Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
9 in-scope
*.kiwi.comscope· critical*.skypicker.comscope· criticalauth.skypicker.com· criticalwww.kiwi.com/stories· highjobs.kiwi.com· mediumtequila.kiwi.com· criticalwww.kiwi.com· criticalcom.skypicker.Skypicker· criticalcom.skypicker.main· critical*._domainkey.kiwi.com*.coupons.kiwi.com*_domainkey.skypicker.com*cars.kiwi.com*citi-sign.kiwi.com*code.kiwi.com*experiences.kiwi.com*learn.kiwi.com*ov.kiwi.com*parking.kiwi.com*sg.kiwi.comemail*kiwi.comemail*skypicker.com− removed 10 scopes
22d ago
first indexed
92d ago · 19 in-scope assets
No reports yet. Be the first to share your triage timing for Kiwi.com.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/kiwicom",
"name": "Kiwi.com",
"handle": "kiwicom",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Mostly branded versions of our main www.kiwi.com site, please report vulnerabilities only for www.kiwi.com and don't duplicate it here.",
"max_severity": "critical",
"asset_identifier": "*.kiwi.com",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "WILDCARD",
"instruction": "APIs & internal tools.",
"max_severity": "critical",
"asset_identifier": "*.skypicker.com",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "URL",
"instruction": "Authentication API used on www.kiwi.com.",
"max_severity": "critical",
"asset_identifier": "auth.skypicker.com",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "**Primary target** - Available in [App Store](https://itunes.apple.com/bs/app/kiwi-com-cheap-flight-tickets/id657843853)",
"max_severity": "critical",
"asset_identifier": "com.skypicker.Skypicker",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "**Primary target** - Available in the [Play Store](https://play.google.com/store/apps/details?id=com.skypicker.main)",
"max_severity": "critical",
"asset_identifier": "com.skypicker.main",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "medium"
},
{
"asset_type": "URL",
"instruction": "Online travel magazine Kiwi.com Stories, with very limited impact on our sites & infrastructure.",
"max_severity": "high",
"asset_identifier": "http://www.kiwi.com/stories",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "low"
},
{
"asset_type": "URL",
"instruction": "Hiring page, no sensitive information, likely no impact on our company.",
"max_severity": "medium",
"asset_identifier": "jobs.kiwi.com",
"eligible_for_bounty": true,
"integrity_requirement": "low",
"eligible_for_submission": true,
"availability_requirement": "low",
"confidentiality_requirement": "low"
},
{
"asset_type": "URL",
"instruction": "B2B platform. Backend API requests are proxied via **tequila-api.kiwi.com** & **api.tequila.kiwi.com**",
"max_severity": "critical",
"asset_identifier": "tequila.kiwi.com",
"eligible_for_bounty": true,
"integrity_requirement": "medium",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "Our main website",
"max_severity": "critical",
"asset_identifier": "www.kiwi.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
}
],
"out_of_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Out of scope, 3rd party assets that are under our domains.",
"max_severity": "none",
"asset_identifier": "*._domainkey.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Managed by third party.",
"max_severity": "none",
"asset_identifier": "*.coupons.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "*_domainkey.skypicker.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "**3rd-party target** - Operated by [rentalcars.com](https://rentalcars.com).",
"max_severity": "none",
"asset_identifier": "*cars.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "*citi-sign.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "**3rd-party target** - Hosted on [medium.com](https://medium.com) (see [this help page](https://help.medium.com/hc/en-us/articles/213481308-Bug-Bounty-Disclosure-Program)).",
"max_severity": "none",
"asset_identifier": "*code.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope, managed by a third party.",
"max_severity": "none",
"asset_identifier": "*experiences.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "**3rd-party target** - Operated by [northpass.com](https://www.northpass.com).",
"max_severity": "none",
"asset_identifier": "*learn.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope, 3rd party assets that are under our domains.",
"max_severity": "none",
"asset_identifier": "*ov.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "**3rd-party target** - Operated by [travelcar.com](https://travelcar.com).",
"max_severity": "none",
"asset_identifier": "*parking.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope, 3rd party assets that are under our domains.",
"max_severity": "none",
"asset_identifier": "*sg.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "email*kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "email*skypicker.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Out of scope, 3rd party asset hosted under our domain.",
"max_severity": "none",
"asset_identifier": "kiwistore.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.",
"max_severity": "none",
"asset_identifier": "link.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "mail.skypicker.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "nyrujhhu3yuk.nest.skypicker.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Out of scope, 3rd party assets that are under our domains.",
"max_severity": "none",
"asset_identifier": "outbound.intercom.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Out of scope: 3rd party asset that is linked under our domain.\n",
"max_severity": "none",
"asset_identifier": "packages.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "**3rd-party target** - Operated by [retool.com](https://retool.com). Please contact retool directly on security@retool.com.",
"max_severity": "none",
"asset_identifier": "retool.skypicker.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "**3rd-party target** - Operated by [booking.com](https://booking.com) (see https://hackerone.com/bookingcom).",
"max_severity": "none",
"asset_identifier": "rooms.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "**3rd-party target** - Hosted on [statuspage.io](https://statuspage.io) (see https://bugcrowd.com/statuspage).",
"max_severity": "none",
"asset_identifier": "status.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "3rd party, out of scope.",
"max_severity": "none",
"asset_identifier": "vacation.kiwi.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://www.kiwi.com",
"offers_swag": true,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 280,
"response_efficiency_percentage": 83,
"average_time_to_report_resolved": 1050,
"average_time_to_first_program_response": 37
}