Starbucks

{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 314,
  "average_time_to_first_program_response": 0,
  "average_time_to_report_resolved": 2911,
  "handle": "starbucks",
  "id": 0,
  "managed_program": true,
  "name": "Starbucks",
  "offers_bounties": true,
  "offers_swag": false,
  "response_efficiency_percentage": 76,
  "submission_state": "open",
  "url": "https://hackerone.com/starbucks",
  "website": "http://www.starbucks.com",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "Other assets",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": true,
        "instruction": "If you have found a vulnerability in a Starbucks site or app not contained within this list, you can still submit, and Starbucks will triage the report.\nThese types of reports will not result in a monetary reward but valid reports that are resolved can improve your reputation score on the HackerOne platform.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Subdomain Takeover (SDTO)",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Subdomain Takeovers will be evaluated on their severity considering cookie scoping, historical significance and potential traffic volume. They maybe bounty eligible or alternately informative as determined by their security impact to Starbucks.\n\nRefer to the Appropriate Proof of Concepts section of this policy for information on how to construct a valid proof of concept for these reports.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "app.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks US\nhttps://app.starbucks.com",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.starbucks.mobilecard",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks USA Android app.\nhttps://play.google.com/store/apps/details?id=com.starbucks.mobilecard",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.starbucks.mystarbucks",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks US ios app.\nhttps://itunes.apple.com/us/app/starbucks/id331177714",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "openapi.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks digital service capabilities to 3rd party business partner(s)/cooperators via standard Open API.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "secureui.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks Payment Processing\nhttps://secureui.starbucks.com/",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.starbucks.ca",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks Canada\nhttps://www.starbucks.ca/",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks US\nhttps://www.starbucks.com/",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.starbucksreserve.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Starbucks Reserve\nhttps://www.starbucksreserve.com/",
        "integrity_requirement": null,
        "max_severity": "critical"
      }
    ],
    "out_of_scope": [
      {
        "asset_identifier": "Teavana",
        "asset_type": "OTHER",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "Assets or site/domains related to Teavana (or aliased as Teavana) are not eligible for bounty, even if the WHOIS record shows that it is owned by Starbucks.  ",
        "integrity_requirement": "not_defined",
        "max_severity": "none"
      },
      {
        "asset_identifier": "apply.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "This site is powered by Eightfold. Any vulnerabilities identified involving this asset should be submitted to Eightfold's Bug Bounty Program https://hackerone.com/eightfold?type=team",
        "integrity_requirement": "not_defined",
        "max_severity": "none"
      },
      {
        "asset_identifier": "athome.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "athome.starbucks.com (and any respective subdomains of athome.starbucks.com)  is managed/run by Nestle and is out of scope from our bug bounty program ",
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "careers.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "This site is powered by Eightfold. Any vulnerabilities identified involving this asset should be submitted to Eightfold's Bug Bounty Program https://hackerone.com/eightfold?type=team",
        "integrity_requirement": "not_defined",
        "max_severity": "none"
      },
      {
        "asset_identifier": "istarbucks.co.kr",
        "asset_type": "URL",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "istarbucks.co.kr and any subdomains of istarbucks.co.kr is not managed by Starbucks and is explicitly out of scope from our Bug Bounty Program ",
        "integrity_requirement": "not_defined",
        "max_severity": "none"
      },
      {
        "asset_identifier": "lsstar.starbucks.com",
        "asset_type": "URL",
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "lsstar.starbucks.com is currently out of scope from our Program ",
        "integrity_requirement": "not_defined",
        "max_severity": "none"
      }
    ]
  }
}