Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for 23andMe Bug Bounty.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 42,
"average_time_to_first_program_response": 11,
"average_time_to_report_resolved": 2060,
"handle": "23andme_bbp",
"id": 0,
"managed_program": true,
"name": "23andMe Bug Bounty",
"offers_bounties": true,
"offers_swag": false,
"response_efficiency_percentage": 95,
"submission_state": "open",
"url": "https://hackerone.com/23andme_bbp",
"website": "http://23andme.org",
"targets": {
"in_scope": [
{
"asset_identifier": "23andme.org/ancestry/last-names",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Surname discovery domain that allows customers to browse different surname information.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "23andme.org/blog",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Official blog of 23andMe, sharing insightful articles, updates, and stories on genetics, health, and personal genomics.",
"integrity_requirement": "medium",
"max_severity": "critical"
},
{
"asset_identifier": "23andme.org/clinicians",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "medium",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Medical and therapeutics site containing information about 23andMe's medical research.",
"integrity_requirement": "medium",
"max_severity": "critical"
},
{
"asset_identifier": "23andme.org/education",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "23andMe's dedicated education site, offering resources and insights to enhance genetic literacy through informative content and educational materials",
"integrity_requirement": "medium",
"max_severity": "critical"
},
{
"asset_identifier": "23andme.org/media-center",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Media center for 23andMe, providing press releases, media assets, and comprehensive information for journalists and media professionals",
"integrity_requirement": "medium",
"max_severity": "critical"
},
{
"asset_identifier": "23andme.org/research",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "medium",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "research.23andMe.com is the official research domain of 23andMe",
"integrity_requirement": "medium",
"max_severity": "medium"
},
{
"asset_identifier": "23andmeresearchinstitute.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Public-facing website for the 23andMe Research Institute. Provides information about ongoing genetic research initiatives, published studies, member contribution programs, and partnership opportunities for researchers and collaborators.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "api.23andme.com",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "First API from original codebase, responsible for less services at the moment but still integrated into the product.",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "auth.23andme.com",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Responsible for all authenticated services throughout the product.",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "fulfillment.23andme.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "23andMe Fulfillment API",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "merch.23andme.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "E-commerce storefront for 23andMe merchandise.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "portal.23andme.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Clinical trials site portal for 23andMe collaborator-sponsored studies.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "refer.23andme.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Customer referral program portal for 23andMe. Handles referral link generation, tracking, and reward redemption for existing customers referring new kit purchases.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "store.23andme.org",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Online store for 23andMe products, offering DNA testing kits, genetic insights, and personalized merchandise.",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "style.23andme.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "This is a documentation site for the 23andMe design system. Its purpose is to organize, streamline, and document the usage of re-usable components within the 23andMe eco-system.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "trust.23andme.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Smart Trust Center to learn about our security posture and request access to our security documentation.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "www.23andme.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "The primary public-facing gateway and core application entry point.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "you.23andme.com",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "you.23andme.com is our main consumer site which contains users DNA kit results, dna relatives, and more. Users can interact with relatives and perform profile related features such as downloading data.",
"integrity_requirement": "high",
"max_severity": "critical"
}
],
"out_of_scope": []
}
}— none listed —