KOHO

{
  "id": 0,
  "url": "https://hackerone.com/koho",
  "name": "KOHO",
  "handle": "koho",
  "targets": {
    "in_scope": [
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "iOS Mobile app. Client-side SDK keys and custom-scheme deep links without demonstrated impact are not vulnerabilities; see the policy's \"False positives\" section.",
        "max_severity": "critical",
        "asset_identifier": "1091010942",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Our app API gateway.",
        "max_severity": "critical",
        "asset_identifier": "app.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "low",
        "asset_identifier": "assets.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "Android Mobile app. **Known issues, do not re-report:** exported `CropImageActivity` (tracked, being fixed); client-side SDK keys (LaunchDarkly, Kustomer, Firebase, Braze) without demonstrated data access; `koho://` deep-link hijacking. See the policy's \"Known issues\" and \"False positives\" sections.",
        "max_severity": "critical",
        "asset_identifier": "ca.koho",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "low",
        "asset_identifier": "clicks.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": "none",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "Our main API gateway. **Known issues, do not re-report:** the unauthenticated `/1.0/users/users/{ref}/flags/hash` LaunchDarkly hash endpoint; obtaining a session or creating an account before SMS verification completes (by design). See the policy's \"Known issues\" and \"Out of scope\" sections.",
        "max_severity": "critical",
        "asset_identifier": "http://api.koho.ca/1.0",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Used for API calls to/for our partners",
        "max_severity": "critical",
        "asset_identifier": "http://api.koho.ca/partner",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Central authentication endpoint for customers. Second-factor (2SV / MFA) requirements intentionally differ between web, mobile and pre-registration login flows; read the policy's \"Out of scope\" section before reporting a 2SV bypass.",
        "max_severity": "critical",
        "asset_identifier": "login.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "Used for our assets to be delivered to customers (i.e. logo, stylesheets, etc.).",
        "max_severity": "medium",
        "asset_identifier": "usercontent.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Customer-facing Web application. Reaching the dashboard before SMS verification completes is by design; see the policy's \"Out of scope\" section.",
        "max_severity": "critical",
        "asset_identifier": "web.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Marketing website. **Known issue, do not re-report:** the Sanity CMS token in the site's JavaScript bundles is already reported and tracked; new reports are closed as Duplicate. See the policy's \"Known issues\" section.",
        "max_severity": "medium",
        "asset_identifier": "www.koho.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "*.koho.ca/cdn-cgi",
        "eligible_for_bounty": false,
        "integrity_requirement": "none",
        "eligible_for_submission": false,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "*.line-of-credit.koho.ca",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": false,
        "availability_requirement": "low",
        "confidentiality_requirement": "high"
      }
    ]
  },
  "website": "https://koho.ca",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 17,
  "response_efficiency_percentage": 99,
  "average_time_to_report_resolved": 3494,
  "average_time_to_first_program_response": 0
}