ","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/in/product-list/tv/"},{"asset":"Mi TV Box","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/us/mi-box-s/"},{"asset":"Mi/Redmi Phone","type":"HARDWARE","bounty":true,"severity":"high","instruction":"https://www.mi.com/hk/mobile/"},{"asset":"Other APK Assets","type":"OTHER","bounty":true,"severity":"high","instruction":"com.miui.screenrecorder\ncom.android.providers.telephony\ncom.android.dynsystem\ncom.miui.powerkeeper\ncom.xiaomi.miplay_client\ncom.milink.service\ncom.xiaomi.mi_connect_service\ncom.android.updater\ncom.miu"},{"asset":"Other Hardware Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":"Accepted ranges of hardware in Xiaomi’s Program include Xiaomi and Mijia products  ( these are for assets that are not specified in  the Hardware/IoT  scope list )"},{"asset":"com.android.browser","type":"OTHER_APK","bounty":true,"severity":"high","instruction":null},{"asset":"com.mi.global.shop","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.miui.cloudbackup","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.miui.cloudservice","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.miui.micloudsync","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.account","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.market","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.mibrain.speech","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.micloud.sdk","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.mipicks","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.payment","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"com.xiaomi.smarthome","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.106,"label":"none","experimental":true}},"derived":{"novelty":0.175,"inverse_crowd":0.2605,"payout_reliability":0.7663,"value_per_competition":0.1376,"triage_quality":0.42,"scope_breadth":0.7238,"crowding_per_asset_month":2.3858,"slop_risk":0.106},"score":{"total":28.3,"parts":{"novelty":0.175,"inverse_crowd":0.26,"payout_reliability":0.766,"value_per_competition":0.138,"triage_quality":0.42,"scope_breadth":0.724},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":28.5},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"neutral","text":"637 reports in 90 days across 89 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.4 years"}]},{"id":"hackerone:stripchat","platform":"hackerone","slug":"stripchat","name":"Stripchat","url":"https://hackerone.com/stripchat","meta":{"reward_min":50,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-10-29T07:37:54.437Z","age_months":11.709780790107613,"reports_90d":186,"resolved_total":50,"response_efficiency":97,"response_indicator":"ok","paid_total":33570,"paid_90d":2150,"last_resolved_at":"2026-02-26T07:48:12.713Z","days_since_resolved":236.40929682667823,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":50,"scope_count":12},"scope":[{"asset":"*.stripchat.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"go.stripchat.com","type":"URL","bounty":true,"severity":"none","instruction":"Only at least High Severity vulnerabilities are eligible for this subdomain. Open endpoints are not eligible for bounty."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 236 days"},"slop":{"risk":0.335,"label":"none","experimental":true}},"derived":{"novelty":0.3617,"inverse_crowd":0.1223,"payout_reliability":0.7995,"value_per_competition":0.0868,"triage_quality":0.97,"scope_breadth":0.4126,"crowding_per_asset_month":5.1667,"slop_risk":0.335},"score":{"total":28.2,"parts":{"novelty":0.362,"inverse_crowd":0.122,"payout_reliability":0.799,"value_per_competition":0.087,"triage_quality":0.97,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15}],"percentile":28.1},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"good","text":"97% response efficiency"},{"sign":"neutral","text":"186 reports in 90 days across 12 assets"},{"sign":"bad","text":"nothing resolved for 236 days"},{"sign":"neutral","text":"launched 12 months ago"}]},{"id":"hackerone:temu","platform":"hackerone","slug":"temu","name":"Temu","url":"https://hackerone.com/temu","meta":{"reward_min":50,"reward_max":1966,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-11-28T06:17:43.839Z","age_months":34.742410875285195,"reports_90d":241,"resolved_total":35,"response_efficiency":88,"response_indicator":"ok","paid_total":80599,"paid_90d":20343,"last_resolved_at":"2026-08-31T03:15:48.831Z","days_since_resolved":50.59846212760417,"avg_bounty_low":789,"avg_bounty_high":1966,"min_bounty":50,"scope_count":7},"scope":[{"asset":"1641486558","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"ads.temu.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.einnovation.temu","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"partner.temu.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"seller.temu.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.temu.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"88% response, pays, last resolved 51d ago"},"slop":{"risk":0.689,"label":"elevated","experimental":true}},"derived":{"novelty":0.2392,"inverse_crowd":0.0508,"payout_reliability":0.854,"value_per_competition":0.0614,"triage_quality":0.88,"scope_breadth":0.3345,"crowding_per_asset_month":11.4762,"slop_risk":0.689},"score":{"total":28.2,"parts":{"novelty":0.239,"inverse_crowd":0.051,"payout_reliability":0.854,"value_per_competition":0.061,"triage_quality":0.88,"scope_breadth":0.334},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":27.6},"reasons":[{"sign":"good","text":"paid $20k in the last 90 days"},{"sign":"good","text":"88% response efficiency"},{"sign":"neutral","text":"241 reports in 90 days across 7 assets"},{"sign":"neutral","text":"running 2.9 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:starbucks_china","platform":"hackerone","slug":"starbucks_china","name":"Starbucks China","url":"https://hackerone.com/starbucks_china","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-11-06T18:12:06.441Z","age_months":23.424264019250515,"reports_90d":61,"resolved_total":39,"response_efficiency":73,"response_indicator":"missed","paid_total":19660,"paid_90d":5750,"last_resolved_at":"2026-10-19T08:38:32.012Z","days_since_resolved":1.374351236400463,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":4},"scope":[{"asset":"Starbucks China Android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Download the App:\nhttps://play.google.com/store/apps/details?id=com.starbucks.cn"},{"asset":"Starbucks China iOS","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Download the App:\nhttps://apps.apple.com/us/app/%E6%98%9F%E5%B7%B4%E5%85%8B%E4%B8%AD%E5%9B%BD/id499819758"},{"asset":"www.starbucks.com.cn/","type":"URL","bounty":true,"severity":"critical","instruction":"Starbucks China"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.246,"label":"none","experimental":true}},"derived":{"novelty":0.2785,"inverse_crowd":0.1244,"payout_reliability":0.862,"value_per_competition":0.1032,"triage_quality":0.5475,"scope_breadth":0.2589,"crowding_per_asset_month":5.0833,"slop_risk":0.246},"score":{"total":27.3,"parts":{"novelty":0.279,"inverse_crowd":0.124,"payout_reliability":0.862,"value_per_competition":0.103,"triage_quality":0.547,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":27.1},"reasons":[{"sign":"good","text":"paid $6k in the last 90 days"},{"sign":"neutral","text":"61 reports in 90 days across 4 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 2.0 years"}]},{"id":"hackerone:valve","platform":"hackerone","slug":"valve","name":"Valve","url":"https://hackerone.com/valve","meta":{"reward_min":100,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-05-07T17:20:38.703Z","age_months":101.45418558667009,"reports_90d":451,"resolved_total":1544,"response_efficiency":73,"response_indicator":"missed","paid_total":3129829,"paid_90d":283679,"last_resolved_at":"2026-10-19T19:22:04.654Z","days_since_resolved":0.9274456576967592,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":100,"scope_count":32},"scope":[{"asset":"*.steamstatic.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Steam Client","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Steam Servers","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.steampowered.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.valvesoftware.Steam","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.valvesoftware.Steam","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.valvesoftware.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"help.steampowered.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/valvesoftware","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":"We are happy to receive reports on code assets, but to be eligible for bounty they must be accompanied by a working POC against a shipping product."},{"asset":"partner.steamgames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"partner.steampowered.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"playartifact.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"steamcommunity.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"store.steampowered.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"storefront.steampowered.com","type":"URL","bounty":false,"severity":"critical","instruction":"This site is out of scope pending engineering cleanup. We are only interested in reports on this domain with a CVSS score above 8 at this time."},{"asset":"support.steampowered.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wiki.teamfortress.com","type":"URL","bounty":false,"severity":"critical","instruction":"This asset is a community run site, not part of Valve or its infrastructure. Reports about issues for this domain are appreciated and will be passed along to the volunteers that run the site."},{"asset":"www.counter-strike.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.dota2.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.teamfortress.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.valvesoftware.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.181,"label":"none","experimental":true}},"derived":{"novelty":0.157,"inverse_crowd":0.1351,"payout_reliability":0.8629,"value_per_competition":0.1173,"triage_quality":0.5475,"scope_breadth":0.5624,"crowding_per_asset_month":4.6979,"slop_risk":0.181},"score":{"total":27.2,"parts":{"novelty":0.157,"inverse_crowd":0.135,"payout_reliability":0.863,"value_per_competition":0.117,"triage_quality":0.547,"scope_breadth":0.562},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":26.7},"reasons":[{"sign":"good","text":"paid $284k in the last 90 days"},{"sign":"neutral","text":"451 reports in 90 days across 32 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.5 years"}]},{"id":"hackerone:shein","platform":"hackerone","slug":"shein","name":"SHEIN","url":"https://hackerone.com/shein","meta":{"reward_min":100,"reward_max":375,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-04-01T09:15:40.933Z","age_months":54.64800175900258,"reports_90d":104,"resolved_total":161,"response_efficiency":60,"response_indicator":"missed","paid_total":99774,"paid_90d":2000,"last_resolved_at":"2026-06-16T12:29:19.491Z","days_since_resolved":126.21407948871527,"avg_bounty_low":350,"avg_bounty_high":375,"min_bounty":100,"scope_count":17},"scope":[{"asset":"*.romwe.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"*.romwe. [com | co.in ]\n.romwe.org\n\n1. **Please note that if the exact same vulnerability is found on different top-level domains listed above (ie: .com, .co.in and .org), please do not submit multipl"},{"asset":"*.shein.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"*.shein.[com | in | tw | se | com.hk | com.vn | com.mx | co.uk ]\n\n1. **Please note that if the exact same vulnerability is found on different top-level domains listed above (example: .com, .in, .tw et"},{"asset":"*.sheingsp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1080248000","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[ROMWE - Fashion Store](https://apps.apple.com/app/romwe-fashion-store/id1080248000)  on the Apple App Store"},{"asset":"878577184","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[SHEIN-Fashion Shopping Online](https://apps.apple.com/app/shein-fashion-shopping-online/id878577184)  on the Apple App Store"},{"asset":"com.romwe","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[ROMWE](https://play.google.com/store/apps/details?id=com.romwe) on the Google Play Store"},{"asset":"com.zzkko","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[SHEIN-Fashion Shopping Online](https://play.google.com/store/apps/details?id=com.zzkko) on the Google Play Store"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.099,"label":"none","experimental":true}},"derived":{"novelty":0.2004,"inverse_crowd":0.2984,"payout_reliability":0.6492,"value_per_competition":0.197,"triage_quality":0.45,"scope_breadth":0.4649,"crowding_per_asset_month":2.0392,"slop_risk":0.099},"score":{"total":26.6,"parts":{"novelty":0.2,"inverse_crowd":0.298,"payout_reliability":0.649,"value_per_competition":0.197,"triage_quality":0.45,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":26.2},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"neutral","text":"104 reports in 90 days across 17 assets"},{"sign":"neutral","text":"running 4.6 years"}]},{"id":"hackerone:yelp","platform":"hackerone","slug":"yelp","name":"Yelp","url":"https://hackerone.com/yelp","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-09-06T15:04:02.653Z","age_months":121.43266153541144,"reports_90d":130,"resolved_total":528,"response_efficiency":37,"response_indicator":"missed","paid_total":380000,"paid_90d":40000,"last_resolved_at":"2026-10-20T16:22:39.133Z","days_since_resolved":0.052046595196759256,"avg_bounty_low":300,"avg_bounty_high":500,"min_bounty":50,"scope_count":26},"scope":[{"asset":"*.yelp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.yelpwifi.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"284910350","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Yelp Mobile"},{"asset":"542767785","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Restaurant Manager iOS app"},{"asset":"936983378","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Yelp for Business Owners"},{"asset":"com.yelp.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Yelp Mobile for Android"},{"asset":"com.yelp.android.biz","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Yelp for Business Owners"},{"asset":"yelptop100.com","type":"URL","bounty":true,"severity":"low","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 37%"},"slop":{"risk":0.07,"label":"none","experimental":true}},"derived":{"novelty":0.1462,"inverse_crowd":0.3514,"payout_reliability":0.6849,"value_per_competition":0.2354,"triage_quality":0.2775,"scope_breadth":0.5302,"crowding_per_asset_month":1.6667,"slop_risk":0.07},"score":{"total":26.5,"parts":{"novelty":0.146,"inverse_crowd":0.351,"payout_reliability":0.685,"value_per_competition":0.235,"triage_quality":0.277,"scope_breadth":0.53},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":25.8},"reasons":[{"sign":"good","text":"paid $40k in the last 90 days"},{"sign":"bad","text":"response efficiency only 37%"},{"sign":"neutral","text":"130 reports in 90 days across 26 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.1 years"}]},{"id":"hackerone:epicgames","platform":"hackerone","slug":"epicgames","name":"Epic Games","url":"https://hackerone.com/epicgames","meta":{"reward_min":200,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-10-12T16:32:06.278Z","age_months":60.25611441205605,"reports_90d":1187,"resolved_total":2591,"response_efficiency":73,"response_indicator":"missed","paid_total":9273934,"paid_90d":547150,"last_resolved_at":"2026-10-19T10:06:12.581Z","days_since_resolved":1.3134650211226853,"avg_bounty_low":750,"avg_bounty_high":1000,"min_bounty":200,"scope_count":557},"scope":[{"asset":"*.3lateral.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"*.amplitude-game.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.artstation.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.audicagame.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.cubicmotion.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"*.dancecentral.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.dropmix.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.easy.ac","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.epicgames.dev","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.epicgames.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.fallguys.com","type":"URL","bounty":true,"severity":"low","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.fortnite.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.harmonixmusic.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hmxservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hmxwebservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.mediatonic.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.oncatapult.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"*.psynet.gg","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.psyonix.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"*.quixel.com","type":"URL","bounty":true,"severity":"critical","instruction":"When assessing Quixel models and/or posts you may only test findings on your own created content. Do not test on any posts or content you did not create. When completed please delete any posts/comment"},{"asset":"*.rocketleague.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty. \nIf you are unsure whether or not an asset is co"},{"asset":"*.singspacegame.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.sketchfab.com","type":"URL","bounty":true,"severity":"critical","instruction":"When assessing Sketchfab models and/or posts you may only test findings on your own created content. Do not test on any posts or content you did not create. When completed please delete any posts/comm"},{"asset":"*.twinmotion.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.unrealengine.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"*.unrealtournament.com","type":"URL","bounty":true,"severity":"critical","instruction":"***Note:*** This asset may contain endpoints not hosted by Epic Games (third party endpoints). These third party endpoints are not eligible for bounty.\nIf you are unsure whether or not an asset is con"},{"asset":"Any other Epic games owned asset not listed in the out of scope section","type":"OTHER","bounty":true,"severity":"critical","instruction":"Note: Acceptance of findings of this type are at the discretion of the Epic Games team."},{"asset":"EOS C# SDK","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[C# SDK] (https://dev.epicgames.com/portal/api/v2/services/sdk/download/?sdkType=c_sharp)"},{"asset":"EpicGamesLauncher.exe    ","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"EpicOnlineServices","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteClient-Android-Shipping-arm64-es2.apk","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteClient-Win64-Shipping.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteLauncher-Win64-Shipping.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteLauncher-Win64-Shipping_BE.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteLauncher-Win64-Shipping_EAC.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"FortniteLauncher.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UEFN","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UnrealEditorFortnite-Win64-Shipping.exe","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"aqtooling.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"aquiris.com.br","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"aquiris.studio","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"aquiristech.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ballistic.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"ballistic.com.br","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"buckingfuggy.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"capturingreality.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"competitive.fortnite.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-service-live-testing.bfda.live.use1a.on.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"content-service.bfda.live.use1a.on.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cosmo.fdeb.live.use1a.on.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"create.fortnite.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev.epicgames.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"fab.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fortnite.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"forum.sketchfab.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is generally considered out of scope. We may accept submissions for this asset only if the finding is highly critical.\nExamples of severe findings:\n- Personal Data Exposure\n- Data Integrity Issue"},{"asset":"harmonixmusic.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hc2services.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hc2tooling.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"help.sketchfab.com","type":"URL","bounty":false,"severity":"critical","instruction":"This is generally considered out of scope. We may accept submissions for this asset only if the finding is highly critical.\nExamples of severe findings:\n- Personal Data Exposure\n- Data Integrity Issue"},{"asset":"hmxservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"horizonchase.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"horizonchase.com.br","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"horizonchaseturbo.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"http://nexus.live.ucs.on.epicgames.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://urc-auth-uefn.live.ucs.on.epicgames.com/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://urc-uefn.live.ucs.on.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please use http://urc-uefn.livetesting.ucs.on.epicgames.com/ when testing"},{"asset":"https://communities.epicgames.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://fn-commerce-live.eeef.live.use1a.on.epicgames.com/api/fn-commerce/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://fngw-svc-ds-livefn.ol.epicgames.net/api/magpie","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://fngw-svc-gc-livefn.ol.epicgames.net/api/magpie","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id1520720139","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"id1534920947","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"innersloth.kidswebservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"kidswebservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"metahuman.unrealengine.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is an API Base, please also see the following list of endpoints\n\nGET: /health-check\nGET: /metrics\nGET: /api/v1/getClientSession\nGET: /api/v1/getQueuePosition\nGET: /api/v1/get-eula\nPOST: /api/v1/a"},{"asset":"niantic.kidswebservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"playwonderbox.com","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"playwonderbox.com.br","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"staging.kidswebservices.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"twinmotion.unrealengine.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is an API Base, please also see the following list of endpoints\n\nGET: /health-check\nGET: /metrics\nGET: /logout\nGET: /api/drive/account\nGET: /api/drive/presentations\nPOST: /api/drive/rename_presen"},{"asset":"v1. kidswebservices.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"v1staging.kidswebservices.com ","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"wonderboxapi.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wonderboxdev.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.044,"label":"none","experimental":true}},"derived":{"novelty":0.1928,"inverse_crowd":0.6012,"payout_reliability":0.8621,"value_per_competition":0.4079,"triage_quality":0.5475,"scope_breadth":1.0,"crowding_per_asset_month":0.7104,"slop_risk":0.044},"score":{"total":26.0,"parts":{"novelty":0.193,"inverse_crowd":0.601,"payout_reliability":0.862,"value_per_competition":0.408,"triage_quality":0.547,"scope_breadth":1.0},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":25.3},"reasons":[{"sign":"good","text":"paid $547k in the last 90 days"},{"sign":"bad","text":"1,187 reports in 90 days across 557 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.0 years"}]},{"id":"hackerone:airtable","platform":"hackerone","slug":"airtable","name":"Airtable","url":"https://hackerone.com/airtable","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-07-30T18:54:13.854Z","age_months":98.6922967924652,"reports_90d":312,"resolved_total":265,"response_efficiency":72,"response_indicator":"missed","paid_total":153104,"paid_90d":9100,"last_resolved_at":"2026-10-15T16:52:27.799Z","days_since_resolved":5.031344442418981,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":20},"scope":[{"asset":"*.staging-airtableblocks.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"IMPORTANT: this domain is NOT eligible for stored XSS via building custom apps/blocks functionality."},{"asset":"*.staging.airtable.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"airtable.js SDK (https://www.npmjs.com/package/airtable)","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"- Install `airtable.js` via `npm install airtable`\n- Visit https://staging.airtable.com/account and generate an API key\n- Create a new Javascript file and add the following lines:\n\n```javascript\nconst"},{"asset":"api-staging.airtable.com","type":"URL","bounty":true,"severity":"critical","instruction":"Go to https://staging.airtable.com/account to generate an API key. See https://staging.airtable.com/api for API documentation per base."},{"asset":"https://www.npmjs.com/package/@airtable/mcp-cli","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Source code for our MCP CLI.\n\nVulnerabilities assuming a malicious MCP server must be paired with a demonstrated MCP exploit that provides a full exploit chain in order to be considered."},{"asset":"mcp.staging.airtable.com","type":"URL","bounty":true,"severity":"critical","instruction":"Use the official Airtable MCP CLI (https://www.npmjs.com/package/@airtable/mcp-cli) to interact with the MCP server. \n\nMCP CLI code is also in scope, but vulnerabilities assuming a malicious MCP serve"},{"asset":"staging.airtable.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.234,"label":"none","experimental":true}},"derived":{"novelty":0.1587,"inverse_crowd":0.1215,"payout_reliability":0.8491,"value_per_competition":0.0817,"triage_quality":0.54,"scope_breadth":0.4897,"crowding_per_asset_month":5.2,"slop_risk":0.234},"score":{"total":25.5,"parts":{"novelty":0.159,"inverse_crowd":0.121,"payout_reliability":0.849,"value_per_competition":0.082,"triage_quality":0.54,"scope_breadth":0.49},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":24.9},"reasons":[{"sign":"good","text":"paid $9k in the last 90 days"},{"sign":"neutral","text":"312 reports in 90 days across 20 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.2 years"}]},{"id":"hackerone:x","platform":"hackerone","slug":"x","name":"X / xAI","url":"https://hackerone.com/x","meta":{"reward_min":100,"reward_max":560,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-05-28T19:28:58.772Z","age_months":148.76131918276104,"reports_90d":742,"resolved_total":1778,"response_efficiency":71,"response_indicator":"missed","paid_total":1959405,"paid_90d":78850,"last_resolved_at":"2026-10-16T22:50:05.599Z","days_since_resolved":3.7829902757523146,"avg_bounty_low":500,"avg_bounty_high":560,"min_bounty":100,"scope_count":40},"scope":[{"asset":"*.grok.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.twimg.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.twitter.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.vine.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.x.ai","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.x.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"X Pixel Helper (Chrome Extension)","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"accounts.x.ai","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ai.x.GrokApp","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"ai.x.grok","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"chat.x.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.atebits.Tweetie2","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.twitter.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"console.x.ai","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"console.x.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grok-build","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"medium","instruction":null},{"asset":"grok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"grokipedia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"money.x.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pscp.tv","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"t.co","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"x.ai","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"x.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"xadsacademy.com","type":"URL","bounty":false,"severity":"medium","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.239,"label":"none","experimental":true}},"derived":{"novelty":0.1348,"inverse_crowd":0.101,"payout_reliability":0.8468,"value_per_competition":0.089,"triage_quality":0.5325,"scope_breadth":0.5974,"crowding_per_asset_month":6.1833,"slop_risk":0.239},"score":{"total":25.3,"parts":{"novelty":0.135,"inverse_crowd":0.101,"payout_reliability":0.847,"value_per_competition":0.089,"triage_quality":0.532,"scope_breadth":0.597},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":24.4},"reasons":[{"sign":"good","text":"paid $79k in the last 90 days"},{"sign":"neutral","text":"742 reports in 90 days across 40 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.4 years"}]},{"id":"hackerone:att","platform":"hackerone","slug":"att","name":"AT&T","url":"https://hackerone.com/att","meta":{"reward_min":100,"reward_max":400,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-07-22T14:32:14.066Z","age_months":86.96932158066203,"reports_90d":1062,"resolved_total":10483,"response_efficiency":93,"response_indicator":"ok","paid_total":6892300,"paid_90d":204800,"last_resolved_at":"2026-10-20T06:03:29.705Z","days_since_resolved":0.48201682667824075,"avg_bounty_low":300,"avg_bounty_high":400,"min_bounty":100,"scope_count":82},"scope":[{"asset":"Other Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 0d ago"},"slop":{"risk":0.159,"label":"none","experimental":true}},"derived":{"novelty":0.1668,"inverse_crowd":0.1474,"payout_reliability":0.9639,"value_per_competition":0.1138,"triage_quality":0.93,"scope_breadth":0.7108,"crowding_per_asset_month":4.3171,"slop_risk":0.159},"score":{"total":25.1,"parts":{"novelty":0.167,"inverse_crowd":0.147,"payout_reliability":0.964,"value_per_competition":0.114,"triage_quality":0.93,"scope_breadth":0.711},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":24.0},"reasons":[{"sign":"good","text":"paid $205k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"bad","text":"1,062 reports in 90 days across 82 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 7.2 years"}]},{"id":"hackerone:live_nation","platform":"hackerone","slug":"live_nation","name":"Live Nation","url":"https://hackerone.com/live_nation","meta":{"reward_min":50,"reward_max":2000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-09-24T19:55:50.215Z","age_months":0.8510554961689101,"reports_90d":1155,"resolved_total":93,"response_efficiency":93,"response_indicator":"ok","paid_total":238950,"paid_90d":201900,"last_resolved_at":"2026-10-20T12:56:39.403Z","days_since_resolved":0.1950990257523148,"avg_bounty_low":500,"avg_bounty_high":2000,"min_bounty":50,"scope_count":37},"scope":[{"asset":"app.livenation.com","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in Authentication Vulnerabilities"},{"asset":"app.ticketmaster.ca","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.com","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.com.au","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.eu","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"app.ticketmaster.ie","type":"URL","bounty":true,"severity":"critical","instruction":"We are interested in API and Authentication Vulnerabilities"},{"asset":"dk.royalarena.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"frontgatetickets.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"https://apps.apple.com/no/app/royal-arena/id1181913144","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"https://apps.apple.com/us/app/ticketmaster-buy-sell-tickets/id500003565","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://signup.ticketmaster.com/bugbountytest","type":"URL","bounty":true,"severity":"critical","instruction":"# Bug Bounty Campaign: Persona & ASU Sign-Up Verification Testing\n\n## Overview\n\nWe are launching a focused testing campaign inviting our security researcher community to evaluate the identity verifica"},{"asset":"livenation.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"livenation.me","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.ca","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.com.br","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"ticketmaster.de","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"www.lineup.com.mx","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**"},{"asset":"www.livenation.co.uk","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"www.onthewaterfrontfestival.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n\n\n**No automated scanning on checkout/ payment flows.**"},{"asset":"www.royalarena.dk","type":"URL","bounty":true,"severity":"critical","instruction":"Only the listed domains, other regional websites are out of scope\n\n\n\n**No automated scanning on checkout/ payment flows.**"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 0d ago"},"slop":{"risk":0.775,"label":"elevated","experimental":true}},"derived":{"novelty":0.7817,"inverse_crowd":0.0567,"payout_reliability":0.9646,"value_per_competition":0.0673,"triage_quality":0.93,"scope_breadth":0.5851,"crowding_per_asset_month":10.4054,"slop_risk":0.775},"score":{"total":25.1,"parts":{"novelty":0.782,"inverse_crowd":0.057,"payout_reliability":0.965,"value_per_competition":0.067,"triage_quality":0.93,"scope_breadth":0.585},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":23.5},"reasons":[{"sign":"good","text":"paid $202k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"bad","text":"1,155 reports in 90 days across 37 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 1 months ago"}]},{"id":"hackerone:verily_life_sciences","platform":"hackerone","slug":"verily_life_sciences","name":"Verily Life Sciences","url":"https://hackerone.com/verily_life_sciences","meta":{"reward_min":50,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-12-18T02:07:42.038Z","age_months":22.06639056993878,"reports_90d":174,"resolved_total":125,"response_efficiency":66,"response_indicator":"missed","paid_total":76199,"paid_90d":7650,"last_resolved_at":"2026-06-23T19:15:56.479Z","days_since_resolved":118.93170694241897,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":50,"scope_count":14},"scope":[{"asset":"https://*.projectbaseline.com/","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"https://*.signalpath.com/","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://*.verily.com/","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"helix.verily.com is managed by a third-party and is out of scope. \n\nContact form endpoints such as https://verily.com/contact-us and https://verily.com/solutions/public-health/wastewater/contact are a"},{"asset":"https://*.verilyme.com/","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://apps.apple.com/us/app/verily-me/id6448808133","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/details?id=com.verily.me","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.205,"label":"none","experimental":true}},"derived":{"novelty":0.285,"inverse_crowd":0.1537,"payout_reliability":0.6833,"value_per_competition":0.0985,"triage_quality":0.495,"scope_breadth":0.4356,"crowding_per_asset_month":4.1429,"slop_risk":0.205},"score":{"total":24.8,"parts":{"novelty":0.285,"inverse_crowd":0.154,"payout_reliability":0.683,"value_per_competition":0.099,"triage_quality":0.495,"scope_breadth":0.436},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":23.1},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"neutral","text":"174 reports in 90 days across 14 assets"},{"sign":"neutral","text":"running 1.8 years"}]},{"id":"hackerone:security","platform":"hackerone","slug":"security","name":"HackerOne","url":"https://hackerone.com/security","meta":{"reward_min":200,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2013-11-06T00:00:00.000Z","age_months":155.4573944630105,"reports_90d":1334,"resolved_total":1032,"response_efficiency":100,"response_indicator":"ok","paid_total":2104275,"paid_90d":55411,"last_resolved_at":"2026-10-19T14:34:03.846Z","days_since_resolved":1.127455009548611,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":200,"scope_count":73},"scope":[{"asset":"*.vpn.hackerone.net","type":"OTHER","bounty":true,"severity":"critical","instruction":"The HackerOne hacker VPN is used by hackers and HackerOne personnel. We'd be most interested in vulnerabilities that allow you to route traffic to other clients (lack of client isolation), routing tra"},{"asset":"a5s.hackerone-ext-content.com","type":"URL","bounty":true,"severity":"medium","instruction":"This domain is used to serve static marketing assets. No confidential information is stored on these systems. However, it is important to us that these assets cannot be updated by an unauthorized thir"},{"asset":"api.hackerone.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is our public API that customers use to read and interact with reports. To look for vulnerabilities in this asset, create a sandboxed program, select HackerOne Professional or HackerOne Enterpris"},{"asset":"app.pullrequest.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please use your `@wearehackerone.com` email address when signing up."},{"asset":"b5s.hackerone-ext-content.com","type":"URL","bounty":true,"severity":"medium","instruction":"This domain is used to serve static marketing assets. No confidential information is stored on these systems. However, it is important to us that these assets cannot be updated by an unauthorized thir"},{"asset":"cover-photos-us-east-2.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"cover-photos.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"ctf.hacker101.com","type":"URL","bounty":true,"severity":"low","instruction":"The Hacker101 CTF domain, ctf.hacker101.com, is not connected to HackerOne's production environment. It is hosted on Amazon AWS. Users authenticate through HackerOne.com (OAuth). The maximum bounty fo"},{"asset":"errors.hackerone.net","type":"URL","bounty":true,"severity":"high","instruction":"A separate domain that we use to capture information of client and server side exceptions."},{"asset":"hackathon-photos-us-east-2.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"hackathon-photos.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"hackerone-ext-content.com","type":"URL","bounty":true,"severity":"medium","instruction":"This domain is used to serve static marketing assets. No confidential information is stored on these systems. However, it is important to us that these assets cannot be updated by an unauthorized thir"},{"asset":"hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is an Amazon S3 bucket that contains attachments of reports and activities. These attachments may contain confidential information. A signed request is required to download an object."},{"asset":"hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"hackerone.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is our main application that hackers and customers use to interact with each other. It connects with a database that contains information about vulnerability reports, users, and programs. This sy"},{"asset":"hackerone.live","type":"URL","bounty":true,"severity":"low","instruction":null},{"asset":"https://*.hackerone-ext-content.com","type":"URL","bounty":true,"severity":"medium","instruction":"This domain is used to serve static marketing assets. No confidential information is stored on these systems. However, it is important to us that these assets cannot be updated by an unauthorized thir"},{"asset":"https://*.hackerone-user-content.com/","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"https://github.com/Hacker0x01/react-datepicker","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"https://hackerone.com/mcp","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"mta-sts.wearehackerone.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"profile-photos-us-east-2.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"profile-photos.hackerone-user-content.com","type":"URL","bounty":true,"severity":"low","instruction":"This is an Amazon S3 bucket that contains profile and cover photos of users and programs. It does not contain any highly confidential information and would not impact the main application if it would "},{"asset":"reviewer.pullrequest.com","type":"URL","bounty":true,"severity":"critical","instruction":"Please use your `@wearehackerone.com` email address when signing up."},{"asset":"www.hackerone.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is our marketing website. It does not contain any report or customer information. It may store information about hackers, such as information collected through the [penetration tester sign up for"},{"asset":"www.wearehackerone.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 1d ago"},"slop":{"risk":0.271,"label":"none","experimental":true}},"derived":{"novelty":0.1325,"inverse_crowd":0.1026,"payout_reliability":0.9975,"value_per_competition":0.0885,"triage_quality":1.0,"scope_breadth":0.6923,"crowding_per_asset_month":6.0913,"slop_risk":0.271},"score":{"total":24.4,"parts":{"novelty":0.133,"inverse_crowd":0.103,"payout_reliability":0.998,"value_per_competition":0.089,"triage_quality":1.0,"scope_breadth":0.692},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":22.6},"reasons":[{"sign":"good","text":"paid $55k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"bad","text":"1,334 reports in 90 days across 73 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 13.0 years"}]},{"id":"hackerone:fronthq","platform":"hackerone","slug":"fronthq","name":"Front","url":"https://hackerone.com/fronthq","meta":{"reward_min":100,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-10-17T14:20:23.221Z","age_months":36.1112756627215,"reports_90d":155,"resolved_total":236,"response_efficiency":66,"response_indicator":"missed","paid_total":118308,"paid_90d":350,"last_resolved_at":"2026-08-12T18:52:14.467Z","days_since_resolved":68.94816541464121,"avg_bounty_low":150,"avg_bounty_high":200,"min_bounty":100,"scope_count":12},"scope":[{"asset":"Front for Mac","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Download here: https://front.com/download"},{"asset":"Front for Windows","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"Download here: https://front.com/download"},{"asset":"api2.frontapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"This scope is our public API documented at https://dev.frontapp.com/"},{"asset":"app.frontapp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.frontapp.mobile","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"https://apps.apple.com/us/app/frontapp/id983808769"},{"asset":"com.frontapp.mobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"https://play.google.com/store/apps/details?id=com.frontapp.mobile"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.181,"label":"none","experimental":true}},"derived":{"novelty":0.2356,"inverse_crowd":0.1478,"payout_reliability":0.723,"value_per_competition":0.1009,"triage_quality":0.495,"scope_breadth":0.4126,"crowding_per_asset_month":4.3056,"slop_risk":0.181},"score":{"total":24.3,"parts":{"novelty":0.236,"inverse_crowd":0.148,"payout_reliability":0.723,"value_per_competition":0.101,"triage_quality":0.495,"scope_breadth":0.413},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":22.2},"reasons":[{"sign":"good","text":"paid $350 in the last 90 days"},{"sign":"neutral","text":"155 reports in 90 days across 12 assets"},{"sign":"neutral","text":"running 3.0 years"}]},{"id":"hackerone:razorpay","platform":"hackerone","slug":"razorpay","name":"Razorpay","url":"https://hackerone.com/razorpay","meta":{"reward_min":250,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-05-23T11:42:36.745Z","age_months":52.936230593134454,"reports_90d":50,"resolved_total":null,"response_efficiency":57,"response_indicator":"missed","paid_total":46911,"paid_90d":1700,"last_resolved_at":"2026-09-08T11:20:07.148Z","days_since_resolved":42.26213901417824,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":250,"scope_count":6},"scope":[{"asset":"api.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Reference:\nhttps://razorpay.com/docs/"},{"asset":"checkout.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Payment Workflow: https://razorpay.com/docs/payments/dashboard/test-live-modes/\nReference:\nhttps://razorpay.com/docs/\nhttps://razorpay.com/docs/payments/payments/test-card-upi-details/"},{"asset":"dashboard.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Signup Workflow: https://razorpay.com/docs/payments/sign-up/"},{"asset":"invoices.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Reference:\nhttps://razorpay.com/docs/"},{"asset":"payroll.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Doc - https://razorpay.com/docs/x/xpayroll/"},{"asset":"x.razorpay.com","type":"URL","bounty":true,"severity":"critical","instruction":"Docs - https://razorpay.com/docs/x"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.5,"label":"watch","experimental":true}},"derived":{"novelty":0.2029,"inverse_crowd":0.2269,"payout_reliability":0.7101,"value_per_competition":0.1341,"triage_quality":0.4275,"scope_breadth":0.313,"crowding_per_asset_month":2.7778,"slop_risk":0.5},"score":{"total":24.1,"parts":{"novelty":0.203,"inverse_crowd":0.227,"payout_reliability":0.71,"value_per_competition":0.134,"triage_quality":0.427,"scope_breadth":0.313},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":21.7},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"neutral","text":"50 reports in 90 days across 6 assets"},{"sign":"neutral","text":"running 4.4 years"}]},{"id":"hackerone:cloudflare","platform":"hackerone","slug":"cloudflare","name":"Cloudflare Public Bug Bounty","url":"https://hackerone.com/cloudflare","meta":{"reward_min":0,"reward_max":350,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-04-21T18:40:25.858Z","age_months":149.9780325883432,"reports_90d":1164,"resolved_total":422,"response_efficiency":87,"response_indicator":"ok","paid_total":673700,"paid_90d":107050,"last_resolved_at":"2026-10-19T12:53:54.087Z","days_since_resolved":1.1970124053819444,"avg_bounty_low":250,"avg_bounty_high":350,"min_bounty":0,"scope_count":85},"scope":[{"asset":"*.cloudflare.com","type":"URL","bounty":true,"severity":"critical","instruction":"Excluding support.cloudflare.com, community.cloudflare.com and other SaaS applications"},{"asset":"*.cloudflarepartners.com","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"*.teams.cloudflare.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"1.1.1.1 Resolver","type":"OTHER","bounty":true,"severity":"critical","instruction":"A blazing fast DNS resolver built for private browsing.\nhttps://1.1.1.1/\nhttps://developers.cloudflare.com/1.1.1.1/what-is-1.1.1.1/\nhttps://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/"},{"asset":"AI Gateway","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/ai-gateway/"},{"asset":"AMP Real URL","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/speed/optimization/other/amp-real-url/"},{"asset":"API Shield","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/api-shield/"},{"asset":"Area 1","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Bot Management","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare enables you to manage bots with speed and accuracy by applying several detection methods: Behavioral analysis, machine learning, and fingerprinting.\nhttps://www.cloudflare.com/products/bot-"},{"asset":"Browser Isolation","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/"},{"asset":"CDNJS","type":"OTHER","bounty":true,"severity":"critical","instruction":"CDNJS is a free and open source project to organize and provide popular front-end web development resources to developers via a fast CDN infrastructure without usage limitations and fees.\n\nhttps://git"},{"asset":"China Network","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/china-network/"},{"asset":"Cloudflare Access","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare Access is an application that controls access to your sites and integrates with social and enterprise identity providers (IdP) for managing user credentials.\n\nhttps://www.cloudflare.com/pro"},{"asset":"Cloudflare Analytics","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/analytics/"},{"asset":"Cloudflare CASB","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare's cloud access security broker (CASB) service gives comprehensive visibility and control over SaaS apps, so you can easily prevent data leaks and compliance violations. With Zero Trust secu"},{"asset":"Cloudflare Cache ","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/cache/"},{"asset":"Cloudflare D1","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://blog.cloudflare.com/introducing-d1/"},{"asset":"Cloudflare DNS","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Cloudflare Durable Objects","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/durable-objects/"},{"asset":"Cloudflare Pages","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/pages"},{"asset":"Cloudflare R2","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://blog.cloudflare.com/r2-open-beta/"},{"asset":"Cloudflare Tunnel","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs.\n\nhttps://developers.cloudflare.com/cloudflare-one/connectio"},{"asset":"Cloudflare Workers CI","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Cloudflare Zaraz","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/zaraz/"},{"asset":"Cloudflare Zero Trust/Cloudflare One","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Data Loss Prevention (DLP)","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/cloudflare-one/policies/data-loss-prevention/"},{"asset":"Gateway","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/cloudflare-one/policies/gateway/"},{"asset":"Hyperdrive","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/hyperdrive/"},{"asset":"Images","type":"OTHER","bounty":true,"severity":"none","instruction":"https://developers.cloudflare.com/speed/optimization/images/#image-optimization"},{"asset":"Load Balancing","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare's Load Balancing automatically reduces latency by directing visitors to infrastructure closest to them.\n\nhttps://www.cloudflare.com/load-balancing/"},{"asset":"Magic Firewall","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/magic-firewall/"},{"asset":"Magic Transit","type":"OTHER","bounty":true,"severity":"critical","instruction":"Magic Transit is a software-defined networking product that offers IP transit with DDoS protection, next-gen firewall, traffic acceleration and more for your on-premise and data center networks from a"},{"asset":"Magic WAN","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/magic-wan/"},{"asset":"Open source tools from Cloudflare","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://github.com/cloudflare"},{"asset":"SSL/TLS","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/ssl/"},{"asset":"Spectrum","type":"OTHER","bounty":true,"severity":"critical","instruction":"Spectrum extends the power of Cloudflare's DDoS, TLS, and IP Firewall to TCP and UDP-based services, keeping them online and secure.\nhttps://www.cloudflare.com/products/cloudflare-spectrum/"},{"asset":"Stream","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare Stream is an easy-to-use, affordable, on-demand video streaming platform. Stream seamlessly integrates video storage, encoding, and a customizable player with Cloudflare’s fast, secure, and"},{"asset":"Vectorize","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/vectorize/"},{"asset":"WARP Mobile Apps","type":"OTHER","bounty":true,"severity":"critical","instruction":"Download on Android: https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone\nDownload on iOS: https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627\nWARP is a "},{"asset":"WARP desktop client","type":"OTHER","bounty":true,"severity":"critical","instruction":"Cloudflare Zero Trust client applications releases on Windows, Linux and MacOS"},{"asset":"Waiting Room","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/waiting-room/"},{"asset":"Workers","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/workers/"},{"asset":"Workers AI","type":"AI_MODEL","bounty":true,"severity":"critical","instruction":"Reports on Prompt Injection attacks on models hosted by Workers AI without demonstrating an impact on Cloudflare will not be accepted."},{"asset":"Workers KV","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://developers.cloudflare.com/kv/"},{"asset":"api.cloudflare.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"cloudflareworkers.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is a Cloudflare Workers test site.\nCloudflare Workers provides a lightweight JavaScript execution environment that allows developers to augment existing applications or create entirely new ones w"},{"asset":"dash.cloudflare.com","type":"URL","bounty":true,"severity":"critical","instruction":"The Cloudflare dashboard (https://dash.cloudflare.com/) and any direct calls from the dashboard to other Cloudflare owned resources are considered in scope."},{"asset":"http://github.com/cloudflare","type":"URL","bounty":true,"severity":"critical","instruction":"-"},{"asset":"https://github.com/cloudflare/vinext","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The Next.js API surface, reimplemented on Vite.\nExperimental — under heavy development.\nTriage may delay for this repo as we will be assessing for duplicates."},{"asset":"https://github.com/cloudflare/workerd","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"one.dash.cloudflare.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 1d ago"},"slop":{"risk":0.275,"label":"none","experimental":true}},"derived":{"novelty":0.1344,"inverse_crowd":0.1392,"payout_reliability":0.9324,"value_per_competition":0.1063,"triage_quality":0.87,"scope_breadth":0.7165,"crowding_per_asset_month":4.5647,"slop_risk":0.275},"score":{"total":22.8,"parts":{"novelty":0.134,"inverse_crowd":0.139,"payout_reliability":0.932,"value_per_competition":0.106,"triage_quality":0.87,"scope_breadth":0.717},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":21.3},"reasons":[{"sign":"good","text":"paid $107k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"bad","text":"1,164 reports in 90 days across 85 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.5 years"}]},{"id":"hackerone:figma","platform":"hackerone","slug":"figma","name":"Figma","url":"https://hackerone.com/figma","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-09-30T16:44:49.231Z","age_months":72.64186125478173,"reports_90d":412,"resolved_total":292,"response_efficiency":70,"response_indicator":"missed","paid_total":606150,"paid_90d":191050,"last_resolved_at":"2026-10-16T18:29:01.725Z","days_since_resolved":3.964285113715278,"avg_bounty_low":500,"avg_bounty_high":750,"min_bounty":50,"scope_count":11},"scope":[{"asset":"Figma Atlassian App","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://marketplace.atlassian.com/apps/1217865/figma-for-jira \n\nUnauthorized access via this app or the APIs that this app uses is also in scope."},{"asset":"Figma Desktop App","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Figma Slack App","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://figma.slack.com/apps/A01N2QYSA81-figma-and-figjam?tab=more_info"},{"asset":"Figma Weave","type":"OTHER","bounty":true,"severity":"critical","instruction":"Figma Weave (formerly Weavy) is an iframe within the Figma application which can be reached by clicking \"Weave\" in Figma (redirects to https://figma.com/weave/...) or directly at https://weavy.ai."},{"asset":"Figma for Microsoft Teams","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://appsource.microsoft.com/en-us/product/office/wa200004521?tab=overview"},{"asset":"Figma iOS and Android apps","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"api.figma.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.figma.com","type":"URL","bounty":true,"severity":"critical","instruction":"We are primarily looking for high/critical vulnerabilities in the system."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.506,"label":"watch","experimental":true}},"derived":{"novelty":0.1791,"inverse_crowd":0.0461,"payout_reliability":0.8414,"value_per_competition":0.0496,"triage_quality":0.525,"scope_breadth":0.3997,"crowding_per_asset_month":12.4848,"slop_risk":0.506},"score":{"total":22.8,"parts":{"novelty":0.179,"inverse_crowd":0.046,"payout_reliability":0.841,"value_per_competition":0.05,"triage_quality":0.525,"scope_breadth":0.4},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":20.8},"reasons":[{"sign":"good","text":"paid $191k in the last 90 days"},{"sign":"neutral","text":"412 reports in 90 days across 11 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.1 years"}]},{"id":"hackerone:vercel","platform":"hackerone","slug":"vercel","name":"Vercel","url":"https://hackerone.com/vercel","meta":{"reward_min":50,"reward_max":1500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-09-21T17:00:25.540Z","age_months":0.9536202064130352,"reports_90d":2766,"resolved_total":331,"response_efficiency":93,"response_indicator":"ok","paid_total":675277,"paid_90d":63702,"last_resolved_at":"2026-10-16T22:36:59.834Z","days_since_resolved":3.79208477806713,"avg_bounty_low":1198,"avg_bounty_high":1500,"min_bounty":50,"scope_count":28},"scope":[{"asset":"*.vercel.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.vercel.live","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Vercel sandbox","type":"OTHER","bounty":true,"severity":"critical","instruction":"Vercel Sandbox lets customers run programs in an isolated environment, take disk snapshots, limit egress network connections, and perform credential brokering at the networking level.\n\nThe Firecracker"},{"asset":"https://github.com/nitrojs/nitro","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/nuxt/nuxt","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/sveltejs/kit","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/sveltejs/svelte","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"If you have found a repository configuration issue (e.g. vulnerable GitHub Action), please report this here.\n\nOut of scope:\n- Vulnerable/outdated dependencies\n- Best practices\n- Bugs in the code itsel"},{"asset":"https://github.com/vercel-labs/agent-skills","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel-labs/skills","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/ai","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/async-sema","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/chat","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/eve","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/flags","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/ms","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/next.js","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/swr","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/turborepo","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/vercel","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/vercel/workflow","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"v0.app","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"v0.dev","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vercel.app","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"vercel.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"93% response, paid recently, resolved 4d ago"},"slop":{"risk":0.934,"label":"elevated","experimental":true}},"derived":{"novelty":0.765,"inverse_crowd":0.0149,"payout_reliability":0.9567,"value_per_competition":0.0218,"triage_quality":0.93,"scope_breadth":0.5417,"crowding_per_asset_month":32.9286,"slop_risk":0.934},"score":{"total":22.6,"parts":{"novelty":0.765,"inverse_crowd":0.015,"payout_reliability":0.957,"value_per_competition":0.022,"triage_quality":0.93,"scope_breadth":0.542},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":20.4},"reasons":[{"sign":"good","text":"paid $64k in the last 90 days"},{"sign":"good","text":"93% response efficiency"},{"sign":"bad","text":"2,766 reports in 90 days across 28 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 1 months ago"}]},{"id":"hackerone:doppler","platform":"hackerone","slug":"doppler","name":"Doppler","url":"https://hackerone.com/doppler","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-12-15T04:47:46.326Z","age_months":46.17772820473991,"reports_90d":481,"resolved_total":44,"response_efficiency":89,"response_indicator":"ok","paid_total":36375,"paid_90d":0,"last_resolved_at":"2026-09-12T20:46:31.811Z","days_since_resolved":37.86879800723379,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":50,"scope_count":14},"scope":[{"asset":"api.doppler.com","type":"URL","bounty":true,"severity":"critical","instruction":"This domain hosts our public API. It's used by the Doppler CLI as well as by customers directly. All APIs and supported auth schemes are [documented](https://docs.doppler.com/reference) in our Docs hu"},{"asset":"dashboard.doppler.com","type":"URL","bounty":true,"severity":"critical","instruction":"This web app provides the ability to view and manage your secrets, team members, and account. You can read about additional functionality in our [docs](https://docs.doppler.com/).\n\nSupported auth meth"},{"asset":"doppler","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"This is the pre-built binary based on the Doppler CLI [source code](https://github.com/DopplerHQ/cli) (also in scope). You can find all builds on [cli.doppler.com](https://cli.doppler.com/download) or"},{"asset":"doppler.team","type":"URL","bounty":true,"severity":"critical","instruction":"This domain hosts our internal tools for managing Workplace plans and features. It does not provide access to user secrets.\n\nAccess is protected via Cloudflare Access. Users must authenticate with a v"},{"asset":"https://github.com/DopplerHQ/cli","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The Doppler CLI is the primary agent for retrieving secrets and executing your applications. It communicates with the Doppler API, which is also in scope.  You can read more about the CLI on our [Docs"},{"asset":"share.doppler.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only submissions for vulnerabilities that permit access to shared secrets or otherwise bypass secret access controls are eligible for bounty on share.doppler.com.\n\nPlease do not send submissions such "}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"89% response, no recent payout seen, last resolved 38d ago"},"slop":{"risk":0.812,"label":"elevated","experimental":true}},"derived":{"novelty":0.214,"inverse_crowd":0.0509,"payout_reliability":0.5763,"value_per_competition":0.0448,"triage_quality":0.89,"scope_breadth":0.4356,"crowding_per_asset_month":11.4524,"slop_risk":0.812},"score":{"total":22.1,"parts":{"novelty":0.214,"inverse_crowd":0.051,"payout_reliability":0.576,"value_per_competition":0.045,"triage_quality":0.89,"scope_breadth":0.436},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":19.9},"reasons":[{"sign":"good","text":"89% response efficiency"},{"sign":"neutral","text":"481 reports in 90 days across 14 assets"},{"sign":"neutral","text":"running 3.8 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:ui","platform":"hackerone","slug":"ui","name":"Ubiquiti Inc.","url":"https://hackerone.com/ui","meta":{"reward_min":150,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-03-12T21:33:24.229Z","age_months":139.29646806974867,"reports_90d":1155,"resolved_total":1690,"response_efficiency":87,"response_indicator":"ok","paid_total":2090000,"paid_90d":205000,"last_resolved_at":"2026-10-14T05:35:17.628Z","days_since_resolved":6.501601051215277,"avg_bounty_low":161,"avg_bounty_high":200,"min_bounty":150,"scope_count":73},"scope":[{"asset":" UniFi OS Server","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ubnt.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.ui.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.uisp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"AmpliFi","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Cloudkey","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"EdgeMAX","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"Enterprise Audio/Video","type":"HARDWARE","bounty":true,"severity":"medium","instruction":null},{"asset":"UCRM","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UFiber","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UID","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://ui.com/uid"},{"asset":"UISP","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UNMS","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Access","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Cloud","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Connect","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Gateways (UDM, UXG, USG)","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi LED","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Network Application","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Protect","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Switches","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Talk","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi Wireless Access Points","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"UniFi-Play","type":"HARDWARE","bounty":true,"severity":"medium","instruction":null},{"asset":"account.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"airFiber","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"airMAX","type":"HARDWARE","bounty":true,"severity":"critical","instruction":null},{"asset":"blog.ui.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"careers.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ubnt.discovery.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ubnt.easyunifi","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ubnt.ucrm","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":null},{"asset":"com.ubnt.umobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"community.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"design.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"dev-training.ui.com","type":"URL","bounty":false,"severity":"medium","instruction":"This asset is hosted and maintained by a 3rd party moonami.com"},{"asset":"fw-update.ubnt.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"help.ui.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"help.uisp.com","type":"URL","bounty":false,"severity":"none","instruction":null},{"asset":"https://*.ui.com/distributors/","type":"WILDCARD","bounty":false,"severity":"none","instruction":null},{"asset":"https://*.ui.com/training/partners/","type":"WILDCARD","bounty":false,"severity":"none","instruction":null},{"asset":"https://ui.com/distributors/","type":"URL","bounty":false,"severity":"none","instruction":null},{"asset":"https://ui.com/training/partners/","type":"URL","bounty":false,"severity":"none","instruction":null},{"asset":"ir.ui.com","type":"URL","bounty":false,"severity":"critical","instruction":null},{"asset":"ispdesign.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rma.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"store.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"training.ui.com","type":"URL","bounty":false,"severity":"medium","instruction":"This asset is hosted and maintained by a 3rd party moonami.com"},{"asset":"uisp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"unifi.ui.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wiki.ui.com","type":"URL","bounty":false,"severity":"none","instruction":"This is a 3rd party service provided by document360.com"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 7d ago"},"slop":{"risk":0.217,"label":"none","experimental":true}},"derived":{"novelty":0.1384,"inverse_crowd":0.1197,"payout_reliability":0.9211,"value_per_competition":0.0854,"triage_quality":0.87,"scope_breadth":0.6923,"crowding_per_asset_month":5.274,"slop_risk":0.217},"score":{"total":21.7,"parts":{"novelty":0.138,"inverse_crowd":0.12,"payout_reliability":0.921,"value_per_competition":0.085,"triage_quality":0.87,"scope_breadth":0.692},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":19.5},"reasons":[{"sign":"good","text":"paid $205k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"bad","text":"1,155 reports in 90 days across 73 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.6 years"}]},{"id":"hackerone:mongodb","platform":"hackerone","slug":"mongodb","name":"MongoDB","url":"https://hackerone.com/mongodb","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-09-01T09:04:29.338Z","age_months":49.621563092564074,"reports_90d":2039,"resolved_total":338,"response_efficiency":86,"response_indicator":"ok","paid_total":448549,"paid_90d":94600,"last_resolved_at":"2026-10-16T22:25:50.197Z","days_since_resolved":3.79983520630787,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":75},"scope":[{"asset":"*.mongodb.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"[Non-Core]\n.mongodb.com/ is in scope, and includes\nmongodb.com/docs/\nsupport.mongodb.com\nAll others sites that follow that pattern are in-scope. If the site is owned by MongoDB, it is eligible for a b"},{"asset":"App Services/Realm","type":"OTHER","bounty":false,"severity":"critical","instruction":"MongoDB App Services (fka Realm) has been deprecated."},{"asset":"Atlas Charts","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\ncharts.mongodb.com"},{"asset":"Atlas Data Federation","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nAtlas Data Federation is embedded into the Atlas Platform. Read more here:\nhttps://www.mongodb.com/products/platform/atlas-data-federation"},{"asset":"Atlas IAM","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\naccount.mongodb.com and other Identity and Access Management bugs within Atlas, regarding Organizations, Projects and permissions."},{"asset":"Atlas Infinite","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nhttps://www.mongodb.com/docs/atlas/infinite/atlas-infinite-landing/"},{"asset":"Atlas Payments/Billing","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nBilling is integrated into the Atlas Platform, read more here: https://www.mongodb.com/docs/atlas/billing/"},{"asset":"Cluster-To-Cluster sync","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.mongodb.com/try/download/mongosync"},{"asset":"Compass","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.mongodb.com/try/download/compass\nResponsible social engineering reports are in scope but not eligible for bounty."},{"asset":"Database Tools","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.mongodb.com/try/download/database-tools"},{"asset":"Drivers","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[Non-Core]\nThese are the following drivers that are in scope:\nAtlas SQL JDBC Driver\nAtlas SQL ODBC Driver\nC\nC++\nGo\nJVM (Java, Scala, Kotlin)\nLibmongocrypt\nNode.js/Typescript\nPHP\nPython\nRuby\nRust\nThe S"},{"asset":"Enterprise Edition Products and Tools","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nOps manager and Cloud manager"},{"asset":"Evergreen","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://github.com/evergreen-ci/evergreen"},{"asset":"Jira Projects","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nMongoDB is open-sourced and has publicly visible JIRA tickets. Only report information disclosure issues-- no technical bugs are accepted. Bounty may be varied."},{"asset":"MongoDB Assistant","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nMongoDB Assistant is integrated into Data Explorer and Compass."},{"asset":"MongoDB Atlas","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nAtlas and Atlas Features and Products are in scope and eligible for bounty.\nAtlas IAM, Charts, Data Federation, Payments/Billing, are listed elsewhere in the scope. Other Atlas products not exp"},{"asset":"MongoDB Atlas Agent Engine ","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nhttps://www.mongodb.com/docs/agentengine/\nCustomers are responsible for the correct functioning of their MongoDB-hosted agent, so no bug reports will be accepted for misbehaving agents. Bug rep"},{"asset":"MongoDB Atlas Agent Engine CLI and First Party Libraries","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nResponsible social engineering reports are in scope but not eligible for bounty."},{"asset":"MongoDB Connectors","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nThe Connectors are in scope. This includes\nKafka Connector\nPowerBI Connector\nBI Connector\nSpark Connector\nTableau Connector"},{"asset":"MongoDB IntelliJ Plugin","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://plugins.jetbrains.com/plugin/24377-mongodb"},{"asset":"MongoDB MCP Server","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://github.com/mongodb-js/mongodb-mcp-server"},{"asset":"MongoDB Owned GitHub Repositories","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nOnly github.com/mongodb is considered to be eligible for bounty. Other MongoDB owned repositories are in scope, but not eligible for bounty.\nhttps://github.com/mongodb/kingfisher is out of "},{"asset":"MongoDB Partner Integrations","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://cloud.mongodb.com/ecosystem\nPartner integrations may be eligible for bounties, depending on the owner of the issue."},{"asset":"MongoDB Server","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\nServer Community and Server Enterprise are in scope and eligible for bounty."},{"asset":"MongoDB Shell","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.mongodb.com/try/download/shell"},{"asset":"MongoDB Toolchain","type":"OTHER","bounty":false,"severity":"critical","instruction":"[Non-Core]\nhttp://mongodbtoolchain.build.10gen.cc"},{"asset":"Relational Migrator","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.mongodb.com/try/download/relational-migrator"},{"asset":"University Platform","type":"OTHER","bounty":false,"severity":"critical","instruction":"[Non-Core]\nlearn.mongodb.com is owned by 3rd party and not eligible for bounty"},{"asset":"VS Code Plugin","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://marketplace.visualstudio.com/items?itemName=mongodb.mongodb-vscode"},{"asset":"voyageai.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-Core]\nhttps://www.voyageai.com\nhttps://ai.mongodb.com\nhttps://api.voyageai.com\nhttps://blog.voyageai.com/\nhttps://docs.voyageai.com/docs/introduction"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 4d ago"},"slop":{"risk":0.568,"label":"watch","experimental":true}},"derived":{"novelty":0.2081,"inverse_crowd":0.0663,"payout_reliability":0.9217,"value_per_competition":0.0624,"triage_quality":0.86,"scope_breadth":0.6966,"crowding_per_asset_month":9.0622,"slop_risk":0.568},"score":{"total":21.6,"parts":{"novelty":0.208,"inverse_crowd":0.066,"payout_reliability":0.922,"value_per_competition":0.062,"triage_quality":0.86,"scope_breadth":0.697},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":19.0},"reasons":[{"sign":"good","text":"paid $95k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"bad","text":"2,039 reports in 90 days across 75 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.1 years"}]},{"id":"hackerone:roblox","platform":"hackerone","slug":"roblox","name":"Roblox","url":"https://hackerone.com/roblox","meta":{"reward_min":100,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-01-27T18:56:18.561Z","age_months":80.75385101445927,"reports_90d":305,"resolved_total":940,"response_efficiency":64,"response_indicator":"missed","paid_total":1350000,"paid_90d":130000,"last_resolved_at":"2026-10-09T17:31:10.137Z","days_since_resolved":11.004465530381944,"avg_bounty_low":500,"avg_bounty_high":750,"min_bounty":100,"scope_count":10},"scope":[{"asset":"*.ra.roblox.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":null},{"asset":"*.rbx.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.roblox.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"App api's that are used within Roblox."},{"asset":"Roblox Client","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Applies to Windows/Osx/Mobile Platform"},{"asset":"Roblox Engine","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"Roblox Studio","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Applies to Windows/Osx/Mobile Platform"},{"asset":"blox.link","type":"URL","bounty":true,"severity":"low","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.379,"label":"watch","experimental":true}},"derived":{"novelty":0.1718,"inverse_crowd":0.0583,"payout_reliability":0.797,"value_per_competition":0.0599,"triage_quality":0.48,"scope_breadth":0.3857,"crowding_per_asset_month":10.1667,"slop_risk":0.379},"score":{"total":21.5,"parts":{"novelty":0.172,"inverse_crowd":0.058,"payout_reliability":0.797,"value_per_competition":0.06,"triage_quality":0.48,"scope_breadth":0.386},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":18.6},"reasons":[{"sign":"good","text":"paid $130k in the last 90 days"},{"sign":"neutral","text":"305 reports in 90 days across 10 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.7 years"}]},{"id":"hackerone:box_private","platform":"hackerone","slug":"box_private","name":"Box BB","url":"https://hackerone.com/box_private","meta":{"reward_min":150,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-08-04T14:25:00.632Z","age_months":2.5341681218438667,"reports_90d":1498,"resolved_total":230,"response_efficiency":95,"response_indicator":"ok","paid_total":297000,"paid_90d":104300,"last_resolved_at":"2026-10-19T17:54:22.427Z","days_since_resolved":0.9883510627893518,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":150,"scope_count":38},"scope":[{"asset":"Android Box Mobile App","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.box.android"},{"asset":"Box Drive","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://www.box.com/resources/downloads/drive"},{"asset":"Box Tools","type":"OTHER","bounty":true,"severity":"critical","instruction":"Box Tools is an installer package that lets you open and edit Box-stored files directly in default desktop applications. Download from https://www.box.com/resources/downloads"},{"asset":"account.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Authentication and identity plane. Includes login, OAuth flows, SSO, token issuance, and session management. High-value target for account takeover and auth bypass vulnerabilities."},{"asset":"api.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Core Box API surface. Includes endpoints for files, folders, users, collaborations, shared links, search, metadata, governance, Shield, events, and AI-related functionality. Primary surface for author"},{"asset":"app.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Primary Box web application. Includes all end-user and admin functionality such as file storage, sharing, collaboration, Box AI, Box Shield, Box Governance, Hubs, Forms, Relay, Apps, Notes, Canvas, an"},{"asset":"cloud.app.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Box-hosted web surface use for certain content experiences such as Box Notes and other cloud-rendered or embedded application views. Represents a distinct frontend origin from app.box.com and may have"},{"asset":"dl.boxcloud.com","type":"URL","bounty":true,"severity":"critical","instruction":"File download and content delivery network. Includes signed URLs and file access mechanisms. Relevant for data exposure, token leakage, and access control issues."},{"asset":"iOS Box Mobile App","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/box-the-power-of-content-ai/id290853822"},{"asset":"m.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Mobile web version of Box application. Separate rendering and session handling logic may expose unique vulnerabilities."},{"asset":"notes.services.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"Box Notes service backend. Includes real-time collaboration and content sync functionality."},{"asset":"upload.box.com","type":"URL","bounty":true,"severity":"critical","instruction":"File upload pipeline. Includes file ingestion, processing, and storage entry points. Relevant for malware bypass, file parsing, and content validation vulnerabilities."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"95% response, paid recently, resolved 1d ago"},"slop":{"risk":0.734,"label":"elevated","experimental":true}},"derived":{"novelty":0.6035,"inverse_crowd":0.0435,"payout_reliability":0.9728,"value_per_competition":0.0444,"triage_quality":0.95,"scope_breadth":0.5893,"crowding_per_asset_month":13.1404,"slop_risk":0.734},"score":{"total":20.9,"parts":{"novelty":0.604,"inverse_crowd":0.043,"payout_reliability":0.973,"value_per_competition":0.044,"triage_quality":0.95,"scope_breadth":0.589},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":18.1},"reasons":[{"sign":"good","text":"paid $104k in the last 90 days"},{"sign":"good","text":"95% response efficiency"},{"sign":"bad","text":"1,498 reports in 90 days across 38 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 3 months ago"}]},{"id":"hackerone:elastic","platform":"hackerone","slug":"elastic","name":"Elastic","url":"https://hackerone.com/elastic","meta":{"reward_min":100,"reward_max":700,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-08-10T20:01:44.157Z","age_months":62.32114677991672,"reports_90d":2984,"resolved_total":986,"response_efficiency":82,"response_indicator":"ok","paid_total":1106791,"paid_90d":131722,"last_resolved_at":"2026-10-12T16:08:50.180Z","days_since_resolved":8.061640958622686,"avg_bounty_low":300,"avg_bounty_high":700,"min_bounty":100,"scope_count":101},"scope":[{"asset":"*.ela.st","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elastic.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All subdomains are in scope UNLESS OTHERWISE LISTED IN OUT-OF-SCOPE."},{"asset":"*.elastic.dev","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Not all applications and services hosted here are of the same importance so expect some nuance while we triage reports about assets falling in this category."},{"asset":"*.elastic.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticacademy.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticaccelerationzone.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticapm.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticbeats.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticcloud.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticgov.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticloud.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticnet.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticon.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticon.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticpartneracademy.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticps.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticsearch.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticsearch.fr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticsearch.jp","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticsearch.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elasticsearch.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.elstc.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Not all applications and services hosted here are of the same importance so expect some nuance while we triage reports about assets falling in this category."},{"asset":"*.eops.nl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.estccdn.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.found.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"These are internal assets, bugs found in services that are hosted in subdomains and subdomain takeovers are welcome."},{"asset":"*.insight.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.kibana.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.logstash.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.logstash.wtf","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.prelert.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.theelasticast.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"Elastic Credentials","type":"OTHER","bounty":true,"severity":"high","instruction":"We adopt the Bounty Awards for Discovered Leaked Credentials policy\nSee https://docs.hackerone.com/en/articles/8369826-detailed-platform-standards#h_83c05e1cc8\n\n- Low: active credentials for non-produ"},{"asset":"Software Supply Chain","type":"OTHER","bounty":true,"severity":"critical","instruction":"Includes threats highlighted by SLSA https://slsa.dev/spec/v0.1/threats\n\n- Source\n- Build\n- Dependencies\n- Package\n\nSpecifically \n\n- Github Workflows in our repositories https://github.com/elastic - l"},{"asset":"Subdomain takeover","type":"OTHER","bounty":true,"severity":"low","instruction":"- Multiple subdomain takeovers resulting from the same underlying record or IP address will be eligible for only one bounty.\n- Subdomain takeovers involving typosquatted domains or parked/reserved dom"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"82% response, paid recently, resolved 8d ago"},"slop":{"risk":0.476,"label":"watch","experimental":true}},"derived":{"novelty":0.1903,"inverse_crowd":0.0604,"payout_reliability":0.8929,"value_per_competition":0.061,"triage_quality":0.82,"scope_breadth":0.744,"crowding_per_asset_month":9.8482,"slop_risk":0.476},"score":{"total":20.4,"parts":{"novelty":0.19,"inverse_crowd":0.06,"payout_reliability":0.893,"value_per_competition":0.061,"triage_quality":0.82,"scope_breadth":0.744},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":17.6},"reasons":[{"sign":"good","text":"paid $132k in the last 90 days"},{"sign":"good","text":"82% response efficiency"},{"sign":"bad","text":"2,984 reports in 90 days across 101 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 5.2 years"}]},{"id":"hackerone:tiktok","platform":"hackerone","slug":"tiktok","name":"TikTok","url":"https://hackerone.com/tiktok","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-10-12T16:05:27.309Z","age_months":72.24850887893567,"reports_90d":1138,"resolved_total":1675,"response_efficiency":76,"response_indicator":"ok","paid_total":4354976,"paid_90d":406375,"last_resolved_at":"2026-10-14T08:54:48.116Z","days_since_resolved":6.363053736400464,"avg_bounty_low":999,"avg_bounty_high":1000,"min_bounty":50,"scope_count":68},"scope":[{"asset":"*.pipopay.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.soundon.global","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tiktokcdn.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tiktokpublishers.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tiktokv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"1235601864","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[iOS Store Download](https://apps.apple.com/sg/app/tiktok-%E6%9C%89%E8%B6%A3%E7%9A%84%E4%BA%BA%E9%83%BD%E5%9C%A8%E9%80%99%E8%A3%A1/id1235601864)"},{"asset":"1591003012","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"TikTok Shop Seller Center\n[iOS Store Download][link].\n\n[link]: https://apps.apple.com/my/app/tiktok-shop-seller-center/id1591003012"},{"asset":"641062073","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[iOS Store Download][link].\n\n[link]: https://apps.apple.com/be/app/tiktok-now/id1641062073"},{"asset":"835599320","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[iOS Store Download](https://apps.apple.com/us/app/tiktok-make-your-day/id835599320)"},{"asset":"Other Asset (Campaigns)","type":"OTHER","bounty":true,"severity":"critical","instruction":"Please note that this is a generic term for reports that we are accepting during campaigns. Note that this does not guaranteed a bounty / Please do not take this as notice of a valid report. Please do"},{"asset":"academy-outbound-ads.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ads.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"affiliate-id.tokopedia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"business.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"careers.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.ss.android.ugc.now","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Play Store Download][link].\n\n[link]: https://play.google.com/store/apps/details?id=com.ss.android.ugc.now"},{"asset":"com.ss.android.ugc.trill","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Play Store Download](https://play.google.com/store/apps/details?id=com.ss.android.ugc.trill&hl=en_US)"},{"asset":"com.tiktok.tv","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"TikTok TV app"},{"asset":"com.tiktokshop.seller","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"TikTok Shop Seller Center\n[Play Store Download][link].\n\n[link]: https://play.google.com/store/apps/details?id=com.tiktokshop.seller&hl=en_US&gl=US"},{"asset":"com.zhiliao.musically.livewallpaper","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.zhiliaoapp.musically","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Play Store Download](https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en_US)"},{"asset":"creatormarketplace.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developers.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"effecthouse.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"fp-sg.tiktokv.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"live-backstage.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"partner.tiktokshop.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pay.tokopediax.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"seller-id.tokopedia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"shop-id.tokopedia.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"shop.tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":"TikTok Shop"},{"asset":"tiktok.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.pangleglobal.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.soundon.global","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"76% response, pays"},"slop":{"risk":0.228,"label":"none","experimental":true}},"derived":{"novelty":0.1795,"inverse_crowd":0.1128,"payout_reliability":0.8663,"value_per_competition":0.106,"triage_quality":0.76,"scope_breadth":0.6811,"crowding_per_asset_month":5.5784,"slop_risk":0.228},"score":{"total":20.3,"parts":{"novelty":0.18,"inverse_crowd":0.113,"payout_reliability":0.866,"value_per_competition":0.106,"triage_quality":0.76,"scope_breadth":0.681},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20}],"percentile":17.2},"reasons":[{"sign":"good","text":"paid $406k in the last 90 days"},{"sign":"bad","text":"1,138 reports in 90 days across 68 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:acronis","platform":"hackerone","slug":"acronis","name":"Acronis","url":"https://hackerone.com/acronis","meta":{"reward_min":100,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-08-11T09:56:51.455Z","age_months":74.29387957404556,"reports_90d":482,"resolved_total":1499,"response_efficiency":41,"response_indicator":"missed","paid_total":591674,"paid_90d":49650,"last_resolved_at":"2026-10-08T09:33:03.293Z","days_since_resolved":12.336489187789352,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":100,"scope_count":29},"scope":[{"asset":"*-api-*.acronis.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.5nine.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.acronis.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.acronis.work","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.devicelock.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1118448159","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Acronis Cyber Protect for [iOS](https://apps.apple.com/app/acronis-cyber-backup/id1118448159)."},{"asset":"1192506963","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Acronis Files Cloud for [iOS](https://apps.apple.com/us/app/files-cloud/id1192506963)."},{"asset":"978342143","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Acronis Mobile for [iOS](https://apps.apple.com/app/acronis-true-image-mobile/id978342143)."},{"asset":"Acronis Agent","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis Agent is a client-side application for Acronis Cyber Protect that incorporates backup and cyber protection mechanisms. You may download versions for all supported platforms from [here](https:/"},{"asset":"Acronis Cloud Manager","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis Cloud Manager provides advanced monitoring, management, migration, and recovery for Microsoft Cloud environments. You may request a trial by completing [registration](https://www.acronis.com/e"},{"asset":"Acronis Cyber Infrastructure","type":"OTHER","bounty":true,"severity":"critical","instruction":"Acronis Cyber Infrastructure unites software-defined compute, network and storage in a single, scalable product, designed for building private or public clouds. You can read more about it at [kb.acron"},{"asset":"Acronis Cyber Protect","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis Cyber Protect is an on-premises cyber protection solution designed for business environments. You may request a trial by completing [registration](https://www.acronis.com/en-us/business/cyber-"},{"asset":"Acronis DeviceLock DLP","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis DeviceLock DLP provides comprehensive endpoint data loss prevention. You may request a trial by completing [registration](https://www.acronis.com/en-us/products/devicelock/trial/)."},{"asset":"Acronis Snap Deploy","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis Snap Deploy is designed to deploy and provision all of your servers and workstations at once. You may request a trial by completing [registration](https://www.acronis.com/en-us/products/snap-d"},{"asset":"Acronis True Image (formerly Acronis Cyber Protect Home Office)","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Acronis True Image is designed for protection of home computers. [Download a trial](https://www.acronis.com/en-us/products/true-image/trial/)."},{"asset":"Other Acronis Domains","type":"OTHER","bounty":true,"severity":"medium","instruction":null},{"asset":"Other Acronis executables","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"account.acronis.com","type":"URL","bounty":true,"severity":"critical","instruction":"Acronis Customer Portal."},{"asset":"beta-cloud.acronis.com","type":"URL","bounty":true,"severity":"critical","instruction":"Acronis Cyber Cloud beta environment. To request an account, please follow HackerOne [Credentials](https://docs.hackerone.com/en/articles/8466488-credentials) guide and select `beta-cloud.acronis.com`"},{"asset":"com.acronis.abc","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Acronis Cyber Protect for [Android](https://play.google.com/store/apps/details?id=com.acronis.cyberb2b)."},{"asset":"com.acronis.acronistrueimage","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Acronis Mobile for [Android](https://play.google.com/store/apps/details?id=com.acronis.cyberb2c)."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 41%"},"slop":{"risk":0.212,"label":"none","experimental":true}},"derived":{"novelty":0.1775,"inverse_crowd":0.1136,"payout_reliability":0.6794,"value_per_competition":0.0853,"triage_quality":0.3075,"scope_breadth":0.5471,"crowding_per_asset_month":5.5402,"slop_risk":0.212},"score":{"total":19.9,"parts":{"novelty":0.178,"inverse_crowd":0.114,"payout_reliability":0.679,"value_per_competition":0.085,"triage_quality":0.307,"scope_breadth":0.547},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":16.7},"reasons":[{"sign":"good","text":"paid $50k in the last 90 days"},{"sign":"bad","text":"response efficiency only 41%"},{"sign":"neutral","text":"482 reports in 90 days across 29 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.2 years"}]},{"id":"hackerone:bumba_bbp","platform":"hackerone","slug":"bumba_bbp","name":"Bumba","url":"https://hackerone.com/bumba_bbp","meta":{"reward_min":50,"reward_max":75,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-01-20T15:51:23.855Z","age_months":20.96340866371017,"reports_90d":307,"resolved_total":6,"response_efficiency":94,"response_indicator":"ok","paid_total":345,"paid_90d":0,"last_resolved_at":"2026-07-13T10:59:14.982Z","days_since_resolved":99.27663167621529,"avg_bounty_low":60,"avg_bounty_high":75,"min_bounty":50,"scope_count":1},"scope":[{"asset":"http://bumba.global","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"94% response, no recent payout seen, last resolved 99d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.2906,"inverse_crowd":0.0039,"payout_reliability":0.5364,"value_per_competition":0.0042,"triage_quality":0.94,"scope_breadth":0.1115,"crowding_per_asset_month":102.3333,"slop_risk":1.0},"score":{"total":19.5,"parts":{"novelty":0.291,"inverse_crowd":0.004,"payout_reliability":0.536,"value_per_competition":0.004,"triage_quality":0.94,"scope_breadth":0.111},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":16.3},"reasons":[{"sign":"good","text":"94% response efficiency"},{"sign":"neutral","text":"307 reports in 90 days across 1 assets"},{"sign":"neutral","text":"running 1.7 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:bcny","platform":"hackerone","slug":"bcny","name":"The Browser Company of NYC","url":"https://hackerone.com/bcny","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-12-03T20:35:15.956Z","age_months":22.533934140552514,"reports_90d":241,"resolved_total":null,"response_efficiency":74,"response_indicator":"missed","paid_total":254100,"paid_90d":39700,"last_resolved_at":"2026-10-02T16:02:04.564Z","days_since_resolved":18.066335588252315,"avg_bounty_low":100,"avg_bounty_high":500,"min_bounty":50,"scope_count":13},"scope":[{"asset":"Arc on Mac","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"Arc on Windows","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":null},{"asset":"Dia Assistant","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Dia on MacOS","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Browser capabilities of Dia on MacOS, excludes all assistant features"},{"asset":"Dia on Windows","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"Browser capabilities of Dia on Windows, excludes all assistant features"},{"asset":"arc.net","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bcny.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"company.thebrowser.arc","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"diabrowser.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"id6472513080","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"thebrowser.company","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.622,"label":"elevated","experimental":true}},"derived":{"novelty":0.2827,"inverse_crowd":0.1011,"payout_reliability":0.8336,"value_per_competition":0.0874,"triage_quality":0.555,"scope_breadth":0.4245,"crowding_per_asset_month":6.1795,"slop_risk":0.622},"score":{"total":17.3,"parts":{"novelty":0.283,"inverse_crowd":0.101,"payout_reliability":0.834,"value_per_competition":0.087,"triage_quality":0.555,"scope_breadth":0.425},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"slop risk","points":-10}],"percentile":15.8},"reasons":[{"sign":"good","text":"paid $40k in the last 90 days"},{"sign":"neutral","text":"241 reports in 90 days across 13 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.9 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:ruby","platform":"hackerone","slug":"ruby","name":"Ruby","url":"https://hackerone.com/ruby","meta":{"reward_min":500,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-06-17T22:53:39.133Z","age_months":124.08313819523347,"reports_90d":100,"resolved_total":78,"response_efficiency":86,"response_indicator":"ok","paid_total":10000,"paid_90d":null,"last_resolved_at":"2026-08-28T02:09:47.844Z","days_since_resolved":53.64430688454861,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":500,"scope_count":2},"scope":[{"asset":"https://github.com/ruby/ruby","type":"SOURCE_CODE","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"86% response, no recent payout seen, last resolved 54d ago"},"slop":{"risk":0.651,"label":"elevated","experimental":true}},"derived":{"novelty":0.1449,"inverse_crowd":0.0331,"payout_reliability":0.5402,"value_per_competition":0.0355,"triage_quality":0.86,"scope_breadth":0.1767,"crowding_per_asset_month":16.6667,"slop_risk":0.651},"score":{"total":17.1,"parts":{"novelty":0.145,"inverse_crowd":0.033,"payout_reliability":0.54,"value_per_competition":0.036,"triage_quality":0.86,"scope_breadth":0.177},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":15.4},"reasons":[{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"100 reports in 90 days across 2 assets"},{"sign":"neutral","text":"running 10.3 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:wolt","platform":"hackerone","slug":"wolt","name":"Wolt","url":"https://hackerone.com/wolt","meta":{"reward_min":50,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-07-27T13:25:27.378Z","age_months":2.798360552446954,"reports_90d":1556,"resolved_total":1,"response_efficiency":86,"response_indicator":"ok","paid_total":10000,"paid_90d":10000,"last_resolved_at":"2026-10-13T16:29:02.618Z","days_since_resolved":7.0476081114004625,"avg_bounty_low":0,"avg_bounty_high":300,"min_bounty":50,"scope_count":25},"scope":[{"asset":"*.wolt.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Anything else under the `.wolt.com` domain is fair game with some exceptions (see the out of scope items). Depending on the affected service and finding type, we might bump this to Tier-1 bounties."},{"asset":"1477299281","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Wolt Courier Partner iOS app: https://apps.apple.com/app/1477299281 \n* Notable use-cases: Receiving delivery requests, tracking orders, completing deliveries, modifying your profile info.\n* For the ti"},{"asset":"943905271","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Wolt Customer iOS app: https://apps.apple.com/app/943905271\n\nNotable use-cases: Regular wolt.com account creation, placing orders, tracking your orders, modifying your profile info."},{"asset":"authentication.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Keywords: OAuth2, OIDC, JWT\n* Used by: Regular wolt.com users, Wolt employees, other services (service-to-service communication).\n* Handles the vast majority of our authN/authZ. In other words, JWTs s"},{"asset":"com.wolt.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Wolt  Customer Android app: https://play.google.com/store/apps/details?id=com.wolt.android\n\nNotable use-cases: Regular wolt.com account creation, placing orders, tracking your orders, modifying your p"},{"asset":"com.wolt.courierapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Wolt Courier Partner Android app: https://play.google.com/store/apps/details?id=com.wolt.courierapp\n\n* Notable use-cases: Receiving delivery requests, tracking orders, completing deliveries, modifying"},{"asset":"corporate.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Keywords: admin\n* Used by: Wolt employees, corporate customers.\n* Admin portal for Wolt's corporate customers.\n* Your JWT as a regular wolt.com user should grant you limited access."},{"asset":"drive.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Keywords: admin\n* Used by: Wolt employees, delivery partners.\n* Admin portal for Wolt's last-mile delivery partners.\n* Your JWT as a regular wolt.com user should grant you limited access."},{"asset":"merchant.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Keywords: admin\n* Used by: Wolt employees, store managers.\n* Portal for store managers to update menus.\n* Your JWT as a regular wolt.com user should grant you limited access."},{"asset":"ops.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Keywords: admin\n* Used by: Wolt employees.\n* This service's endpoints are only accessible by Wolt employees (if you can show otherwise, that’ll be very interesting). However, your tainted data (e.g., "},{"asset":"restaurant-api.wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"* Used by: Regular wolt.com users, Wolt employees, corporate customers, delivery partners, store managers.\n* Notable use-cases: Creating and editing users, placing orders, tracking orders, setting pri"},{"asset":"wolt.com","type":"URL","bounty":true,"severity":"critical","instruction":"Used by: Everybody.\n* Our main web page.\n* Notable use-cases: Offering an in-browser JavaScript app to interact with other APIs and services. Offering HTTP endpoints to interact with this service's ow"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 7d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.5864,"inverse_crowd":0.0256,"payout_reliability":0.9149,"value_per_competition":0.0265,"triage_quality":0.86,"scope_breadth":0.5241,"crowding_per_asset_month":20.7467,"slop_risk":1.0},"score":{"total":17.1,"parts":{"novelty":0.586,"inverse_crowd":0.026,"payout_reliability":0.915,"value_per_competition":0.026,"triage_quality":0.86,"scope_breadth":0.524},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":14.9},"reasons":[{"sign":"good","text":"paid $10k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"bad","text":"1,556 reports in 90 days across 25 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 3 months ago"}]},{"id":"hackerone:insightly","platform":"hackerone","slug":"insightly","name":"Insightly","url":"https://hackerone.com/insightly","meta":{"reward_min":100,"reward_max":100,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-07-11T16:33:26.323Z","age_months":27.30331190045821,"reports_90d":303,"resolved_total":158,"response_efficiency":76,"response_indicator":"ok","paid_total":56025,"paid_90d":0,"last_resolved_at":"2026-03-17T21:15:44.906Z","days_since_resolved":216.84850755584492,"avg_bounty_low":100,"avg_bounty_high":100,"min_bounty":100,"scope_count":27},"scope":[{"asset":"accounts.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"crm.na1.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"http://api.insightly.com/v3.1/","type":"URL","bounty":true,"severity":"critical","instruction":"api.insightly.com/v3.1/ operates as a proxy, interacting with api.na1.insightly.com/v3.1/\n\nSubmissions on api.insightly.com/v3.0 and older will not be accepted."},{"asset":"http://api.na1.insightly.com/v3.1/","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"login.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"marketing.na1.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":"Insightly Marketing is a premium feature that requires an account upgrade.  Once your trial account is created, send an email to hacking@insightly.com with the details of your accounts so we can enabl"},{"asset":"mobileapi.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"mobileapi.na1.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"outlook.insightly.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 217 days"},"slop":{"risk":0.211,"label":"none","experimental":true}},"derived":{"novelty":0.2626,"inverse_crowd":0.1704,"payout_reliability":0.398,"value_per_competition":0.0983,"triage_quality":0.76,"scope_breadth":0.536,"crowding_per_asset_month":3.7407,"slop_risk":0.211},"score":{"total":17.0,"parts":{"novelty":0.263,"inverse_crowd":0.17,"payout_reliability":0.398,"value_per_competition":0.098,"triage_quality":0.76,"scope_breadth":0.536},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15}],"percentile":14.5},"reasons":[{"sign":"neutral","text":"303 reports in 90 days across 27 assets"},{"sign":"bad","text":"nothing resolved for 217 days"},{"sign":"neutral","text":"running 2.3 years"}]},{"id":"hackerone:quora","platform":"hackerone","slug":"quora","name":"Quora","url":"https://hackerone.com/quora","meta":{"reward_min":100,"reward_max":200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-12-08T20:02:11.685Z","age_months":118.37041762636892,"reports_90d":57,"resolved_total":387,"response_efficiency":34,"response_indicator":"missed","paid_total":230000,"paid_90d":5000,"last_resolved_at":"2026-09-16T20:42:16.167Z","days_since_resolved":33.87175684982639,"avg_bounty_low":200,"avg_bounty_high":200,"min_bounty":100,"scope_count":4},"scope":[{"asset":"*.quora.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Except for subdomains managed by third parties, such as help.quora.com, careers.quora.com, and business.quora.com."},{"asset":"com.quora.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"The latest version of Android app installed from the official store at:\nhttps://play.google.com/store/apps/details?id=com.quora.android"},{"asset":"com.quora.app.mobile","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"The latest version of iOS app installed from the official store at:\nhttps://itunes.apple.com/us/developer/quora-inc/id456034440"},{"asset":"http://poe.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 34%"},"slop":{"risk":0.177,"label":"none","experimental":true}},"derived":{"novelty":0.1477,"inverse_crowd":0.1336,"payout_reliability":0.6073,"value_per_competition":0.0931,"triage_quality":0.255,"scope_breadth":0.2589,"crowding_per_asset_month":4.75,"slop_risk":0.177},"score":{"total":15.7,"parts":{"novelty":0.148,"inverse_crowd":0.134,"payout_reliability":0.607,"value_per_competition":0.093,"triage_quality":0.255,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":14.0},"reasons":[{"sign":"good","text":"paid $5k in the last 90 days"},{"sign":"bad","text":"response efficiency only 34%"},{"sign":"neutral","text":"57 reports in 90 days across 4 assets"},{"sign":"neutral","text":"running 9.9 years"}]},{"id":"hackerone:wickr","platform":"hackerone","slug":"wickr","name":"Wickr","url":"https://hackerone.com/wickr","meta":{"reward_min":null,"reward_max":null,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2021-11-30T18:45:52.936Z","age_months":58.64320595589969,"reports_90d":147,"resolved_total":22,"response_efficiency":61,"response_indicator":"missed","paid_total":null,"paid_90d":null,"last_resolved_at":"2026-08-21T01:58:00.499Z","days_since_resolved":60.65249374797453,"avg_bounty_low":null,"avg_bounty_high":null,"min_bounty":null,"scope_count":14},"scope":[{"asset":"Wickr Me Android","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Me Linux","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Me OS X","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Me Windows","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Me iOS","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro Android","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro Linux","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro OS X","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro Windows","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro iOS","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Wickr Pro/Wickr Me (all related technical components) (up to)","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"admin.wickr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.wickr.com","type":"URL","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"medium","signals_present":7,"signals_expected":10,"missing":["paid_total","paid_90d","avg_bounty_high"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.393,"label":"watch","experimental":true}},"derived":{"novelty":0.1949,"inverse_crowd":0.1819,"payout_reliability":0.4069,"value_per_competition":0.0,"triage_quality":0.4575,"scope_breadth":0.4356,"crowding_per_asset_month":3.5,"slop_risk":0.393},"score":{"total":15.3,"parts":{"novelty":0.195,"inverse_crowd":0.182,"payout_reliability":0.407,"value_per_competition":0.0,"triage_quality":0.458,"scope_breadth":0.436},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10}],"percentile":13.6},"reasons":[{"sign":"neutral","text":"147 reports in 90 days across 14 assets"},{"sign":"neutral","text":"running 4.9 years"}]},{"id":"hackerone:abercrombie_fitch_bbp","platform":"hackerone","slug":"abercrombie_fitch_bbp","name":"Abercrombie & Fitch Bug Bounty","url":"https://hackerone.com/abercrombie_fitch_bbp","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-07-21T14:58:24.627Z","age_months":2.9933650208475933,"reports_90d":1667,"resolved_total":65,"response_efficiency":86,"response_indicator":"ok","paid_total":115450,"paid_90d":22250,"last_resolved_at":"2026-10-06T15:51:59.526Z","days_since_resolved":14.073338342881945,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":10},"scope":[{"asset":"339041767","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"},{"asset":"383915209","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"},{"asset":"abercrombie.com","type":"URL","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"},{"asset":"anfcorp.com","type":"URL","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. You may not use exposed credentials to continue testing without explicit approval of the company."},{"asset":"com.abercrombie.abercrombie","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"},{"asset":"com.abercrombie.hollister","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"},{"asset":"corporate.abercrombie.com","type":"URL","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. You may not use exposed credentials to continue testing without explicit approval of the company."},{"asset":"hollisterco.com","type":"URL","bounty":true,"severity":"critical","instruction":"No credentials are required or provided for this asset. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to conti"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"86% response, paid recently, resolved 14d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.5747,"inverse_crowd":0.008,"payout_reliability":0.901,"value_per_competition":0.0118,"triage_quality":0.86,"scope_breadth":0.3857,"crowding_per_asset_month":55.5667,"slop_risk":1.0},"score":{"total":15.0,"parts":{"novelty":0.575,"inverse_crowd":0.008,"payout_reliability":0.901,"value_per_competition":0.012,"triage_quality":0.86,"scope_breadth":0.386},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":13.1},"reasons":[{"sign":"good","text":"paid $22k in the last 90 days"},{"sign":"good","text":"86% response efficiency"},{"sign":"bad","text":"1,667 reports in 90 days across 10 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 3 months ago"}]},{"id":"hackerone:nodejs","platform":"hackerone","slug":"nodejs","name":"Node.js","url":"https://hackerone.com/nodejs","meta":{"reward_min":500,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-04-08T23:15:06.827Z","age_months":102.39887030642063,"reports_90d":179,"resolved_total":171,"response_efficiency":77,"response_indicator":"ok","paid_total":6150,"paid_90d":0,"last_resolved_at":"2026-09-25T20:04:21.336Z","days_since_resolved":24.898085912326387,"avg_bounty_low":250,"avg_bounty_high":250,"min_bounty":500,"scope_count":1},"scope":[{"asset":"https://github.com/nodejs/node","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"77% response, no recent payout seen"},"slop":{"risk":0.642,"label":"elevated","experimental":true}},"derived":{"novelty":0.1564,"inverse_crowd":0.0073,"payout_reliability":0.5367,"value_per_competition":0.0092,"triage_quality":0.77,"scope_breadth":0.1115,"crowding_per_asset_month":59.6667,"slop_risk":0.642},"score":{"total":14.8,"parts":{"novelty":0.156,"inverse_crowd":0.007,"payout_reliability":0.537,"value_per_competition":0.009,"triage_quality":0.77,"scope_breadth":0.111},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"slop risk","points":-10}],"percentile":12.7},"reasons":[{"sign":"neutral","text":"179 reports in 90 days across 1 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.5 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:newegg","platform":"hackerone","slug":"newegg","name":"Newegg","url":"https://hackerone.com/newegg","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-04-18T15:38:55.710Z","age_months":42.08894982463495,"reports_90d":95,"resolved_total":116,"response_efficiency":68,"response_indicator":"missed","paid_total":130650,"paid_90d":16450,"last_resolved_at":"2025-08-29T08:56:44.947Z","days_since_resolved":417.3617015257523,"avg_bounty_low":350,"avg_bounty_high":500,"min_bounty":50,"scope_count":18},"scope":[{"asset":"com.newegg.app","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.newegg.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"http://*.newegg.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"http://*.newegg.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"https://secure.newegg.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"pmtcards.newegg.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"secure.newegg.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"sellerportal.newegg.com","type":"URL","bounty":false,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 417 days"},"slop":{"risk":0.096,"label":"none","experimental":true}},"derived":{"novelty":0.2219,"inverse_crowd":0.3367,"payout_reliability":0.6419,"value_per_competition":0.2275,"triage_quality":0.51,"scope_breadth":0.4736,"crowding_per_asset_month":1.7593,"slop_risk":0.096},"score":{"total":14.0,"parts":{"novelty":0.222,"inverse_crowd":0.337,"payout_reliability":0.642,"value_per_competition":0.227,"triage_quality":0.51,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"dormant","points":-15}],"percentile":12.2},"reasons":[{"sign":"good","text":"paid $16k in the last 90 days"},{"sign":"neutral","text":"95 reports in 90 days across 18 assets"},{"sign":"bad","text":"nothing resolved for 417 days"},{"sign":"neutral","text":"running 3.5 years"}]},{"id":"hackerone:linkedin","platform":"hackerone","slug":"linkedin","name":"LinkedIn","url":"https://hackerone.com/linkedin","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-05-18T15:29:01.782Z","age_months":53.09533583421742,"reports_90d":156,"resolved_total":null,"response_efficiency":66,"response_indicator":"missed","paid_total":870000,"paid_90d":40000,"last_resolved_at":"2026-10-13T22:09:43.684Z","days_since_resolved":6.811021699363425,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":6},"scope":[{"asset":"288429040","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"api.linkedin.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"business.linkedin.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"com.linkedin.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"www.linkedin.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.712,"label":"elevated","experimental":true}},"derived":{"novelty":0.2026,"inverse_crowd":0.0697,"payout_reliability":0.8154,"value_per_competition":0.0649,"triage_quality":0.495,"scope_breadth":0.313,"crowding_per_asset_month":8.6667,"slop_risk":0.712},"score":{"total":12.6,"parts":{"novelty":0.203,"inverse_crowd":0.07,"payout_reliability":0.815,"value_per_competition":0.065,"triage_quality":0.495,"scope_breadth":0.313},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"slop risk","points":-10}],"percentile":11.8},"reasons":[{"sign":"good","text":"paid $40k in the last 90 days"},{"sign":"neutral","text":"156 reports in 90 days across 6 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 4.4 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:crypto","platform":"hackerone","slug":"crypto","name":"Crypto.com","url":"https://hackerone.com/crypto","meta":{"reward_min":100,"reward_max":566,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-05-02T08:13:50.184Z","age_months":101.63093230467146,"reports_90d":1632,"resolved_total":418,"response_efficiency":100,"response_indicator":"ok","paid_total":1629266,"paid_90d":14619,"last_resolved_at":"2026-10-14T01:58:59.960Z","days_since_resolved":6.651805541956019,"avg_bounty_low":453,"avg_bounty_high":566,"min_bounty":100,"scope_count":42},"scope":[{"asset":"*.crypto.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact."},{"asset":"*.mona.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact."},{"asset":"Crypto.com Exchange APIs that require an account","type":"API","bounty":true,"severity":"critical","instruction":"Includes any BFF APIs"},{"asset":"Crypto.com mobile app APIs that require an account","type":"API","bounty":true,"severity":"critical","instruction":"Includes any BFF APIs"},{"asset":"app.mona.co","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"co.mona.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"Get the app here: https://play.google.com/store/apps/details?id=co.mona.android\n\nYou won’t need test accounts for this as it will be public-facing sites for now.\n\nThe app should give you the functiona"},{"asset":"com.monaco.mobile","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":null},{"asset":"developer-api.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer-platform-api.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"developer.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"experiences.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://crypto.com/exchange","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://crypto.com/nft","type":"URL","bounty":true,"severity":"critical","instruction":"Reward for GraphQL-based DOS that can cause service disruption will be capped at $500 USD"},{"asset":"https://crypto.com/price","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":"**Bounty Range Changes: CDCETH Smart Contract**\n\nCritical Severity: Up to $50,000 USD\nExtreme Tier: Up to $1,000,000"},{"asset":"https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"js.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"merchant.crypto.com","type":"URL","bounty":true,"severity":"medium","instruction":"Reward for GraphQL-based DOS that can cause service disruption will be capped at $200 USD"},{"asset":"nadex.com","type":"URL","bounty":true,"severity":"medium","instruction":"For this asset, we only accept Critical and High severity issues."},{"asset":"og.com","type":"URL","bounty":true,"severity":"critical","instruction":"OG is available now in the U.S. via App Store, Google Play, and OG.com."},{"asset":"tax.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":"For this asset, we only accept Critical and High severity issues."},{"asset":"tickets.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"travel.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"web.crypto.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 7d ago"},"slop":{"risk":0.622,"label":"elevated","experimental":true}},"derived":{"novelty":0.1569,"inverse_crowd":0.0442,"payout_reliability":0.9858,"value_per_competition":0.0459,"triage_quality":1.0,"scope_breadth":0.605,"crowding_per_asset_month":12.9524,"slop_risk":0.622},"score":{"total":12.1,"parts":{"novelty":0.157,"inverse_crowd":0.044,"payout_reliability":0.986,"value_per_competition":0.046,"triage_quality":1.0,"scope_breadth":0.605},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":11.3},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"bad","text":"1,632 reports in 90 days across 42 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.5 years"}]},{"id":"hackerone:arc-bbp","platform":"hackerone","slug":"arc-bbp","name":"Arc","url":"https://hackerone.com/arc-bbp","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-09-16T00:59:08.584Z","age_months":1.1398233229998478,"reports_90d":3736,"resolved_total":3,"response_efficiency":87,"response_indicator":"ok","paid_total":11200,"paid_90d":11200,"last_resolved_at":"2026-10-13T16:20:08.288Z","days_since_resolved":7.0537924864004635,"avg_bounty_low":50,"avg_bounty_high":500,"min_bounty":100,"scope_count":44},"scope":[{"asset":"*.arc.io","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Eligible for Tier B bounty payouts. \n\nOnly for Circle-owned assets."},{"asset":"https://github.com/circlefin/arc-node","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/arc-remote-signer","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/circlefin/malachite","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The repository containing the source-code for Malachite.    Malachite is a Byzantine-fault tolerant (BFT) consensus engine implemented in Rust.\n \n==Partial scope only:==\nin scope is code/crates minus "},{"asset":"rpc.drpc.testnet.arc.network","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"rpc.testnet.arc.network","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"87% response, paid recently, resolved 7d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.7376,"inverse_crowd":0.0178,"payout_reliability":0.9199,"value_per_competition":0.0214,"triage_quality":0.87,"scope_breadth":0.6123,"crowding_per_asset_month":28.303,"slop_risk":1.0},"score":{"total":11.1,"parts":{"novelty":0.738,"inverse_crowd":0.018,"payout_reliability":0.92,"value_per_competition":0.021,"triage_quality":0.87,"scope_breadth":0.612},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"premium crowding","points":-10},{"reason":"slop risk","points":-10}],"percentile":10.9},"reasons":[{"sign":"good","text":"paid $11k in the last 90 days"},{"sign":"good","text":"87% response efficiency"},{"sign":"bad","text":"3,736 reports in 90 days across 44 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 1 months ago"}]},{"id":"hackerone:expediagroup_bbp","platform":"hackerone","slug":"expediagroup_bbp","name":"Expedia Group Bug Bounty","url":"https://hackerone.com/expediagroup_bbp","meta":{"reward_min":100,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-11-28T20:02:24.288Z","age_months":46.71538203316792,"reports_90d":1066,"resolved_total":705,"response_efficiency":66,"response_indicator":"missed","paid_total":1000000,"paid_90d":245000,"last_resolved_at":"2026-10-15T08:21:17.828Z","days_since_resolved":5.386320958622685,"avg_bounty_low":375,"avg_bounty_high":750,"min_bounty":100,"scope_count":117},"scope":[{"asset":"*.abritel.fr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.bookabach.co.nz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.carrentals.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below:\ndbmanalytics.carrentals.com"},{"asset":"*.cheaptickets.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below:\nfaq-lab.cheaptickets.com, faq.cheaptickets.com, groups.cheaptickets.com, link.mailer.c"},{"asset":"*.ean.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expedia-aarp.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expedia.biz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expedia.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expediaagents.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expediacruises.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expediagroup.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expediapartnercentral.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"."},{"asset":"*.expediapartnersolutions.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below:\n\ndiscoveryhub.expediapartnersolutions.com, gco-get.expediapartnersolutions.com, gco.ex"},{"asset":"*.expediataap.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.expediataaprewards.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.fewo-direkt.de","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.flights.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hotels.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hotwire.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.hotwirepartnercentral.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.lastminute.co.nz","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for a bounty. Before submitting your report, please confirm that the asset you are testing does not appear in t"},{"asset":"*.lastminute.com.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for a bounty. Before submitting your report, please confirm that the asset you are testing does not appear in t"},{"asset":"*.orbitz.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.stayz.com.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tiqets.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.travelocity.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below:\n\nclick.e.travelocity.ca, fr.groups.travelocity.ca, gro"},{"asset":"*.travelocity.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below:\n\nbr.ac.travelocity.com, groups.travelocity.com, mi.tra"},{"asset":"*.vrbo.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below:\n\nli.vrbo.com, media.vrbo.com, om.vrbo.com, community.v"},{"asset":"*.wotif.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below:\n\ngroups.wotif.com, link.wotif.com, res.ac.wotif.com, s"},{"asset":"1245772818","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Vrbo iOS app](https://apps.apple.com/us/app/vrbo-vacation-rentals/id1245772818)"},{"asset":"284803487","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Travelocity iOS app](https://apps.apple.com/us/app/travelocity-hotels-flights/id284803487)"},{"asset":"284971959","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Hotels.com iOS app](https://apps.apple.com/us/app/hotels-com-book-your-hotel/id284971959)"},{"asset":"403546234","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Orbitz iOS app](https://apps.apple.com/us/app/orbitz-hotels-flights/id403546234)"},{"asset":"427916203","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Expedia iOS app](https://apps.apple.com/us/app/expedia-hotels-flights-car/id427916203)"},{"asset":"483394780","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"This is the ebookers iOS app \n\nhttps://apps.apple.com/us/app/ebookers-hotels-flights/id483394780"},{"asset":"506426310","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[CarRentals iOS App](https://apps.apple.com/us/app/carrentals-com-rental-car-app/id506426310)"},{"asset":"531549799","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Wotif iOS app](https://apps.apple.com/au/app/wotif-hotels-flights/id531549799)"},{"asset":"566635048","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Hotwire iOS App](https://apps.apple.com/us/app/hotwire-last-minute-hotels/id566635048)"},{"asset":"642441300","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[HomeAway / Stayz & Bookabach iOS App](https://apps.apple.com/us/app/homeaway-holiday-rentals/id642441300)"},{"asset":"880759727","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Cheaptickets iOS app](https://apps.apple.com/us/app/cheaptickets-hotels-flights/id880759727)"},{"asset":"987675995","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"critical","instruction":null},{"asset":"com.carrentals","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[CarRentals Android App](https://play.google.com/store/apps/details?id=com.carrentals&hl=en_CA)"},{"asset":"com.cheaptickets","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[CheapTickets Android app](https://play.google.com/store/apps/details?id=com.cheaptickets)"},{"asset":"com.ebookers","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"This is the ebookers Android app \n\nhttps://play.google.com/store/apps/details?id=com.ebookers"},{"asset":"com.expedia.bookings","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Expedia Android App](https://play.google.com/store/apps/details?id=com.expedia.bookings)"},{"asset":"com.expediapartnercentral","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"critical","instruction":null},{"asset":"com.hcom.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Hotels Android App](https://play.google.com/store/apps/details?id=com.hcom.android)"},{"asset":"com.homeaway.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[HomeAway Android app](https://play.google.com/store/apps/details?id=com.vacationrentals.homeaway&hl=en)"},{"asset":"com.hotwire.hotels","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Hotwire Android App](https://play.google.com/store/apps/details?id=com.hotwire.hotels)"},{"asset":"com.orbitz","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Orbitz Android app](https://play.google.com/store/apps/details?id=com.orbitz)"},{"asset":"com.travelocity.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Travelocity Android app](https://play.google.com/store/apps/details?id=com.travelocity.android)"},{"asset":"com.vrbo.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[VRBO Android App](https://play.google.com/store/apps/details?id=com.vrbo.android)"},{"asset":"com.wotif.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Wotif Android app](https://play.google.com/store/apps/details?id=com.wotif.android)"},{"asset":"https://apps.apple.com/in/app/expedia-group-partner-central/id987675995","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"https://play.google.com/store/apps/datasafety?id=com.expediapartnercentral&hl=en","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"www.abritel.fr","type":"URL","bounty":true,"severity":"critical","instruction":"www.abritel.fr/api/track is out of scope. Please do not test this endpoint or submit reports related to it."},{"asset":"www.bookabach.co.nz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.carrentals.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.cheaptickets.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.ebookers.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.ebookers.fi","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.expedia-aarp.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.expedia.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only point-of-sale assets under www.expedia.com are in scope, including regional versions such as www.expedia.co.in and www.expedia.co.uk.\n\nAll other subdomains are out of scope for Tier 0."},{"asset":"www.expediacruises.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.expediagroup.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.expediapartnercentral.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.expediataap.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"www.fewo-direkt.de","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.hotels.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only point-of-sale assets under www.hotels.com are in scope, including regional versions such as www.in.hotels.com, www.uk.hotels.com, and www.fr.hotels.com.\n\nAll other subdomains are out of scope for"},{"asset":"www.hotwire.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.lastminute.co.nz","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.lastminute.com.au","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.mrjet.se","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.orbitz.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.stayz.com.au","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.tiqets.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.travelocity.ca","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.travelocity.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.vrbo.com","type":"URL","bounty":true,"severity":"critical","instruction":"Only point-of-sale assets under www.vrbo.com are in scope. All other subdomains are out of scope for Tier 0."},{"asset":"www.wotif.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.17,"label":"none","experimental":true}},"derived":{"novelty":0.2131,"inverse_crowd":0.2087,"payout_reliability":0.8184,"value_per_competition":0.1656,"triage_quality":0.495,"scope_breadth":0.7674,"crowding_per_asset_month":3.037,"slop_risk":0.17},"score":{"total":10.7,"parts":{"novelty":0.213,"inverse_crowd":0.209,"payout_reliability":0.818,"value_per_competition":0.166,"triage_quality":0.495,"scope_breadth":0.767},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":10.4},"reasons":[{"sign":"good","text":"paid $245k in the last 90 days"},{"sign":"bad","text":"1,066 reports in 90 days across 117 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 3.9 years"}]},{"id":"hackerone:lark_technologies","platform":"hackerone","slug":"lark_technologies","name":"Lark Technologies","url":"https://hackerone.com/lark_technologies","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-12-01T05:00:01.999Z","age_months":70.62098028740779,"reports_90d":147,"resolved_total":352,"response_efficiency":63,"response_indicator":"missed","paid_total":260199,"paid_90d":8100,"last_resolved_at":"2025-05-22T07:43:12.411Z","days_since_resolved":516.4127725442709,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":100,"scope_count":22},"scope":[{"asset":"1452166623","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset\n\nOnly the latest version of the application will be in scope. \n\n[Download from the Apple App Store here](https://apps.apple.com/app/lark-collaboration-tool/id1452166623)"},{"asset":"Mac OS Executable: Download here https://www.larksuite.com/download","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset\n\nThis is the Lark Suite application for Mac OS. Only the latest version of the application will be in scope.\n\nPlease download the latest version of the application here: https://www.l"},{"asset":"Windows OS Executable: Download here https://www.larksuite.com/download","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset\n\nThis is the Lark Suite application for Windows. Only the latest version of the application will be in scope. \n\nPlease download the latest version of the application here: https://www"},{"asset":"api.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"app.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 2** Asset"},{"asset":"caldav.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"com.larksuite.suite","type":"OTHER_APK","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset\n\nOnly the latest version of the application will be in scope. \n\n[Download from the Google Play Store here](https://play.google.com/store/apps/details?id=com.larksuite.suite)"},{"asset":"file.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"hackers_chosendomain.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset\n\n<hacker’s_chosendomain>.larksuite.com\nIf you find a vulnerability against your own test account domain, please feel free to use this asset for submission."},{"asset":"internal-api-drive-stream.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"internal-api-lark-api.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"internal-api.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"lark-frontier.byteoversea.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"open.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"passport.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 1** Asset"},{"asset":"status.larksuite.com","type":"URL","bounty":true,"severity":"critical","instruction":"**Tier 2** Asset"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 516 days"},"slop":{"risk":0.097,"label":"none","experimental":true}},"derived":{"novelty":0.1811,"inverse_crowd":0.2767,"payout_reliability":0.6156,"value_per_competition":0.1945,"triage_quality":0.4725,"scope_breadth":0.5044,"crowding_per_asset_month":2.2273,"slop_risk":0.097},"score":{"total":10.5,"parts":{"novelty":0.181,"inverse_crowd":0.277,"payout_reliability":0.616,"value_per_competition":0.195,"triage_quality":0.473,"scope_breadth":0.504},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"dormant","points":-15}],"percentile":10.0},"reasons":[{"sign":"good","text":"paid $8k in the last 90 days"},{"sign":"neutral","text":"147 reports in 90 days across 22 assets"},{"sign":"bad","text":"nothing resolved for 516 days"},{"sign":"neutral","text":"running 5.9 years"}]},{"id":"hackerone:matomo","platform":"hackerone","slug":"matomo","name":"Matomo","url":"https://hackerone.com/matomo","meta":{"reward_min":10000,"reward_max":555,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2018-09-27T05:18:58.833Z","age_months":96.77249871694615,"reports_90d":1099,"resolved_total":382,"response_efficiency":100,"response_indicator":"ok","paid_total":203785,"paid_90d":50521,"last_resolved_at":"2026-10-12T21:24:02.974Z","days_since_resolved":7.8427428799189824,"avg_bounty_low":333,"avg_bounty_high":555,"min_bounty":10000,"scope_count":17},"scope":[{"asset":"737216887","type":"APPLE_STORE_APP_ID","bounty":false,"severity":"medium","instruction":"Matomo Mobile 2 iOS App\nOnly critical issues compromising the token are in scope."},{"asset":"https://github.com/innocraft/","type":"SOURCE_CODE","bounty":true,"severity":"high","instruction":"All other software on the innocraft GitHub organisation. Archived or forked repositories are explicitly out of scope."},{"asset":"https://github.com/matomo-org","type":"SOURCE_CODE","bounty":true,"severity":"high","instruction":"All other software on the matomo-org GitHub organisation not listed separately. Archived or forked repositories are explicitly out of scope."},{"asset":"https://github.com/matomo-org/developer-documentation","type":"SOURCE_CODE","bounty":true,"severity":"low","instruction":"Developer Documentation. Vulnerabilities are only in scope in case they affect https://developer.matomo.org/"},{"asset":"https://github.com/matomo-org/docker","type":"URL","bounty":true,"severity":"critical","instruction":"Official Docker project for Matomo Analytics"},{"asset":"https://github.com/matomo-org/matomo","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"this repository contains the source code of Matomo Analytics"},{"asset":"https://github.com/matomo-org/tracker-proxy","type":"SOURCE_CODE","bounty":true,"severity":"medium","instruction":"Matomo Tracker Proxy"},{"asset":"https://plugins.matomo.org/developer/innocraft","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Official plugins by Innocraft"},{"asset":"https://plugins.matomo.org/developer/matomo-org","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Official plugins by the Matomo team"},{"asset":"matomo.cloud","type":"URL","bounty":true,"severity":"critical","instruction":"Matomo Analytics Cloud\n*$username.matomo.cloud* is also in scope, but please limit tests to ones that don't affect the live instance. (no automated tools) You can easily set up your own Matomo instanc"},{"asset":"org.piwik.mobile2","type":"GOOGLE_PLAY_APP_ID","bounty":false,"severity":"medium","instruction":"Matomo Mobile 2 Android App\nOnly critical issues compromising the token are in scope."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"100% response, paid recently, resolved 8d ago"},"slop":{"risk":0.715,"label":"elevated","experimental":true}},"derived":{"novelty":0.1599,"inverse_crowd":0.0245,"payout_reliability":0.9833,"value_per_competition":0.0283,"triage_quality":1.0,"scope_breadth":0.4649,"crowding_per_asset_month":21.549,"slop_risk":0.715},"score":{"total":10.4,"parts":{"novelty":0.16,"inverse_crowd":0.024,"payout_reliability":0.983,"value_per_competition":0.028,"triage_quality":1.0,"scope_breadth":0.465},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":9.5},"reasons":[{"sign":"good","text":"paid $51k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"bad","text":"1,099 reports in 90 days across 17 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 8.1 years"}]},{"id":"hackerone:omarchy","platform":"hackerone","slug":"omarchy","name":"Omarchy","url":"https://hackerone.com/omarchy","meta":{"reward_min":50,"reward_max":null,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-10-01T17:46:28.379Z","age_months":0.6240275229390068,"reports_90d":1483,"resolved_total":0,"response_efficiency":96,"response_indicator":"ok","paid_total":0,"paid_90d":0,"last_resolved_at":null,"days_since_resolved":null,"avg_bounty_low":null,"avg_bounty_high":null,"min_bounty":50,"scope_count":1},"scope":[{"asset":"https://github.com/omacom/omarchy","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"medium","signals_present":8,"signals_expected":10,"missing":["last_resolved_at","avg_bounty_high"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"96% response, no recent payout seen"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.8237,"inverse_crowd":0.0006,"payout_reliability":0.4835,"value_per_competition":0.0,"triage_quality":0.96,"scope_breadth":0.1115,"crowding_per_asset_month":494.3333,"slop_risk":1.0},"score":{"total":10.1,"parts":{"novelty":0.824,"inverse_crowd":0.001,"payout_reliability":0.483,"value_per_competition":0.0,"triage_quality":0.96,"scope_breadth":0.111},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":9.0},"reasons":[{"sign":"good","text":"96% response efficiency"},{"sign":"bad","text":"1,483 reports in 90 days across 1 assets"},{"sign":"neutral","text":"launched 1 months ago"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:spotify","platform":"hackerone","slug":"spotify","name":"Spotify","url":"https://hackerone.com/spotify","meta":{"reward_min":250,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-05-31T16:50:46.191Z","age_months":112.65815262294662,"reports_90d":1009,"resolved_total":1712,"response_efficiency":73,"response_indicator":"missed","paid_total":766162,"paid_90d":34100,"last_resolved_at":"2026-10-15T09:16:01.899Z","days_since_resolved":5.348310877604167,"avg_bounty_low":300,"avg_bounty_high":300,"min_bounty":250,"scope_count":106},"scope":[{"asset":"*.atspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.avecspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.byspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.enspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.forspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.fromspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.spotify.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"[Non-core asset]\n\nMain spotify domain wildcard for assets on this domain that are not otherwise listed."},{"asset":"*.spotify.net","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"[Non-core asset]\n\nInternal spotify domain wildcard for assets on this domain that are not otherwise listed."},{"asset":"*.tospotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"*.withspotify.com","type":"WILDCARD","bounty":true,"severity":"low","instruction":"If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational."},{"asset":"Anchor","type":"OTHER","bounty":true,"severity":"critical","instruction":"Anchor was acquired by Spotify in 2019.\n\n[Non-core asset]\n\n~~~\nanchor.fm"},{"asset":"Android SDK","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"[Core asset]\n\n* https://developer.spotify.com/documentation/android/ \n* https://github.com/spotify/android-sdk"},{"asset":"Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Core Backstage source code","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"https://github.com/backstage/backstage\n\n[Core asset]\n\nNote on severity - per Backstage's [threat model](https://backstage.io/docs/overview/threat-model/), Backstage is primarily designed to be deploye"},{"asset":"DRM (Digital Rights Management) System","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core Asset]\nWe are interested in reports about the DRM used to secure the content on Spotify, specifically for these DRM implementations and versions. More info on the DRM is available in the program"},{"asset":"GHE","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"Jira","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"Megaphone","type":"OTHER","bounty":true,"severity":"critical","instruction":"Megaphone was acquired by Spotify in November 2020.\n\n[Core asset]\n\n** These targets are NOT in scope:**\n```\nsupport.megaphone.fm\n```"},{"asset":"Non-Core Assets","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Okta","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"Other Spotify websites","type":"OTHER","bounty":true,"severity":"critical","instruction":"Please use this asset for non *.spotify.com websites. This includes sites associated with Spotify, but aren't otherwise listed as a separate asset.\n[Non-core asset]\nFind below a list of in-scope targe"},{"asset":"Podsights","type":"OTHER","bounty":true,"severity":"critical","instruction":"Podsights was acquired by Spotify in February 2022. \n\n[ Non-core asset]\n\n** These targets are in scope: **\n```\nadmin.podsights.com\napi.pdst.fm\ncdn.pdst.fm\ndash.podsights.com\nmetarouter.pdst.io\npdst.fm"},{"asset":"Save to Spotify CLI","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[Non-Core asset] \n\nThis only includes the CLI and the skill.\n* https://github.com/spotify/save-to-spotify\n* https://clawhub.ai/spotify/save-to-spotify"},{"asset":"Sonantic","type":"OTHER","bounty":true,"severity":"critical","instruction":"Sonantic was acquired by Spotify in June 2022. \n\n[Non-core asset]\n\n** These targets are in scope: **\n```\napp.sonantic.io\napi.sonantic.io\nlabel-studio-public.sonantic.io\n```"},{"asset":"Spotify SDKs","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"For Spotify SDK (note: there is a specific scope for Web, Android and iOS SDK)\nhttps://developer.spotify.com/\n\n[Core asset]"},{"asset":"Spotify desktop application (Windows and Mac)","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[Core asset]"},{"asset":"VPN","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Web Playback SDK","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"* https://developer.spotify.com/documentation/web-playback-sdk/\n\n[Non-core asset]"},{"asset":"Wrapped","type":"OTHER","bounty":true,"severity":"critical","instruction":"Please use this asset when reporting bugs related to [Spotify Wrapped](https://www.spotify.com/wrapped).\n\nThis asset supersedes other assets when the issue primarily concerns Spotify Wrapped, even if "},{"asset":"api-partner.spotify.com","type":"API","bounty":true,"severity":"critical","instruction":"api-partner.spotify.com\n\n[Core asset]\n\napi-partner is used by Spotify's partners, aka Ads API. It's documentation is available @ https://developer.spotify.com/documentation/ads-api"},{"asset":"api.spotify.com","type":"URL","bounty":true,"severity":"critical","instruction":"api.spotify.com\n\n[Core asset]\n\nBased on simple REST principles, the Spotify Web API endpoints return JSON metadata about music artists, albums, and tracks, directly from the Spotify Data Catalogue.\nWe"},{"asset":"assets.spotify.com","type":"URL","bounty":true,"severity":"critical","instruction":"* Do not run automated scans against this target. They are often very noisy.\n~~~\nassets.spotify.com"},{"asset":"backstage.io","type":"URL","bounty":true,"severity":"medium","instruction":"Backstage is an open-source developer portal.\n\n[Non-core asset]\n\nFind below a list of in-scope targets. Note that it is continuously updated: \n\n~~~\nbackstage.io"},{"asset":"com.anchorfminc.Anchor","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"[Non-core asset]"},{"asset":"com.spotify.client","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify - Music and Podcasts\n\n[Core asset]\n\nhttps://itunes.apple.com/us/app/spotify-music-and-podcasts/id324684580"},{"asset":"com.spotify.kids","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify Kids\n\n[Core asset]\n\nhttps://apps.apple.com/ie/app/Spotify-Kids/id1470209570"},{"asset":"com.spotify.kids","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify Kids\n\n[Core asset]\n\nhttps://play.google.com/store/apps/details?id=com.spotify.kids"},{"asset":"com.spotify.music","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify - Music and Podcasts\n\nhttps://play.google.com/store/apps/details?id=com.spotify.music\n\n[Core asset]"},{"asset":"com.spotify.s4a","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify for Artists\n\n[Core asset]\n\nhttps://itunes.apple.com/us/app/spotify-for-artists/id1222021797"},{"asset":"com.spotify.s4a","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify for Artists\n\n[Core asset]\n\nhttps://play.google.com/store/apps/details?id=com.spotify.s4a"},{"asset":"com.spotify.tv.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Spotify Music - for Android TV\n\nhttps://play.google.com/store/apps/details?id=com.spotify.tv.android\n\n[Core asset]"},{"asset":"fm.anchor.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"[Non-core asset]"},{"asset":"https://github.com/backstage/backstage","type":"SOURCE_CODE","bounty":true,"severity":"medium","instruction":"Non-Core Backstage source code\n\nhttps://github.com/backstage/backstage\n\n[Non-Core asset] This asset includes all components of the repo that are **not** part of the \"Core Backstage source code\" asset\n"},{"asset":"https://www.whosampled.com/","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-core asset]\n\nReports accepted for the whosampled website only and the `/apimob/` API. Whosampled mobile apps are out of scope."},{"asset":"iOS SDK","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"* https://developer.spotify.com/documentation/ios/ \n* https://github.com/spotify/ios-sdk \n\n[Core asset]"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.138,"label":"none","experimental":true}},"derived":{"novelty":0.1506,"inverse_crowd":0.2001,"payout_reliability":0.8535,"value_per_competition":0.1381,"triage_quality":0.5475,"scope_breadth":0.7517,"crowding_per_asset_month":3.173,"slop_risk":0.138},"score":{"total":10.0,"parts":{"novelty":0.151,"inverse_crowd":0.2,"payout_reliability":0.853,"value_per_competition":0.138,"triage_quality":0.547,"scope_breadth":0.752},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":8.6},"reasons":[{"sign":"good","text":"paid $34k in the last 90 days"},{"sign":"bad","text":"1,009 reports in 90 days across 106 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.4 years"}]},{"id":"hackerone:chia_network","platform":"hackerone","slug":"chia_network","name":"Chia Network","url":"https://hackerone.com/chia_network","meta":{"reward_min":50,"reward_max":1000,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2024-02-29T21:13:22.708Z","age_months":31.666534812846987,"reports_90d":1550,"resolved_total":45,"response_efficiency":100,"response_indicator":"ok","paid_total":351000,"paid_90d":50000,"last_resolved_at":"2026-07-28T18:08:54.969Z","days_since_resolved":83.97825219704862,"avg_bounty_low":1000,"avg_bounty_high":1000,"min_bounty":50,"scope_count":11},"scope":[{"asset":"api.vault.chiatest.net","type":"URL","bounty":true,"severity":"critical","instruction":"Chia Cloud crypto wallet API"},{"asset":"https://apps.apple.com/app/chia-signer/id6504493785 ","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"IOS cryptographic signing application"},{"asset":"https://github.com/Chia-Network/chia-blockchain","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Chia core"},{"asset":"https://github.com/Chia-Network/chia-blockchain-gui","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Chia desktop"},{"asset":"https://github.com/Chia-Network/chia_rs","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Chia RUST implementations"},{"asset":"https://github.com/Chia-Network/chiapos","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Chia Proof of Space plotter"},{"asset":"https://github.com/Chia-Network/chiavdf","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"ChiaVDF (Verifiable Delay Function) for Timelords"},{"asset":"https://github.com/Chia-Network/clvm_rs","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Chia RUST implementations"},{"asset":"https://vault.chiatest.net/","type":"URL","bounty":true,"severity":"critical","instruction":"Chia Cloud crypto wallet"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"100% response, pays, last resolved 84d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.2479,"inverse_crowd":0.0098,"payout_reliability":0.8787,"value_per_competition":0.0145,"triage_quality":1.0,"scope_breadth":0.3997,"crowding_per_asset_month":46.9697,"slop_risk":1.0},"score":{"total":9.0,"parts":{"novelty":0.248,"inverse_crowd":0.01,"payout_reliability":0.879,"value_per_competition":0.015,"triage_quality":1.0,"scope_breadth":0.4},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":8.1},"reasons":[{"sign":"good","text":"paid $50k in the last 90 days"},{"sign":"good","text":"100% response efficiency"},{"sign":"bad","text":"1,550 reports in 90 days across 11 assets"},{"sign":"neutral","text":"running 2.6 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:wordpress","platform":"hackerone","slug":"wordpress","name":"WordPress","url":"https://hackerone.com/wordpress","meta":{"reward_min":10,"reward_max":225,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-04-18T02:29:09.487Z","age_months":114.09054166545936,"reports_90d":2233,"resolved_total":null,"response_efficiency":81,"response_indicator":"ok","paid_total":200000,"paid_90d":95000,"last_resolved_at":"2026-10-19T23:23:35.678Z","days_since_resolved":0.759725472511574,"avg_bounty_low":150,"avg_bounty_high":225,"min_bounty":10,"scope_count":36},"scope":[{"asset":"*.buddypress.org,bbpress.org,profiles.wordpress.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"**Do _not_ pentest Trac instances**, it's very annoying to clean up after. Setup a local environment instead; the custom source code is available via the Git command below, in the `trac.wordpress.org`"},{"asset":"*.wordcamp.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.wordpress.net","type":"WILDCARD","bounty":true,"severity":"low","instruction":"Only the jobs.wordpress.net site is eligible for bounty.\n\nIssues with playground.wordpress.net should use the \"Playground\" asset.\n\nIssues are in scope only if they can be exploited without an authenti"},{"asset":"*.wordpress.org","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"All wordpress.org domains that **are not listed in other assets**, including (but not limited to) the following:\n* login.wordpress.org\n* developer.wordpress.org\n* make.wordpress.org\n* translate.wordpr"},{"asset":"BuddyPress Core","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Download source code from: https://buddypress.org/download/\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contr"},{"asset":"Create Block Theme","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The Create Block Theme plugin at https://github.com/WordPress/create-block-theme.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenti"},{"asset":"GlotPress","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"All code located under [the GlotPress organization](https://github.com/GlotPress/) on GitHub.\n\nThe most important target is the `glotpress-wp` repository. Other repositories are in scope, but may have"},{"asset":"Gutenberg","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Download source code from https://github.com/WordPress/gutenberg"},{"asset":"Official WordPress plugins","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Only plugins that are officially maintained by WordPress.org are in scope. Most plugins have their own asset, use this asset only for those that don't.\n\nIssues are in scope only if they can be exploit"},{"asset":"Playground","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Covers https://playground.wordpress.net and https://github.com/WordPress/wordpress-playground .\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that re"},{"asset":"SQLite Database Integration","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The SQLite Database Integration plugin at https://github.com/WordPress/sqlite-database-integration.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues tha"},{"asset":"Secure Custom Fields","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"The Secure Custom Fields plugin at https://github.com/WordPress/secure-custom-fields.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require auth"},{"asset":"WP-CLI","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"All code located under [the WP-CLI organization](https://github.com/wp-cli) on GitHub.\n\nThe most important targets are the main `wp-cli` repository, and any repositories for commands that are bundled "},{"asset":"WordPress Core","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Download source code from: https://wordpress.org/download/source/"},{"asset":"api.wordpress.org","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"bbPress Core","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Download source code from: https://bbpress.org/download/\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contribu"},{"asset":"codex.wordpress.org,codex.bbpress.org,codex.buddypress.org","type":"URL","bounty":true,"severity":"medium","instruction":"These are wikis, they're intended to be freely edited by anonymous users. We are not interested in vulnerabilities unless they have a severe impact."},{"asset":"doaction.org","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"github.com/wordpress","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"This only covers repos under https://github.com/wordpress that are not covered by any other asset. Please check all other assets before using this one.\n\nIssues are in scope only if they can be exploit"},{"asset":"mercantile.wordpress.org","type":"URL","bounty":true,"severity":"medium","instruction":"This site runs uses [the WooCommerce plugin](https://woocommerce.com/), but we don't accept reports for that. We only accept reports for our custom code. If you find any vulnerabilities that are also "},{"asset":"planet.wordpress.org","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wordpressfoundation.org","type":"URL","bounty":true,"severity":"medium","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"81% response, paid recently, resolved 1d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.1498,"inverse_crowd":0.0257,"payout_reliability":0.9033,"value_per_competition":0.0253,"triage_quality":0.81,"scope_breadth":0.5809,"crowding_per_asset_month":20.6759,"slop_risk":1.0},"score":{"total":7.1,"parts":{"novelty":0.15,"inverse_crowd":0.026,"payout_reliability":0.903,"value_per_competition":0.025,"triage_quality":0.81,"scope_breadth":0.581},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":7.7},"reasons":[{"sign":"good","text":"paid $95k in the last 90 days"},{"sign":"good","text":"81% response efficiency"},{"sign":"bad","text":"2,233 reports in 90 days across 36 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.5 years"}]},{"id":"hackerone:neon_bbp","platform":"hackerone","slug":"neon_bbp","name":"Neon","url":"https://hackerone.com/neon_bbp","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-02-28T09:33:37.246Z","age_months":19.690713633289604,"reports_90d":1026,"resolved_total":75,"response_efficiency":79,"response_indicator":"ok","paid_total":136200,"paid_90d":27150,"last_resolved_at":"2026-10-01T13:18:57.160Z","days_since_resolved":19.179615727141204,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":6},"scope":[{"asset":"Neon-supported extensions","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"https://console-stage.neon.build/","type":"URL","bounty":true,"severity":"critical","instruction":"Please do research here and use @wearehackerone.com email addresses for account creation."},{"asset":"https://console.neon.tech/","type":"URL","bounty":true,"severity":"critical","instruction":"Use Staging unless absolutely necessary. Notify us before testing here. Accounts must use @wearehackerone.com email addresses."},{"asset":"https://console.neon.tech/api/v2/","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"79% response, pays"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.2976,"inverse_crowd":0.0078,"payout_reliability":0.8566,"value_per_competition":0.0115,"triage_quality":0.79,"scope_breadth":0.313,"crowding_per_asset_month":57.0,"slop_risk":1.0},"score":{"total":6.6,"parts":{"novelty":0.298,"inverse_crowd":0.008,"payout_reliability":0.857,"value_per_competition":0.012,"triage_quality":0.79,"scope_breadth":0.313},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":7.2},"reasons":[{"sign":"good","text":"paid $27k in the last 90 days"},{"sign":"bad","text":"1,026 reports in 90 days across 6 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 1.6 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:anthropic","platform":"hackerone","slug":"anthropic","name":"Anthropic","url":"https://hackerone.com/anthropic","meta":{"reward_min":50,"reward_max":1200,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2026-05-07T19:06:39.180Z","age_months":5.451766970425507,"reports_90d":5684,"resolved_total":490,"response_efficiency":96,"response_indicator":"ok","paid_total":1105335,"paid_90d":250600,"last_resolved_at":"2026-10-20T10:48:23.909Z","days_since_resolved":0.2841672433449074,"avg_bounty_low":600,"avg_bounty_high":1200,"min_bounty":50,"scope_count":23},"scope":[{"asset":"API & SDKs","type":"AI_MODEL","bounty":true,"severity":"critical","instruction":"[Core]\n\nAnthropic's API enables enterprise customers to programmatically interact with Claude, supporting their diverse business requirements. Claude is a large language model (LLM) that has been trai"},{"asset":"Claude Code","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\n\n**In Scope:**\n* Bypassing permission prompts for unauthorized command execution \n(excluding pre-approved or user-allowed commands)\n* Bypassing permission prompts for file write operations outs"},{"asset":"Claude Desktop Extensions and Claude.ai MCP servers","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core] \n\nConnectors (e.g., desktop extensions, local MCP servers, and remote MCP servers) installable from the Claude.ai & Desktop Connectors directory may be developed by Anthropic or created ind"},{"asset":"Claude in Chrome","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\n\nhttps://chromewebstore.google.com/detail/claude/fcoeoabgfenejglbffodgkkbkcdhcgfn"},{"asset":"Infrastructure & Internal Apps/Services","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core]\n\nIn scope:\n\n- Vulnerabilities in Anthropic infrastructure that could lead to unauthorized access, data exposure, or service disruption. Examples include server misconfigurations, exposed in"},{"asset":"Leaked Employee API Keys","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Non-Core] \n\nAPI keys belonging to employees that are publicly leaked. Hackers should submit the leaked credentials to the program and should NOT test their validity beyond authenticating and then imm"},{"asset":"Official Clients","type":"OTHER","bounty":true,"severity":"critical","instruction":"[Core]\n\nClaude, Anthropic's AI assistant, is now available on iOS, Android, and Desktop. \n\nClaude iOS App:\nhttps://apps.apple.com/us/app/claude/id6473753684\n\nClaude Android App:\nhttps://play.google.co"},{"asset":"anthropic.atlassian.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-Core]\n\nNote: It is working as intended that there are 4 queues accessible with an external account: AP Inbox, Finsys Intake, and Dev Accounts Payable. Reports about this will be closed as Informa"},{"asset":"api.anthropic.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core]"},{"asset":"claude.ai","type":"URL","bounty":true,"severity":"critical","instruction":"[Core]\n\nClaude, a next-generation AI assistant trained to be helpful, honest and harmless, is accessible through a chat interface on claude.ai.\n\nClaude is capable of a wide variety of conversational a"},{"asset":"console.anthropic.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Core]"},{"asset":"docs.anthropic.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-Core]"},{"asset":"github.com/anthropics","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"[Non-Core]\n\nNote: Vulnerabilities in repos that are marked as archived or repos that are forks of other open source projects are excluded from our bug bounty unless the issue can be demonstrated to im"},{"asset":"support.anthropic.com","type":"URL","bounty":true,"severity":"critical","instruction":"[Non-Core]"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"green","label":"Pays reliably","why":"96% response, paid recently, resolved 0d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.4744,"inverse_crowd":0.005,"payout_reliability":0.9794,"value_per_competition":0.0086,"triage_quality":0.96,"scope_breadth":0.5112,"crowding_per_asset_month":82.3768,"slop_risk":1.0},"score":{"total":6.4,"parts":{"novelty":0.474,"inverse_crowd":0.005,"payout_reliability":0.979,"value_per_competition":0.009,"triage_quality":0.96,"scope_breadth":0.511},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"premium crowding","points":-10},{"reason":"slop risk","points":-10}],"percentile":6.8},"reasons":[{"sign":"good","text":"paid $251k in the last 90 days"},{"sign":"good","text":"96% response efficiency"},{"sign":"bad","text":"5,684 reports in 90 days across 23 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"launched 5 months ago"}]},{"id":"hackerone:shopify","platform":"hackerone","slug":"shopify","name":"Shopify","url":"https://hackerone.com/shopify","meta":{"reward_min":500,"reward_max":900,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2015-04-09T18:44:14.695Z","age_months":138.3804096371682,"reports_90d":1863,"resolved_total":2430,"response_efficiency":51,"response_indicator":"missed","paid_total":10201016,"paid_90d":741363,"last_resolved_at":"2026-10-16T13:15:44.105Z","days_since_resolved":4.181850160011574,"avg_bounty_low":500,"avg_bounty_high":900,"min_bounty":500,"scope_count":181},"scope":[{"asset":"*.pci.shopifyinc.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"*.shopify.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\nReports involving *.shopify.com are reviewed on a per case basis for bounty eligibility, this includes shopifycompass.com. Any services operated by a third party without a proof"},{"asset":"*.shopify.io","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\n*.shopify.io may include developer test or third party applications. If you are unsure about a domain and it looks like a test or third party application, please email us at bug"},{"asset":"*.shopifycloud.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\n*.shopifycloud.com may include developer test or third party applications. For example,  devdegree*.shopifycloud.com, vendorvoice.shopifycloud.com, nsolid-test-console.shopifycl"},{"asset":"*.shopifycs.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"Environment: Non-core\n\nShopify's service for handling credit card data in a PCI compliant way."},{"asset":"*.shopifykloud.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\nShopify Kloud includes all *.shopifykloud.com applications. Please note, there may be developer test or third party applications launched on the domain which may have low securi"},{"asset":"Authentication & ATO","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Shopify Developed Apps","type":"OTHER","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\nShopify apps and sales channels means everything installed via the following link https://apps.shopify.com/collections/made-by-shopify"},{"asset":"Shopify Mobile Applications","type":"OTHER","bounty":true,"severity":"critical","instruction":"Environment: Non-core\n\nAndroid: https://play.google.com/store/apps/dev?id=8929232438554100687\niOS: https://itunes.apple.com/ca/developer/shopify-inc/id371294475\n\nNote: any services operated by a third"},{"asset":"Shopify Third Party Apps","type":"OTHER","bounty":false,"severity":"medium","instruction":"Environment: Non-core\n\nVulnerabilities found in Shopify third party apps should be reported to the responsible developer. You should only report vulnerabilities in Shopify third party apps to Shopify "},{"asset":"Shopify Third Party Store","type":"OTHER","bounty":false,"severity":"medium","instruction":"Environment: Non-core\n\nYou may only test against shops you have created."},{"asset":"accounts.shopify.com","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"admin.shopify.com","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"arrive-server.shopifycloud.com","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"https://github.com/Shopify/*","type":"SOURCE_CODE","bounty":true,"severity":"medium","instruction":"Environment: Non-core\n\nPublic repositories available under the Shopify organization in Github."},{"asset":"linkpop.com","type":"URL","bounty":true,"severity":"medium","instruction":"Environment: Non-core"},{"asset":"partners.shopify.com","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"shop.app","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"shopify.plus","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core"},{"asset":"shopifyinbox.com","type":"URL","bounty":true,"severity":"medium","instruction":"Environment: Non-core"},{"asset":"your-store.myshopify.com","type":"URL","bounty":true,"severity":"critical","instruction":"Environment: Core\n\nYour development store hosted at `*.myshopify.com`. Create a development store by signing up at https://partners.shopify.com/"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.154,"label":"none","experimental":true}},"derived":{"novelty":0.1388,"inverse_crowd":0.1855,"payout_reliability":0.7459,"value_per_competition":0.155,"triage_quality":0.3825,"scope_breadth":0.8371,"crowding_per_asset_month":3.4309,"slop_risk":0.154},"score":{"total":6.1,"parts":{"novelty":0.139,"inverse_crowd":0.186,"payout_reliability":0.746,"value_per_competition":0.155,"triage_quality":0.383,"scope_breadth":0.837},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":6.3},"reasons":[{"sign":"good","text":"paid $741k in the last 90 days"},{"sign":"bad","text":"1,863 reports in 90 days across 181 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 11.5 years"}]},{"id":"hackerone:amazonvrp","platform":"hackerone","slug":"amazonvrp","name":"Amazon Vulnerability Research Program","url":"https://hackerone.com/amazonvrp","meta":{"reward_min":100,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-04-21T21:58:46.805Z","age_months":77.95708006457716,"reports_90d":1708,"resolved_total":2699,"response_efficiency":63,"response_indicator":"missed","paid_total":null,"paid_90d":null,"last_resolved_at":"2026-10-19T22:56:16.859Z","days_since_resolved":0.7786932850115741,"avg_bounty_low":400,"avg_bounty_high":500,"min_bounty":100,"scope_count":253},"scope":[{"asset":"*.amazon.ae","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.ca","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.cl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.cn","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.co.jp","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.co.uk","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.co.za","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.au","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.be","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.br","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.co","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.mx","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.ng","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.com.tr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.de","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.eg","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.es","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.fr","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.in","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.it","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.nl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.pl","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.sa","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.se","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.amazon.sg","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"1057338687","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"PN Seller\thttps://apps.apple.com/us/app/pn-seller/id1057338687"},{"asset":"1151746202","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/transparency/id1151746202"},{"asset":"1265170914","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Live Creator\thttps://apps.apple.com/us/app/amazon-live-creator/id1265170914"},{"asset":"1276296103","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Relay\nhttps://apps.apple.com/us/app/itunes-store/1276296103"},{"asset":"1324809509","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1454725763","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Flex\nhttps://apps.apple.com/us/app/itunes-store/1454725763"},{"asset":"1475021574","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music for Artists\nhttps://apps.apple.com/us/app/amazon-music-for-artists/id1475021574"},{"asset":"1478350915","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (IN)\nhttps://apps.apple.com/in/app/amazon-india-shop-pay-minitv/id1478350915"},{"asset":"1494755014","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopper Panel\thttps://apps.apple.com/us/app/amazon-shopper-panel/id1494755014"},{"asset":"1498197033","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Business\thttps://apps.apple.com/us/app/amazon-business-b2b-shopping/id1498197033"},{"asset":"1528364633","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"1532153219","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Freevee\nhttps://apps.apple.com/us/app/amazon-freevee-movies-live-tv/id1532153219"},{"asset":"1552455423","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Astro\nhttps://apps.apple.com/us/app/amazon-astro/id1552455423"},{"asset":"1579372261","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Business (IN)\nhttps://apps.apple.com/in/app/amazon-business-india-b2b/id1579372261"},{"asset":"1592204907","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Sidewalk Bridge Pro\thttps://apps.apple.com/us/app/amazon-sidewalk-bridge-pro/id1592204907"},{"asset":"1659883691","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Vendor Central (IN)\thttps://apps.apple.com/in/app/vendor-central-india/id1659883691"},{"asset":"297606951","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://apps.apple.com/us/app/amazon-shopping/id297606951"},{"asset":"302584613","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"335187483","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (UK)\thttps://apps.apple.com/gb/app/amazon/id335187483"},{"asset":"342576766","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (CN)\thttps://apps.apple.com/cn/app/%E4%BA%9A%E9%A9%AC%E9%80%8A%E8%B4%AD%E7%89%A9/id342576766"},{"asset":"348712880","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (DE)\thttps://apps.apple.com/de/app/amazon/id348712880"},{"asset":"358861688","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (FR)\thttps://apps.apple.com/fr/app/amazon-fr/id358861688"},{"asset":"374254473","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (JP)\thttps://apps.apple.com/jp/app/amazon-%E3%82%B7%E3%83%A7%E3%83%83%E3%83%94%E3%83%B3%E3%82%B0%E3%82%A2%E3%83%97%E3%83%AA/id374254473"},{"asset":"510855668","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music\thttps://apps.apple.com/us/app/amazon-music-songs-podcasts/id510855668"},{"asset":"545519333","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Prime Video\thttps://apps.apple.com/us/app/amazon-prime-video/id545519333"},{"asset":"621574163","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"6444868926","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Vendor\thttps://apps.apple.com/us/app/amazon-vendor/id6444868926"},{"asset":"6452192521","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon One\thttps://apps.apple.com/us/app/amazon-one/id6452192521"},{"asset":"6471528064","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Kids + Parents Dashbaord\nhttps://apps.apple.com/us/app/amazon-kids-parent-dashboard/id6471528064"},{"asset":"6479334468","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shipping\t-->\thttps://apps.apple.com/us/app/amazon-shipping/id6479334468"},{"asset":"6560104638","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Fire TV Recast|Blaster\t--> https://apps.apple.com/us/app/amazon-fire-tv-recast-blaster/id6560104638"},{"asset":"794141485","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Seller\nhttps://apps.apple.com/us/app/itunes-store/794141485"},{"asset":"944011620","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"947984433","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"988788863","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"Selling Services on Amazon\thttps://apps.apple.com/us/app/selling-services-on-amazon/id988788863"},{"asset":"Amazon Subsidiaries (Please only actively test explicitly stated scope)","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"Devices","type":"OTHER","bounty":true,"severity":"none","instruction":"Placeholder for the Rewards modal. Please view Devices scope items to detail active scope."},{"asset":"Echo Family Devices","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"FireTV","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"GenAI Apps under *.amazon.*","type":"AI_MODEL","bounty":true,"severity":"critical","instruction":"This is a catchall for any GenAI applications found under \\*.amazon.\\*. Rufus is an example of this."},{"asset":"Kindle E-Reader","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"Luna","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"Other Amazon Retail Assets (Please only actively test explicitly stated scope)","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"Other Amazon Retail Mobile Apps (Please only actively test explicitly stated scope)","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"Other Amazon Retail Sites (Please only actively test explicitly stated scope)","type":"OTHER","bounty":false,"severity":"critical","instruction":null},{"asset":"Services/Mobile/GenAI","type":"OTHER","bounty":true,"severity":"none","instruction":"Placeholder for the Rewards modal. Please view the scope page to active scope."},{"asset":"Tablets","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"Vega OS","type":"OTHER","bounty":true,"severity":"critical","instruction":"Devices must be purchased on Amazon or an authorized retailer, and must be running the latest available software."},{"asset":"amazon.speech.sim","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Alexa - Show Mode for L\nhttps://play.google.com/store/apps/details?id=amazon.speech.sim"},{"asset":"amazonpayinsurance.in","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.aba.application","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.amazon.aba.application"},{"asset":"com.amazon.amazonone.androidapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon One\nhttps://play.google.com/store/apps/details?id=com.amazon.amazonone.androidapp"},{"asset":"com.amazon.amazonvideo.livingroom","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Prime Video (TV) - Android TV https://play.google.com/store/apps/details?id=com.amazon.amazonvideo.livingroom\n\n**Android TV**: follow the documentation [here](https://developer.android.com/trai"},{"asset":"com.amazon.astro","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Astro\nhttps://play.google.com/store/apps/details?id=com.amazon.astro"},{"asset":"com.amazon.avod.thirdpartyclient","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Prime Video\nhttps://play.google.com/store/apps/details?id=com.amazon.avod.thirdpartyclient"},{"asset":"com.amazon.clouddrive.photos","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.dee.alexaonwearos","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.dee.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.enterprise.access.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"AEA - Amazon Employees\t-->\thttps://play.google.com/store/apps/details?id=com.amazon.enterprise.access.android"},{"asset":"com.amazon.firetv.recast.blaster.aosp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Fire TV Recast|Blaster\t-->\thttps://play.google.com/store/apps/details?id=com.amazon.firetv.recast.blaster.aosp"},{"asset":"com.amazon.flex.rabbit","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Flex\nhttps://play.google.com/store/apps/details?id=com.amazon.flex.rabbit"},{"asset":"com.amazon.helix.prod","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Hub Counter\nhttps://play.google.com/store/apps/details?id=com.amazon.helix.prod"},{"asset":"com.amazon.ihm.candycane","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Store Ops by Amazon\t-->\thttps://play.google.com/store/apps/details?id=com.amazon.ihm.candycane"},{"asset":"com.amazon.imdb.tv.mobile.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Freevee\nhttps://play.google.com/store/apps/details?id=com.amazon.imdb.tv.mobile.app"},{"asset":"com.amazon.kindle","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.kisan.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Kisan\nhttps://play.google.com/store/apps/details?id=com.amazon.kisan.app"},{"asset":"com.amazon.mShop.android.business.shopping","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Business\nhttps://play.google.com/store/apps/details?id=com.amazon.mShop.android.business.shopping"},{"asset":"com.amazon.mShop.android.shopping","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.amazon.mShop.android.shopping"},{"asset":"com.amazon.minitv.android.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon miniTV\nhttps://play.google.com/store/apps/details?id=com.amazon.minitv.android.app"},{"asset":"com.amazon.mp3","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music\nhttps://play.google.com/store/apps/details?id=com.amazon.mp3\n\nAmazon Music (Watch) is also in scope\n\n**wearOS**: follow the documentation [here](https://developer.android.com/training/wea"},{"asset":"com.amazon.mp3.automotiveOS","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music - Automotive\nhttps://play.google.com/store/apps/details?id=com.amazon.mp3.automotiveOS\n\n**Android Automotive (AAOS)**: follow the documentation [here](https://developer.android.com/traini"},{"asset":"com.amazon.music.tv","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music TV\nhttps://play.google.com/store/apps/details?id=com.amazon.music.tv\n\n**Android TV**: follow the documentation [here](https://developer.android.com/training/tv/get-started/create#run-on-a"},{"asset":"com.amazon.primenow.seller.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"PN Seller\thttps://play.google.com/store/apps/details?id=com.amazon.primenow.seller.android"},{"asset":"com.amazon.relay","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Relay\nhttps://play.google.com/store/apps/details?id=com.amazon.relay"},{"asset":"com.amazon.sellerflexmobile","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Seller Flex App\thttps://play.google.com/store/apps/details?id=com.amazon.sellerflexmobile"},{"asset":"com.amazon.sellermobile.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Seller\nhttps://play.google.com/store/apps/details?id=com.amazon.sellermobile.android"},{"asset":"com.amazon.sft.rangoli.seller.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"SmartBiz by Amazon Web Builder\nhttps://play.google.com/store/apps/details?id=com.amazon.sft.rangoli.seller.app"},{"asset":"com.amazon.shopperpanel.android.mobile.app","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopper Panel\thttps://play.google.com/store/apps/details?id=com.amazon.shopperpanel.android.mobile.app"},{"asset":"com.amazon.storm.lightning.client.aosp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.swa.mobileapp","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shipping --> https://play.google.com/store/apps/details?id=com.amazon.swa.mobileapp"},{"asset":"com.amazon.tahoe.freetime","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.tahoe.grownups","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Kids + Parent Dashboard\nhttps://play.google.com/store/apps/details?id=com.amazon.tahoe.grownups"},{"asset":"com.amazon.tails","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":null},{"asset":"com.amazon.technician.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Selling Services on Amazon\thttps://play.google.com/store/apps/details?id=com.amazon.technician.android"},{"asset":"com.amazon.vendormobile.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Vendor\thttps://play.google.com/store/apps/details?id=com.amazon.vendormobile.android"},{"asset":"com.amazon.vendormobile.india.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Vendor Central (IN)\thttps://play.google.com/store/apps/details?id=com.amazon.vendormobile.india.android"},{"asset":"com.amazon.warhol.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Live Creator\nhttps://play.google.com/store/apps/details?id=com.amazon.warhol.android"},{"asset":"com.amazon.ziggy.android","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Music for Artists\nhttps://play.google.com/store/apps/details?id=com.amazon.ziggy.android"},{"asset":"com.imdbtv.livingroom","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Freevee (TV) https://play.google.com/store/apps/details?id=com.imdbtv.livingroom\n\n**Android TV**: follow the documentation [here](https://developer.android.com/training/tv/get-started/create#ru"},{"asset":"com.localqueen","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"GlowRoad: Resell & Earn Online\nhttps://play.google.com/store/apps/details?id=com.localqueen"},{"asset":"https://www.amazonpay.in/*","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"in.amazon.mShop.android.business.shopping","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Business (IN)\nhttps://play.google.com/store/apps/details?id=in.amazon.mShop.android.business.shopping"},{"asset":"in.amazon.mShop.android.shopping","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"Amazon Shopping (IN)\nhttps://play.google.com/store/apps/details?id=in.amazon.mShop.android.shopping&hl=en_US"},{"asset":"primevideo.com/*","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"www.amazon.*","type":"URL","bounty":true,"severity":"critical","instruction":"All international retail marketplaces\n* Brazil: www.amazon.com.br\n* Canada: www.amazon.ca\n* Mexico: www.amazon.com.mx\n* United States: www.amazon.com\n* China: www.amazon.cn\n* India: www.amazon.in\n* Ja"}],"quality":{"confidence":"medium","signals_present":8,"signals_expected":10,"missing":["paid_total","paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.106,"label":"none","experimental":true}},"derived":{"novelty":0.1742,"inverse_crowd":0.2742,"payout_reliability":0.5133,"value_per_competition":0.1931,"triage_quality":0.4725,"scope_breadth":0.8907,"crowding_per_asset_month":2.2503,"slop_risk":0.106},"score":{"total":5.7,"parts":{"novelty":0.174,"inverse_crowd":0.274,"payout_reliability":0.513,"value_per_competition":0.193,"triage_quality":0.473,"scope_breadth":0.891},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":5.9},"reasons":[{"sign":"bad","text":"1,708 reports in 90 days across 253 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 6.5 years"}]},{"id":"hackerone:alsco","platform":"hackerone","slug":"alsco","name":"ALSCO","url":"https://hackerone.com/alsco","meta":{"reward_min":50,"reward_max":210,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-09-01T03:09:10.848Z","age_months":49.62966959876226,"reports_90d":130,"resolved_total":5,"response_efficiency":100,"response_indicator":"ok","paid_total":10000,"paid_90d":null,"last_resolved_at":"2025-12-18T07:52:37.729Z","days_since_resolved":306.40622951186344,"avg_bounty_low":200,"avg_bounty_high":210,"min_bounty":50,"scope_count":4},"scope":[{"asset":"sandbox-royal.securegateway.com","type":"URL","bounty":true,"severity":"critical","instruction":"Check [Royal CMS] Against Common Injection include [XSS Injection , SQL Injection ,SQLi Injection , OS Injection ,Command Injection, URL Injection , Remote Code Execution, and privilege escalation] th"},{"asset":"sandbox.securegateway.com","type":"URL","bounty":true,"severity":"critical","instruction":"1- Check if you can pass the two authentications provided by Secure Gateway mobile APP, Try any possible way to login without receiving the code, or try brute force the code or pass the rate limit.\n2-"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 306 days"},"slop":{"risk":0.79,"label":"elevated","experimental":true}},"derived":{"novelty":0.2081,"inverse_crowd":0.0542,"payout_reliability":0.5066,"value_per_competition":0.0457,"triage_quality":1.0,"scope_breadth":0.2589,"crowding_per_asset_month":10.8333,"slop_risk":0.79},"score":{"total":5.5,"parts":{"novelty":0.208,"inverse_crowd":0.054,"payout_reliability":0.507,"value_per_competition":0.046,"triage_quality":1.0,"scope_breadth":0.259},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15},{"reason":"slop risk","points":-10}],"percentile":5.4},"reasons":[{"sign":"good","text":"100% response efficiency"},{"sign":"neutral","text":"130 reports in 90 days across 4 assets"},{"sign":"bad","text":"nothing resolved for 306 days"},{"sign":"neutral","text":"running 4.1 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:github","platform":"hackerone","slug":"github","name":"GitHub","url":"https://hackerone.com/github","meta":{"reward_min":250,"reward_max":617,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-04-12T19:17:52.021Z","age_months":126.25643924930604,"reports_90d":1351,"resolved_total":2203,"response_efficiency":31,"response_indicator":"missed","paid_total":6704633,"paid_90d":251627,"last_resolved_at":"2026-10-13T23:12:17.369Z","days_since_resolved":6.767576271122685,"avg_bounty_low":617,"avg_bounty_high":617,"min_bounty":250,"scope_count":197},"scope":[{"asset":"*.github.net","type":"URL","bounty":true,"severity":"critical","instruction":"Subdomains under `*.github.net` run services for our internal production network. Many of these services are not accessible from outside our internal network. Not all subdomains are [in-scope](https:/"},{"asset":"*.githubapp.com","type":"URL","bounty":true,"severity":"critical","instruction":"Subdomains under `*.githubapp.com` provide a number of internal services to GitHub employees. Not all subdomains are [in-scope](https://bounty.github.com/#scope)"},{"asset":"*.githubusercontent.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"Copilot","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Copilot Chat on dotcom","type":"OTHER","bounty":true,"severity":"high","instruction":null},{"asset":"Copilot Coding Agent","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Copilot Spaces","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Copilot for Business","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"Dependabot","type":"OTHER","bounty":true,"severity":"critical","instruction":"Dependabot powers GitHub's [automated security fixes](https://help.github.com/en/articles/configuring-automated-security-fixes). This feature allows GitHub users to automatically update vulnerable dep"},{"asset":"GitHub CLI","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":"[GitHub CLI](https://cli.github.com) is an open source command line tool for working with your GitHub.com account. It is built with Golang, and performs several GitHub.com commands from your terminal,"},{"asset":"GitHub CSP","type":"OTHER","bounty":true,"severity":"high","instruction":"While content-injection vulnerabilities are already in-scope for our [GitHub.com bounty](https://bounty.github.com/targets/github.html), we also accept bounty reports for novel [CSP](https://developer"},{"asset":"GitHub Desktop","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"critical","instruction":"[GitHub Desktop](https://desktop.github.com) is an open-source [Electron](https://electronjs.org)-based app for working with your GitHub.com or GitHub Enterprise account. Only the following vulnerabil"},{"asset":"GitHub Enterprise Cloud","type":"OTHER","bounty":true,"severity":"critical","instruction":"GitHub Enterprise Cloud is the cloud-hosted version of GitHub Enterprise. It is designed for teams who want advanced authentication and permissions without managing infrastructure. More information ab"},{"asset":"GitHub Enterprise Cloud with Data Residency (GHEC-DR)","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"GitHub Enterprise Server","type":"HARDWARE","bounty":true,"severity":"critical","instruction":"GitHub Enterprise Server is the on-premise version of GitHub Enterprise. GitHub Enterprise Server shares a code-base with GitHub.com, is built on Ruby on Rails and leverages a number of open source te"},{"asset":"GitHub Pages","type":"OTHER","bounty":true,"severity":"critical","instruction":"GitHub Pages is our static site hosting service designed to host your personal, organization, or project pages directly from a GitHub repository. It uses the Jekyll static site generator and officiall"},{"asset":"GitHub Production Credentials","type":"OTHER","bounty":true,"severity":"critical","instruction":"GitHub, Inc. uses a mix of our own physical infrastructure, cloud platforms and third-party services to keep everything running smoothly. Keeping credentials and access tokens secure for these resourc"},{"asset":"GitHub Spark","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"GitHub for mobile","type":"OTHER","bounty":true,"severity":"critical","instruction":"Bring GitHub collaboration tools to your small screens with [GitHub for mobile](https://github.com/mobile)."},{"asset":"api.github.com","type":"URL","bounty":true,"severity":"critical","instruction":"The GitHub API is used by thousands of developers and applications to programatically interact with GitHub data and services. Because so much of the GitHub.com functionality is exposed in the API, sec"},{"asset":"classroom.github.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"education.github.com","type":"URL","bounty":true,"severity":"critical","instruction":"GitHub Education offers a variety of tools to help educators and researchers work more effectively inside and outside of the classroom. More details are available at https://education.github.com/. Git"},{"asset":"gist.github.com","type":"URL","bounty":true,"severity":"critical","instruction":"Gist is one of the first products launched by GitHub after GitHub.com. It is a service for sharing snippets of code or other text content. Gist is built on Ruby on Rails and leverages a number of Open"},{"asset":"github.com","type":"URL","bounty":true,"severity":"critical","instruction":"GitHub.com is our main web site. It is our most intricate application with a number of user inputs and access methods. GitHub.com is built on Ruby on Rails and leverages a number of Open Source techno"},{"asset":"npm CLI","type":"DOWNLOADABLE_EXECUTABLES","bounty":true,"severity":"high","instruction":null},{"asset":"npmjs.com","type":"URL","bounty":true,"severity":"critical","instruction":"This is the domain for npm’s public-facing websites. All subdomains under npmjs.com are in scope."},{"asset":"npmjs.org","type":"URL","bounty":true,"severity":"critical","instruction":"This is the domain for npm’s registry, public-facing databases, and APIs. All subdomains under npmjs.org are in scope."}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 31%"},"slop":{"risk":0.107,"label":"none","experimental":true}},"derived":{"novelty":0.1439,"inverse_crowd":0.2705,"payout_reliability":0.6405,"value_per_competition":0.1975,"triage_quality":0.2325,"scope_breadth":0.8507,"crowding_per_asset_month":2.286,"slop_risk":0.107},"score":{"total":4.9,"parts":{"novelty":0.144,"inverse_crowd":0.27,"payout_reliability":0.641,"value_per_competition":0.197,"triage_quality":0.232,"scope_breadth":0.851},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20}],"percentile":5.0},"reasons":[{"sign":"good","text":"paid $252k in the last 90 days"},{"sign":"bad","text":"response efficiency only 31%"},{"sign":"bad","text":"1,351 reports in 90 days across 197 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.5 years"}]},{"id":"hackerone:tron_dao","platform":"hackerone","slug":"tron_dao","name":"TRON DAO","url":"https://hackerone.com/tron_dao","meta":{"reward_min":50,"reward_max":500,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2023-01-26T16:31:42.582Z","age_months":44.78179077375656,"reports_90d":1088,"resolved_total":30,"response_efficiency":83,"response_indicator":"ok","paid_total":117450,"paid_90d":14600,"last_resolved_at":"2026-09-08T10:03:33.426Z","days_since_resolved":42.315307092881945,"avg_bounty_low":500,"avg_bounty_high":500,"min_bounty":50,"scope_count":1},"scope":[{"asset":"https://github.com/tronprotocol/java-tron","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Pays, slowly","why":"83% response, pays, last resolved 42d ago"},"slop":{"risk":1.0,"label":"elevated","experimental":true}},"derived":{"novelty":0.2166,"inverse_crowd":0.0008,"payout_reliability":0.84,"value_per_competition":0.0017,"triage_quality":0.83,"scope_breadth":0.1115,"crowding_per_asset_month":362.6667,"slop_risk":1.0},"score":{"total":3.2,"parts":{"novelty":0.217,"inverse_crowd":0.001,"payout_reliability":0.84,"value_per_competition":0.002,"triage_quality":0.83,"scope_breadth":0.111},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":4.5},"reasons":[{"sign":"good","text":"paid $15k in the last 90 days"},{"sign":"good","text":"83% response efficiency"},{"sign":"bad","text":"1,088 reports in 90 days across 1 assets"},{"sign":"neutral","text":"running 3.7 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:blend-labs","platform":"hackerone","slug":"blend-labs","name":"Blend Labs","url":"https://hackerone.com/blend-labs","meta":{"reward_min":50,"reward_max":750,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2022-09-13T15:14:29.685Z","age_months":49.2188707406742,"reports_90d":58,"resolved_total":13,"response_efficiency":86,"response_indicator":"ok","paid_total":21150,"paid_90d":0,"last_resolved_at":"2025-01-23T21:21:12.231Z","days_since_resolved":634.8447190720486,"avg_bounty_low":750,"avg_bounty_high":750,"min_bounty":50,"scope_count":1},"scope":[{"asset":"knox.beta.blendlabs.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"nothing resolved in 635 days"},"slop":{"risk":0.778,"label":"elevated","experimental":true}},"derived":{"novelty":0.2088,"inverse_crowd":0.0278,"payout_reliability":0.4302,"value_per_competition":0.0329,"triage_quality":0.86,"scope_breadth":0.1115,"crowding_per_asset_month":19.3333,"slop_risk":0.778},"score":{"total":0.4,"parts":{"novelty":0.209,"inverse_crowd":0.028,"payout_reliability":0.43,"value_per_competition":0.033,"triage_quality":0.86,"scope_breadth":0.111},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"dormant","points":-15},{"reason":"slop risk","points":-10}],"percentile":4.1},"reasons":[{"sign":"good","text":"86% response efficiency"},{"sign":"neutral","text":"58 reports in 90 days across 1 assets"},{"sign":"bad","text":"nothing resolved for 635 days"},{"sign":"neutral","text":"running 4.1 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:phabricator","platform":"hackerone","slug":"phabricator","name":"Phabricator","url":"https://hackerone.com/phabricator","meta":{"reward_min":300,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2013-12-03T19:32:50.696Z","age_months":154.54357185444712,"reports_90d":40,"resolved_total":56,"response_efficiency":10,"response_indicator":"failed","paid_total":20950,"paid_90d":0,"last_resolved_at":"2022-05-31T18:00:14.608Z","days_since_resolved":1602.984274893808,"avg_bounty_low":300,"avg_bounty_high":300,"min_bounty":300,"scope_count":null},"scope":[],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["scope_count"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"triage marked failed, response efficiency 10%, nothing resolved in 1603 days"},"slop":{"risk":0.509,"label":"watch","experimental":true}},"derived":{"novelty":0.1328,"inverse_crowd":0.0428,"payout_reliability":0.05,"value_per_competition":0.0402,"triage_quality":0.05,"scope_breadth":0.0,"crowding_per_asset_month":13.3333,"slop_risk":0.509},"score":{"total":0.0,"parts":{"novelty":0.133,"inverse_crowd":0.043,"payout_reliability":0.05,"value_per_competition":0.04,"triage_quality":0.05,"scope_breadth":0.0},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"triage failing","points":-25},{"reason":"dormant","points":-15}],"percentile":3.6},"reasons":[{"sign":"bad","text":"response efficiency only 10%"},{"sign":"neutral","text":"40 reports in 90 days"},{"sign":"bad","text":"nothing resolved for 1603 days"},{"sign":"neutral","text":"running 12.9 years"}]},{"id":"hackerone:automattic","platform":"hackerone","slug":"automattic","name":"Automattic","url":"https://hackerone.com/automattic","meta":{"reward_min":0,"reward_max":150,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2014-04-14T14:29:04.170Z","age_months":150.21374697270704,"reports_90d":1356,"resolved_total":null,"response_efficiency":60,"response_indicator":"missed","paid_total":260000,"paid_90d":25000,"last_resolved_at":"2026-10-20T16:31:51.838Z","days_since_resolved":0.04564954658564815,"avg_bounty_low":100,"avg_bounty_high":150,"min_bounty":0,"scope_count":45},"scope":[{"asset":"*.srvcs.tumblr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":null},{"asset":"*.tumblr.com","type":"WILDCARD","bounty":true,"severity":"critical","instruction":"**The Blog Network**\n\n*Note: Blogs are cached for 1 minute after first request (60s from first request); content is re-loaded into cache when a new request is submitted after the 61st second.*\n\nHow to"},{"asset":"Beeper","type":"OTHER","bounty":true,"severity":"high","instruction":"Beeper apps across all the available platforms are eligible."},{"asset":"Crowdsignal","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any issues on https://crowdsignal.com/, and or Crowdsignal WordPress plugins"},{"asset":"Jetpack","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":"Any issues related to the Jetpack plugin https://github.com/Automattic/jetpack and/or https://jetpack.com/"},{"asset":"Texts","type":"OTHER","bounty":true,"severity":"high","instruction":"Texts apps (texts.com) across all the available platforms are included."},{"asset":"WP Cloud","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any issue affecting the WP Cloud hosting environment allowing cross-site access/impact, the WP Cloud API or the wp.cloud website."},{"asset":"WooCommerce","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any security issues on the WordPress WooCommerce plugin (https://wordpress.org/plugins/woocommerce/) and/or https://woocommerce.com/"},{"asset":"WordPress Plugins & Themes","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any security issue found on any WordPress plugin or theme that's **maintained/created by Automattic**.\n\nThis includes but is not limited to\n- WP-Supercache (https://wordpress.org/plugins/wp-super-cach"},{"asset":"WordPress VIP","type":"OTHER","bounty":true,"severity":"critical","instruction":"Any issue in the WordPress VIP infrastructure, WordPress plugins, or client sites."},{"asset":"akismet.com","type":"URL","bounty":true,"severity":"critical","instruction":"Any issues on https://akismet.com/, or the Akismet WordPress plugin."},{"asset":"api.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"assets.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"clay.earth","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"com.clay.ios","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"Clay: Contacts + CRM (iOS app)."},{"asset":"com.tumblr","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"high","instruction":"- Minimum OS version: API 21\n\nExclusions:\n- API keys in code\n- Certificate pinning"},{"asset":"com.tumblr.tumblr","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"high","instruction":"- Minimum OS version: iOS 11\n\nExclusions:\n- API keys in code\n- Certificate pinning"},{"asset":"embed.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"gravatar.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"intensedebate.com","type":"URL","bounty":true,"severity":"medium","instruction":null},{"asset":"mailpoet.com","type":"URL","bounty":true,"severity":"critical","instruction":"Any issue in https://www.mailpoet.com/, or the MailPoet WordPress plugin."},{"asset":"my.pressable.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"parse.ly","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"safe.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"secure.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"simperium.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"simplenote.com","type":"URL","bounty":true,"severity":"high","instruction":null},{"asset":"t.umblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wordpress.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"wpscan.com","type":"URL","bounty":true,"severity":"high","instruction":"WPScan.com - valid vulnerabilities in the site itself or the submission platform."},{"asset":"www.tumblr.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.762,"label":"elevated","experimental":true}},"derived":{"novelty":0.1343,"inverse_crowd":0.0591,"payout_reliability":0.7999,"value_per_competition":0.0459,"triage_quality":0.45,"scope_breadth":0.6159,"crowding_per_asset_month":10.0444,"slop_risk":0.762},"score":{"total":0.0,"parts":{"novelty":0.134,"inverse_crowd":0.059,"payout_reliability":0.8,"value_per_competition":0.046,"triage_quality":0.45,"scope_breadth":0.616},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20},{"reason":"slop risk","points":-10}],"percentile":3.2},"reasons":[{"sign":"good","text":"paid $25k in the last 90 days"},{"sign":"bad","text":"1,356 reports in 90 days across 45 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 12.5 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:gitlab","platform":"hackerone","slug":"gitlab","name":"GitLab","url":"https://hackerone.com/gitlab","meta":{"reward_min":100,"reward_max":1370,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-02-06T01:31:16.454Z","age_months":128.4491518384763,"reports_90d":4580,"resolved_total":2278,"response_efficiency":72,"response_indicator":"missed","paid_total":7572927,"paid_90d":597800,"last_resolved_at":"2026-10-19T14:03:29.202Z","days_since_resolved":1.1486893151041666,"avg_bounty_low":1000,"avg_bounty_high":1370,"min_bounty":100,"scope_count":63},"scope":[{"asset":"*.gitlab.net","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Hosts owned and operated by GitLab."},{"asset":"*.gitlab.org","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Hosts owned and operated by GitLab."},{"asset":"*.gitlap.com","type":"WILDCARD","bounty":true,"severity":"medium","instruction":"Hosts owned and operated by GitLab. gitla**p** with a p!"},{"asset":"GitLab for Jira Cloud","type":"OTHER","bounty":true,"severity":"medium","instruction":null},{"asset":"Other non-production infrastructure","type":"OTHER","bounty":true,"severity":"medium","instruction":"Hosts owned and operated by GitLab other than gitlab.com itself and our static websites."},{"asset":"Your Own GitLab Instance","type":"OTHER","bounty":true,"severity":"critical","instruction":null},{"asset":"about.gitlab.com","type":"URL","bounty":true,"severity":"medium","instruction":"There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable."},{"asset":"advisories.gitlab.com","type":"URL","bounty":true,"severity":"medium","instruction":"There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable."},{"asset":"customers.gitlab.com","type":"URL","bounty":true,"severity":"critical","instruction":"Server-side Denial of Service is out of scope as per our Policy."},{"asset":"design.gitlab.com","type":"URL","bounty":true,"severity":"medium","instruction":"There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable."},{"asset":"docs.gitlab.com","type":"URL","bounty":true,"severity":"medium","instruction":"There is no user data therefore no confidentiality impact is possible, however we want to know if you can modify the content or make it unavailable."},{"asset":"gitlab.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitaly","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitlab","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitlab-pages","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitlab-runner","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitlab-shell","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://gitlab.com/gitlab-org/gitlab-vscode-extension","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"registry.gitlab.com","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"yellow","label":"Missed targets","why":"blowing its own stated response targets"},"slop":{"risk":0.68,"label":"elevated","experimental":true}},"derived":{"novelty":0.1429,"inverse_crowd":0.0213,"payout_reliability":0.8575,"value_per_competition":0.0289,"triage_quality":0.54,"scope_breadth":0.669,"crowding_per_asset_month":24.2328,"slop_risk":0.68},"score":{"total":0.0,"parts":{"novelty":0.143,"inverse_crowd":0.021,"payout_reliability":0.857,"value_per_competition":0.029,"triage_quality":0.54,"scope_breadth":0.669},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"crowd wall","points":-20},{"reason":"premium crowding","points":-10},{"reason":"slop risk","points":-10}],"percentile":2.7},"reasons":[{"sign":"good","text":"paid $598k in the last 90 days"},{"sign":"bad","text":"4,580 reports in 90 days across 63 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 10.7 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:torproject","platform":"hackerone","slug":"torproject","name":"Tor","url":"https://hackerone.com/torproject","meta":{"reward_min":100,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2017-07-20T12:55:07.772Z","age_months":111.02081838422123,"reports_90d":92,"resolved_total":80,"response_efficiency":16,"response_indicator":"failed","paid_total":22050,"paid_90d":1600,"last_resolved_at":"2026-10-11T05:19:19.270Z","days_since_resolved":9.51269315769676,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":100,"scope_count":7},"scope":[{"asset":"Tor Browser","type":"OTHER","bounty":true,"severity":"critical","instruction":"https://gitlab.torproject.org/tpo/applications/tor-browser\n\nIt's a good start to look at the latest stable, alpha, and nightly builds. The former can be found at https://www.torproject.org/download/ a"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"triage marked failed, response efficiency 16%"},"slop":{"risk":0.204,"label":"none","experimental":true}},"derived":{"novelty":0.1515,"inverse_crowd":0.1452,"payout_reliability":0.5599,"value_per_competition":0.1071,"triage_quality":0.08,"scope_breadth":0.3345,"crowding_per_asset_month":4.381,"slop_risk":0.204},"score":{"total":0.0,"parts":{"novelty":0.151,"inverse_crowd":0.145,"payout_reliability":0.56,"value_per_competition":0.107,"triage_quality":0.08,"scope_breadth":0.334},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"triage failing","points":-25}],"percentile":2.3},"reasons":[{"sign":"good","text":"paid $2k in the last 90 days"},{"sign":"bad","text":"response efficiency only 16%"},{"sign":"neutral","text":"92 reports in 90 days across 7 assets"},{"sign":"good","text":"resolved a report in the last month"},{"sign":"neutral","text":"running 9.3 years"}]},{"id":"hackerone:discourse","platform":"hackerone","slug":"discourse","name":"Discourse","url":"https://hackerone.com/discourse","meta":{"reward_min":256,"reward_max":512,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2016-12-17T02:18:07.320Z","age_months":118.09900701149327,"reports_90d":370,"resolved_total":285,"response_efficiency":36,"response_indicator":"missed","paid_total":118138,"paid_90d":0,"last_resolved_at":"2026-08-27T02:55:12.140Z","days_since_resolved":54.612775680844905,"avg_bounty_low":256,"avg_bounty_high":512,"min_bounty":256,"scope_count":2},"scope":[{"asset":"https://github.com/discourse/discourse","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"try.discourse.org","type":"URL","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"response efficiency 36%"},"slop":{"risk":0.652,"label":"elevated","experimental":true}},"derived":{"novelty":0.1478,"inverse_crowd":0.0071,"payout_reliability":0.289,"value_per_competition":0.0101,"triage_quality":0.27,"scope_breadth":0.1767,"crowding_per_asset_month":61.6667,"slop_risk":0.652},"score":{"total":0.0,"parts":{"novelty":0.148,"inverse_crowd":0.007,"payout_reliability":0.289,"value_per_competition":0.01,"triage_quality":0.27,"scope_breadth":0.177},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"missing response targets","points":-10},{"reason":"slop risk","points":-10}],"percentile":1.8},"reasons":[{"sign":"bad","text":"response efficiency only 36%"},{"sign":"neutral","text":"370 reports in 90 days across 2 assets"},{"sign":"neutral","text":"running 9.8 years"},{"sign":"bad","text":"report flood vs resolution — slop risk (experimental)"}]},{"id":"hackerone:yoti","platform":"hackerone","slug":"yoti","name":"Yoti","url":"https://hackerone.com/yoti","meta":{"reward_min":100,"reward_max":300,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2020-11-04T10:34:59.705Z","age_months":71.50040164796754,"reports_90d":30,"resolved_total":118,"response_efficiency":10,"response_indicator":"failed","paid_total":60925,"paid_90d":0,"last_resolved_at":"2024-06-27T11:16:24.057Z","days_since_resolved":845.2647210859375,"avg_bounty_low":200,"avg_bounty_high":300,"min_bounty":100,"scope_count":18},"scope":[{"asset":"983980808","type":"APPLE_STORE_APP_ID","bounty":true,"severity":"critical","instruction":"https://itunes.apple.com/us/app/yoti/id983980808"},{"asset":"api.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"ccloud.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"code.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"com.yoti.mobile.android.live","type":"GOOGLE_PLAY_APP_ID","bounty":true,"severity":"critical","instruction":"https://play.google.com/store/apps/details?id=com.yoti.mobile.android.live"},{"asset":"core.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"hub.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":"you must use \"[Hackerone] <whatever name here>\" when creating any organisation/application/service within Hub!"},{"asset":"identity.yoti.com","type":"URL","bounty":true,"severity":"critical","instruction":null},{"asset":"www.yotisign.com","type":"URL","bounty":true,"severity":"critical","instruction":"You must use \"[Hackerone] ORG_NAME\" when registering an organisation!"}],"quality":{"confidence":"high","signals_present":10,"signals_expected":10,"missing":[],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"triage marked failed, response efficiency 10%, nothing resolved in 845 days"},"slop":{"risk":0.03,"label":"none","experimental":true}},"derived":{"novelty":0.1802,"inverse_crowd":0.6694,"payout_reliability":0.05,"value_per_competition":0.3705,"triage_quality":0.05,"scope_breadth":0.4736,"crowding_per_asset_month":0.5556,"slop_risk":0.03},"score":{"total":0.0,"parts":{"novelty":0.18,"inverse_crowd":0.669,"payout_reliability":0.05,"value_per_competition":0.37,"triage_quality":0.05,"scope_breadth":0.474},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"triage failing","points":-25},{"reason":"dormant","points":-15}],"percentile":1.4},"reasons":[{"sign":"bad","text":"response efficiency only 10%"},{"sign":"neutral","text":"30 reports in 90 days across 18 assets"},{"sign":"bad","text":"nothing resolved for 845 days"},{"sign":"neutral","text":"running 6.0 years"}]},{"id":"hackerone:chainlink","platform":"hackerone","slug":"chainlink","name":"Chainlink","url":"https://hackerone.com/chainlink","meta":{"reward_min":50,"reward_max":250,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2019-05-09T20:48:59.901Z","age_months":89.39193705142026,"reports_90d":476,"resolved_total":138,"response_efficiency":16,"response_indicator":"failed","paid_total":310000,"paid_90d":null,"last_resolved_at":"2026-09-11T13:14:24.382Z","days_since_resolved":39.18277287991898,"avg_bounty_low":200,"avg_bounty_high":250,"min_bounty":50,"scope_count":29},"scope":[{"asset":"*.smartcontract.com","type":"WILDCARD","bounty":false,"severity":"none","instruction":null},{"asset":"Faucets","type":"OTHER","bounty":true,"severity":"high","instruction":"Chainlink Testnet Faucet is available at the following URL: https://faucets.chain.link/"},{"asset":"chain.link","type":"URL","bounty":false,"severity":"medium","instruction":"The focus of this program should be on the code residing on our Github repository. While reports on the domain and email are useful, we will no longer reward bounties for these reports."},{"asset":"https://github.com/smartcontractkit/chainlink","type":"SOURCE_CODE","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null},{"asset":"https://github.com/smartcontractkit/external-adapters-js/","type":"SOURCE_CODE","bounty":true,"severity":"high","instruction":null},{"asset":"https://github.com/smartcontractkit/staking-v0.1/tree/master/contracts","type":"SMART_CONTRACT","bounty":true,"severity":"critical","instruction":null}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["paid_90d"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"triage marked failed, response efficiency 16%"},"slop":{"risk":0.335,"label":"none","experimental":true}},"derived":{"novelty":0.165,"inverse_crowd":0.1151,"payout_reliability":0.2094,"value_per_competition":0.0862,"triage_quality":0.08,"scope_breadth":0.5471,"crowding_per_asset_month":5.4713,"slop_risk":0.335},"score":{"total":0.0,"parts":{"novelty":0.165,"inverse_crowd":0.115,"payout_reliability":0.209,"value_per_competition":0.086,"triage_quality":0.08,"scope_breadth":0.547},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"triage failing","points":-25}],"percentile":0.9},"reasons":[{"sign":"bad","text":"response efficiency only 16%"},{"sign":"neutral","text":"476 reports in 90 days across 29 assets"},{"sign":"neutral","text":"running 7.4 years"}]},{"id":"hackerone:netscaler_public_program","platform":"hackerone","slug":"netscaler_public_program","name":"NetScaler Public Program","url":"https://hackerone.com/netscaler_public_program","meta":{"reward_min":50,"reward_max":0,"tags":[],"vdp":false,"submission_state":"open","team_state":"public_mode"},"signals":{"launched_at":"2025-09-11T12:15:35.018Z","age_months":13.280447540050574,"reports_90d":25,"resolved_total":null,"response_efficiency":22,"response_indicator":"failed","paid_total":1600,"paid_90d":0,"last_resolved_at":"2025-11-04T08:50:43.249Z","days_since_resolved":350.36588784519677,"avg_bounty_low":0,"avg_bounty_high":0,"min_bounty":50,"scope_count":5},"scope":[{"asset":"NetScaler AAA","type":"OTHER","bounty":true,"severity":"critical","instruction":"Critical\n\nRemote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise\nService key compromise, e.g., taking"},{"asset":"NetScaler ADC","type":"OTHER","bounty":true,"severity":"critical","instruction":"Critical\n\nRemote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise\nService key compromise, e.g., taking"},{"asset":"NetScaler Gateway","type":"OTHER","bounty":true,"severity":"critical","instruction":"Critical\n\nRemote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise\nService key compromise, e.g., taking"}],"quality":{"confidence":"high","signals_present":9,"signals_expected":10,"missing":["resolved_total"],"sources":["hackerone"]},"badges":{"will_pay":{"tier":"red","label":"Risky","why":"triage marked failed, response efficiency 22%, nothing resolved in 350 days"},"slop":{"risk":0.46,"label":"watch","experimental":true}},"derived":{"novelty":0.3452,"inverse_crowd":0.3514,"payout_reliability":0.1141,"value_per_competition":0.0,"triage_quality":0.11,"scope_breadth":0.2882,"crowding_per_asset_month":1.6667,"slop_risk":0.46},"score":{"total":0.0,"parts":{"novelty":0.345,"inverse_crowd":0.351,"payout_reliability":0.114,"value_per_competition":0.0,"triage_quality":0.11,"scope_breadth":0.288},"weights":{"novelty":0.22,"inverse_crowd":0.22,"payout_reliability":0.22,"value_per_competition":0.16,"triage_quality":0.11,"scope_breadth":0.07},"penalties":[{"reason":"triage failing","points":-25},{"reason":"dormant","points":-15}],"percentile":0.5},"reasons":[{"sign":"bad","text":"response efficiency only 22%"},{"sign":"neutral","text":"25 reports in 90 days across 5 assets"},{"sign":"bad","text":"nothing resolved for 350 days"},{"sign":"neutral","text":"running 1.1 years"}]}]}