HackerOne

{ "allows_bounty_splitting": false, "average_time_to_bounty_awarded": null, "average_time_to_first_program_response": 1, "average_time_to_report_resolved": 545, "handle": "tesco", "id": 0, "managed_program": true, "name": "Tesco", "offers_bounties": false, "offers_swag": false, "response_efficiency_percentage": 94, "submission_state": "open", "url": "https://hackerone.com/tesco", "website": "http://tesco.com", "targets": { "in_scope": [ { "asset_identifier": "*.itesco.cz/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.itesco.cz/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.itesco.sk/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.itesco.sk/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.ourtesco.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.ourtesco.com/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco-europe.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco-europe.com/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.com/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco.hu/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.hu/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco.ie/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.ie/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco.org/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.org/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tesco.sk/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tesco.sk/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tescocloud.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Cloud Asset. This asset includes any subdirectory from https://www.tescocloud.com/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.tescoplc.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Core Asset. This asset includes any subdirectory from https://www.tescoplc.com/.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "389581236", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "iOS mobile application for Tesco groceries.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "857834425", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "iOS mobile application for Tesco Bank.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "API Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Assets which include any Tesco API endpoints.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Cloud Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Assets which include any Tesco cloud asset which is hosted on cloud infrastructure which is not explicitly listed within the program scope.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Domain, Subdomain & Zone Takeovers", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Domain, subdomain & zone takeovers only. Please see the \"Domain, Subdomain & Zone Takeovers\" section for more details.", "integrity_requirement": null, "max_severity": "medium" }, { "asset_identifier": "Exposed Sensitive Documents", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Exposure of sensitive documents only. Please see the “Exposed Sensitive Documents” section for more details.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Leaked & Default Credentials", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Leaked & default credentials only. Please see the \"Leaked & Default Credentials\" section for more details.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Medium, High and Critical Severity Issue on Out-Of-Scope Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "We allow Medium, High and Critical findings to be submitted on any asset which is explicitly not listed in the program scope. Please note that only valid critical OOS reports should be submitted.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Third-Party Managed Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Assets which include any Tesco asset which is managed by third party providers & vendors. Please see the “Third Party Managed Assets” section for more details.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.tesco.grocery.view", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Android mobile application for Tesco groceries.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "https://www.booker.co.uk/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Subsidiary Asset. This asset includes any subdirectory from https://booker.co.uk/. This does not include any other subdomains.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "https://www.onestop.co.uk/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Subsidiary Asset. This asset includes any subdirectory from https://onestop.co.uk/. This does not include any other subdomains.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "https://www.tescomobile.com/*", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Subsidiary Asset. This asset includes any subdirectory from https://tescomobile.com/. This does not include any other subdomains.", "integrity_requirement": null, "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "Dunnhumby (Non-Critical)", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Please report any low/medium/high vulnerabilities here: https://www.dunnhumby.com/security.txt", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Tesco Bank", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "As defined in the \"Tesco Bank\" section. Please report any vulnerabilities here: https://tescobank.responsibledisclosure.com/hc/en-us", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "com.tescobank.mobile", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Android mobile application for Tesco Bank.", "integrity_requirement": null, "max_severity": "none" } ] } }

Tesco

In scope

Recent changes

Community reports

Your notes

Out of scope