Kiwi.com Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 427, "average_time_to_first_program_response": 49, "average_time_to_report_resolved": 904, "handle": "kiwicom", "id": 0, "managed_program": true, "name": "Kiwi.com", "offers_bounties": true, "offers_swag": true, "response_efficiency_percentage": 80, "submission_state": "open", "url": "https://hackerone.com/kiwicom", "website": "https://www.kiwi.com", "targets": { "in_scope": [ { "asset_identifier": "*.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Mostly branded versions of our main www.kiwi.com site, please report vulnerabilities only for www.kiwi.com and don't duplicate it here.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.skypicker.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "APIs & internal tools.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "auth.skypicker.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Authentication API used on www.kiwi.com.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "com.skypicker.Skypicker", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**Primary target** - Available in [App Store](https://itunes.apple.com/bs/app/kiwi-com-cheap-flight-tickets/id657843853)", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "com.skypicker.main", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**Primary target** - Available in the [Play Store](https://play.google.com/store/apps/details?id=com.skypicker.main)", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "http://www.kiwi.com/stories", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Online travel magazine Kiwi.com Stories, with very limited impact on our sites & infrastructure.", "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/js-iam-middleware", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/k8s-vault-operator", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/kiwi-cache", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/kiwi-json", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/kiwi-structlog-config", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/konfetti", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/navigation-compose-typed", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/orbit", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/pg2avro", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "https://github.com/kiwicom/request-session", "asset_type": "SOURCE_CODE", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "jobs.kiwi.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Hiring page, no sensitive information, likely no impact on our company.", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "tequila.kiwi.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "B2B platform. Backend API requests are proxied via **tequila-api.kiwi.com** & **api.tequila.kiwi.com**", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "www.kiwi.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Our main website", "integrity_requirement": "high", "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "*._domainkey.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, 3rd party assets that are under our domains.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.coupons.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Managed by third party.", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*_domainkey.skypicker.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*cars.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Operated by [rentalcars.com](https://rentalcars.com).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*citi-sign.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*code.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Hosted on [medium.com](https://medium.com) (see [this help page](https://help.medium.com/hc/en-us/articles/213481308-Bug-Bounty-Disclosure-Program)).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*experiences.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, managed by a third party.", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*learn.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Operated by [northpass.com](https://www.northpass.com).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*ov.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, 3rd party assets that are under our domains.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*parking.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Operated by [travelcar.com](https://travelcar.com).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*sg.kiwi.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, 3rd party assets that are under our domains.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "email*kiwi.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "email*skypicker.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "kiwistore.kiwi.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, 3rd party asset hosted under our domain.", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "link.kiwi.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "mail.skypicker.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "nyrujhhu3yuk.nest.skypicker.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "outbound.intercom.kiwi.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope, 3rd party assets that are under our domains.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "packages.kiwi.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: 3rd party asset that is linked under our domain.\n", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "retool.skypicker.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Operated by [retool.com](https://retool.com). Please contact retool directly on security@retool.com.", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "rooms.kiwi.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Operated by [booking.com](https://booking.com) (see https://hackerone.com/bookingcom).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "status.kiwi.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "**3rd-party target** - Hosted on [statuspage.io](https://statuspage.io) (see https://bugcrowd.com/statuspage).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "vacation.kiwi.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd party, out of scope.", "integrity_requirement": null, "max_severity": "none" } ] } }

Kiwi.com

In scope

Recent changes

Community reports

Your notes

Out of scope