Arkose Labs

{
  "id": 0,
  "url": "https://hackerone.com/arkose_labs",
  "name": "Arkose Labs",
  "handle": "arkose_labs",
  "targets": {
    "in_scope": [
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "cdn.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Core product asset. It serves the client-side scripts and API that customer sites load to run Arkose. Paid at the core bounty tier.\n\nBefore testing, read our developer docs: https://developer.arkoselabs.com/docs/client-api",
        "max_severity": "critical",
        "asset_identifier": "client-api.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "customer-sessions.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "This web app is mainly a Marketing based site. Vulnerabilities on this asset will be awarded with lower bounties.",
        "max_severity": "critical",
        "asset_identifier": "demo.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Core product asset that delivers the Arkose challenge inside an iframe on customer sites. Paid at the core bounty tier.\n\nBefore testing, read our developer docs to see how the product is integrated: https://developer.arkoselabs.com/docs (see Iframe Setup Guide and Client API).",
        "max_severity": "critical",
        "asset_identifier": "iframe.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Core product asset. This is the Arkose Command Center, the customer portal for dashboards, keys and user management. Paid at the core bounty tier.\n\nBefore testing, read our developer docs: https://developer.arkoselabs.com/docs/arkose-labs-command-center",
        "max_severity": "critical",
        "asset_identifier": "portal.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Core product asset. This is the server-side API customers call to confirm that a session token is valid. Paid at the core bounty tier.\n\nBefore testing, read our developer docs to see how the API works: https://developer.arkoselabs.com/docs/verify-api-v4",
        "max_severity": "critical",
        "asset_identifier": "verify.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Public marketing site. No customer data or product functionality is hosted here. Paid at the non-core bounty tier.\n\nOf interest: issues that let you change site content, inject script that runs for other visitors, or reach admin or backend functions.",
        "max_severity": "critical",
        "asset_identifier": "www.arkoselabs.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "URL",
        "instruction": "This site is managed by a 3rd party provider.",
        "max_severity": "none",
        "asset_identifier": "developer.arkoselabs.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://status.arkoselabs.com/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://www.arkoselabs.com/",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 0,
  "response_efficiency_percentage": 78,
  "average_time_to_report_resolved": 94,
  "average_time_to_first_program_response": 19
}