Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
24 in-scope
*.itesco.cz/*· critical*.itesco.sk/*· critical*.ourtesco.com/*· critical*.tesco-europe.com/*· critical*.tesco.com/*· critical*.tesco.hu/*· critical*.tesco.ie/*· critical*.tesco.org/*· critical*.tesco.sk/*· critical*.tescocloud.com/*· critical*.tescoplc.com/*· criticalwww.booker.co.uk/*· criticalwww.onestop.co.uk/*· criticalwww.tescomobile.com/*· critical389581236· critical857834425· noneAPI Assets· criticalCloud Assets· criticalDomain, Subdomain & Zone Takeovers· mediumExposed Sensitive Documents· criticalLeaked & Default Credentials· criticalMedium, High and Critical Severity Issue on Out-Of-Scope Assets· criticalThird-Party Managed Assets· criticalcom.tesco.grocery.view· criticalDunnhumby (Non-Critical)otherTesco Bankothercom.tescobank.mobileotherfirst indexed
92d ago · 24 in-scope assets
// only one snapshot on record, changes appear from the next ingest onward
No reports yet. Be the first to share your triage timing for Tesco.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/tesco",
"name": "Tesco",
"handle": "tesco",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.itesco.cz/.",
"max_severity": "critical",
"asset_identifier": "*.itesco.cz/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.itesco.sk/.",
"max_severity": "critical",
"asset_identifier": "*.itesco.sk/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.ourtesco.com/.",
"max_severity": "critical",
"asset_identifier": "*.ourtesco.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco-europe.com/.",
"max_severity": "critical",
"asset_identifier": "*.tesco-europe.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.com/.",
"max_severity": "critical",
"asset_identifier": "*.tesco.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.hu/.",
"max_severity": "critical",
"asset_identifier": "*.tesco.hu/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.ie/.",
"max_severity": "critical",
"asset_identifier": "*.tesco.ie/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.org/.",
"max_severity": "critical",
"asset_identifier": "*.tesco.org/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.sk/.",
"max_severity": "critical",
"asset_identifier": "*.tesco.sk/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Cloud Asset. This asset includes any subdirectory from https://www.tescocloud.com/.",
"max_severity": "critical",
"asset_identifier": "*.tescocloud.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Core Asset. This asset includes any subdirectory from https://www.tescoplc.com/.",
"max_severity": "critical",
"asset_identifier": "*.tescoplc.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "iOS mobile application for Tesco groceries.",
"max_severity": "critical",
"asset_identifier": "389581236",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "iOS mobile application for Tesco Bank.",
"max_severity": "none",
"asset_identifier": "857834425",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Assets which include any Tesco API endpoints.",
"max_severity": "critical",
"asset_identifier": "API Assets",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Assets which include any Tesco cloud asset which is hosted on cloud infrastructure which is not explicitly listed within the program scope.",
"max_severity": "critical",
"asset_identifier": "Cloud Assets",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Domain, subdomain & zone takeovers only. Please see the \"Domain, Subdomain & Zone Takeovers\" section for more details.",
"max_severity": "medium",
"asset_identifier": "Domain, Subdomain & Zone Takeovers",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Exposure of sensitive documents only. Please see the “Exposed Sensitive Documents” section for more details.",
"max_severity": "critical",
"asset_identifier": "Exposed Sensitive Documents",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Leaked & default credentials only. Please see the \"Leaked & Default Credentials\" section for more details.",
"max_severity": "critical",
"asset_identifier": "Leaked & Default Credentials",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "We allow Medium, High and Critical findings to be submitted on any asset which is explicitly not listed in the program scope. Please note that only valid critical OOS reports should be submitted.",
"max_severity": "critical",
"asset_identifier": "Medium, High and Critical Severity Issue on Out-Of-Scope Assets",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Assets which include any Tesco asset which is managed by third party providers & vendors. Please see the “Third Party Managed Assets” section for more details.",
"max_severity": "critical",
"asset_identifier": "Third-Party Managed Assets",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Android mobile application for Tesco groceries.",
"max_severity": "critical",
"asset_identifier": "com.tesco.grocery.view",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Subsidiary Asset. This asset includes any subdirectory from https://booker.co.uk/. This does not include any other subdomains.",
"max_severity": "critical",
"asset_identifier": "https://www.booker.co.uk/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Subsidiary Asset. This asset includes any subdirectory from https://onestop.co.uk/. This does not include any other subdomains.",
"max_severity": "critical",
"asset_identifier": "https://www.onestop.co.uk/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Subsidiary Asset. This asset includes any subdirectory from https://tescomobile.com/. This does not include any other subdomains.",
"max_severity": "critical",
"asset_identifier": "https://www.tescomobile.com/*",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": "Please report any low/medium/high vulnerabilities here: https://www.dunnhumby.com/security.txt",
"max_severity": "none",
"asset_identifier": "Dunnhumby (Non-Critical)",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "As defined in the \"Tesco Bank\" section. Please report any vulnerabilities here: https://tescobank.responsibledisclosure.com/hc/en-us",
"max_severity": "none",
"asset_identifier": "Tesco Bank",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "Android mobile application for Tesco Bank.",
"max_severity": "none",
"asset_identifier": "com.tescobank.mobile",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "http://tesco.com",
"offers_swag": false,
"managed_program": true,
"offers_bounties": false,
"submission_state": "open",
"allows_bounty_splitting": false,
"average_time_to_bounty_awarded": null,
"response_efficiency_percentage": 100,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": 0
}