Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
4 in-scope
uber.com· critical*.uberinternal.comscope· none*ubereats.com· noneRecon Data· none*scaledsolutions.uber.comscaledsolutions*.uber.com*.ubercarshare.comFraud Reportsfirst indexed
92d ago · 4 in-scope assets
No reports yet. Be the first to share your triage timing for Uber.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/uber",
"name": "Uber",
"handle": "uber",
"targets": {
"in_scope": [
{
"asset_type": "OTHER",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*.uberinternal.com",
"eligible_for_bounty": true,
"integrity_requirement": "none",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "OTHER",
"instruction": "Includes all subdomains (*.ubereats.com) except subdomains listed in out of scope.",
"max_severity": "none",
"asset_identifier": "*ubereats.com",
"eligible_for_bounty": true,
"integrity_requirement": "none",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "OTHER",
"instruction": "Uber provides endpoints to determine whether an asset belongs to Uber:\n\nhttps://appsec-analysis.uber.com/public/bugbounty/ListDomains\nhttps://appsec-analysis.uber.com/public/bugbounty/ListIPs\n\nAll of the endpoints support offset and limit as optional parameters.\nExample: https://appsec-analysis.uber.com/public/bugbounty/ListDomains?offset=0&limit=100.\n\nThe public endpoints for asset information are for recon purposes. Information returned by those endpoints (or not) does not mean a bounty is guaranteed.",
"max_severity": "none",
"asset_identifier": "Recon Data",
"eligible_for_bounty": true,
"integrity_requirement": "none",
"eligible_for_submission": true,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "uber.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "none",
"asset_identifier": "*.ubercarshare.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "This asset is not eligible for Uber bounty programs.",
"max_severity": "none",
"asset_identifier": "*.uberscoot.us",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "This asset is not eligible for Uber bounty programs.",
"max_severity": "none",
"asset_identifier": "*.ubertransit.io",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*scaledsolutions.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Fraud reports are out of scope and ineligible for bounties. This includes reports detailing the ability to take free rides and evade payment.",
"max_severity": "none",
"asset_identifier": "Fraud Reports",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "adsacademy.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "bizblog.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "central-beta.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "drive.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "eng.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "et.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://assets.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "https://brand.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "not_defined",
"eligible_for_submission": false,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "love.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Reports of broken access control or privilege escalation that affect only organization‑scoped roles within the reporter’s own organization (e.g., a Staff role performing Manager‑only actions in the same organization) are out of scope for the Merchants application. This exclusion does not apply to cross‑tenant access, such findings remain in scope.",
"max_severity": "none",
"asset_identifier": "merchants.ubereats.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "newsroom.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "people.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "none",
"asset_identifier": "scaledsolutions*.uber.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": "Any asset under *.uber.com.cn is not eligible for Uber bounty programs. This and any other asset related to Uber in China belongs to Didi Chuxing.",
"max_severity": "none",
"asset_identifier": "uber.com.cn",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "uber.onelogin.com",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
}
]
},
"website": "https://www.uber.com",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 144,
"response_efficiency_percentage": 66,
"average_time_to_report_resolved": null,
"average_time_to_first_program_response": 63
}