Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
7 in-scope
*.romwe.comscope· critical*.shein.comscope· critical*.sheingsp.comscope· critical1080248000· critical878577184· criticalnone listed
first indexed
92d ago · 7 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for SHEIN.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/shein",
"name": "SHEIN",
"handle": "shein",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "*.romwe. [com | co.in ]\n.romwe.org\n\n1. **Please note that if the exact same vulnerability is found on different top-level domains listed above (ie: .com, .co.in and .org), please do not submit multiple reports. Any duplicate reports submitted will be treated as such.**\n\n2. Please read the \"Important guidelines regarding cross-host vulnerabilities\" section of the policy page as the guidelines apply for this asset.",
"max_severity": "critical",
"asset_identifier": "*.romwe.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "*.shein.[com | in | tw | se | com.hk | com.vn | com.mx | co.uk ]\n\n1. **Please note that if the exact same vulnerability is found on different top-level domains listed above (example: .com, .in, .tw etc), please do not submit multiple reports. Any duplicate reports submitted will be treated as such.**\n\n2. Please read the \"Important guidelines regarding cross-host vulnerabilities\" section of the policy page as the guidelines apply for this asset.",
"max_severity": "critical",
"asset_identifier": "*.shein.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.sheingsp.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[ROMWE - Fashion Store](https://apps.apple.com/app/romwe-fashion-store/id1080248000) on the Apple App Store \n",
"max_severity": "critical",
"asset_identifier": "1080248000",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[SHEIN-Fashion Shopping Online](https://apps.apple.com/app/shein-fashion-shopping-online/id878577184) on the Apple App Store \n",
"max_severity": "critical",
"asset_identifier": "878577184",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[ROMWE](https://play.google.com/store/apps/details?id=com.romwe) on the Google Play Store\n",
"max_severity": "critical",
"asset_identifier": "com.romwe",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[SHEIN-Fashion Shopping Online](https://play.google.com/store/apps/details?id=com.zzkko) on the Google Play Store\n\n",
"max_severity": "critical",
"asset_identifier": "com.zzkko",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": []
},
"website": "http://shein.com",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 206,
"response_efficiency_percentage": 60,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": 8
}