1win

{
  "id": 0,
  "url": "https://hackerone.com/1win_com",
  "name": "1win",
  "handle": "1win_com",
  "targets": {
    "in_scope": [
      {
        "asset_type": "URL",
        "instruction": "Mirror of 1win.com: redirects to the current 1win.com mirror. Same platform and same scope as 1win.com. Not related to the 1win Partners program.",
        "max_severity": "critical",
        "asset_identifier": "1w.cash",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "**1win Partners** - the official 1win affiliate program, owned and operated by 1win.\n\nIn scope:\n- Partner registration and login\n- Partner dashboard: statistics, promo tools, payment details, payouts\n- Referral links, attribution and postbacks\n- Partner API and Telegram bot\n\nThe same service runs on 1w.run, 1win-partners.com, 1win.partners, 1win.run, 1w-partner.com and 1win.team. Report issues found on any of them under 1w.run or 1win-partners.com; both are accepted.\n\nPayout manipulation and hijacking of referral attribution are rated under the financial rows of the reward table (¹).",
        "max_severity": "critical",
        "asset_identifier": "1w.run",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "**1win Partners** - the official 1win affiliate program, owned and operated by 1win.\n\nIn scope:\n- Partner registration and login\n- Partner dashboard: statistics, promo tools, payment details, payouts\n- Referral links, attribution and postbacks\n- Partner API and Telegram bot\n\nThe same service runs on 1w.run, 1win-partners.com, 1win.partners, 1win.run, 1w-partner.com and 1win.team. Report issues found on any of them under 1w.run or 1win-partners.com; both are accepted.\n\nPayout manipulation and hijacking of referral attribution are rated under the financial rows of the reward table (¹).",
        "max_severity": "critical",
        "asset_identifier": "1win-partners.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "- Registration\n- Login\n- Deposit\n- Withdrawal\n- Personal account(settings, voucher, details, etc)\n\n**Here is an incomplete list of countries where the 1win.com website is available: Brazil, Albania, Vietnam, Gibraltar, Zimbabwe, Israel, Indonesia, Malaysia, Kuwait, Jamaica, Japan, Panama, Thailand, Taiwan, Turkey, Philippines, South Korea, India, Bangladesh, Pakistan, Nepal, Kyrgyzstan, Azerbaijan, Uzbekistan, Tajikistan, Armenia, Chile, Argentina, Colombia, Ecuador, Venezuela, Bolivia, Cameroon, Egypt, Zambia, Costa Rica, Algeria, Angola, Andorra, Gabon, Guatemala, Guinea-Bissau, Honduras, Mozambique, Monaco, Mongolia, Namibia**\n\nOfficial 1win country domains and mirrors serving the same platform as 1win.com are in scope. Report issues found on them against this asset.",
        "max_severity": "critical",
        "asset_identifier": "1win.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "**1win.io** - the official 1win crypto casino and sports betting site, running on the same platform as 1win.com.\n\nIn scope:\n- Registration and login\n- Crypto deposits and withdrawals\n- Personal account (settings, vouchers, bonuses)\n- Casino and betting",
        "max_severity": "critical",
        "asset_identifier": "1win.io",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "1wintoken.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "1wtoken.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "In scope:\n- Payment forms and integrations hosted on 1win.com, including processing of redirect responses and callbacks.\n\nOut of scope:\n- Infrastructure and APIs of external payment providers (vulnerabilities that do not affect 1win)",
        "max_severity": "critical",
        "asset_identifier": "Deposit/Withdraw",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "**1win Forum** - the official 1win community forum (self-hosted Invision Community). Also available at forum.1win.com; report issues found there under this asset.\n\nIn scope:\n- Access control, including restricted sub-forums and private messages\n- Account security and session handling\n- Stored XSS and other injections in posts, profiles, themes and integrations\n\nVulnerabilities in the Invision Community core are accepted if they are exploitable on this instance.",
        "max_severity": "critical",
        "asset_identifier": "forum.1win.io",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "URL",
        "instruction": "Here is an incomplete list of countries where the 1win.com website is available: Brazil, Albania, Vietnam, Gibraltar, Zimbabwe, Israel, Indonesia, Malaysia, Kuwait, Jamaica, Japan, Panama, Thailand, Taiwan, Turkey, Philippines, South Korea, India, Bangladesh, Pakistan, Nepal, Kyrgyzstan, Azerbaijan, Uzbekistan, Tajikistan, Armenia, Chile, Argentina, Colombia, Ecuador, Venezuela, Bolivia, Cameroon, Egypt, Zambia, Costa Rica, Algeria, Angola, Andorra, Gabon, Guatemala, Guinea-Bissau, Honduras, Mozambique, Monaco, Mongolia, Namibia",
        "max_severity": "critical",
        "asset_identifier": "https://1win.com/betting",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "All games available at https://1win.com/casino fall within the scope of the program.",
        "max_severity": "critical",
        "asset_identifier": "https://1win.com/casino",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://solscan.io/account/B2RFzpckwjtHXHMrPMKarg6Cj6xkSdT6mru4gJiJE87L",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://solscan.io/account/GWvQinGBRa7ZUzhXY23MrLjdsx3KfRGxH8yXURBwrz1R",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://solscan.io/account/sxzuA7TuRvjVbrXkJUgrYq2hfjVf3RFd8WFaSxt2rYm",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "low"
      }
    ],
    "out_of_scope": []
  },
  "website": "https://1win.com",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 349,
  "response_efficiency_percentage": 100,
  "average_time_to_report_resolved": 1017,
  "average_time_to_first_program_response": 8
}