Urban Company

{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 1354,
  "average_time_to_first_program_response": 6,
  "average_time_to_report_resolved": 1702,
  "handle": "urbancompany",
  "id": 0,
  "managed_program": false,
  "name": "Urban Company",
  "offers_bounties": true,
  "offers_swag": true,
  "response_efficiency_percentage": 100,
  "submission_state": "open",
  "url": "https://hackerone.com/urbancompany",
  "website": "https://www.urbancompany.com",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "1032480595",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is our customer iOS apps",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "982922982",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is our professional ios app.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.urbanclap.provider",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is our partner android app.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.urbanclap.urbanclap",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is our customer app.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.urbanclap.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "www.urbanclap.com is also our root and critical domain. Most of our traffic routes through it.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.urbancompany.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "www.urbancompany.com is our main and critical domain. Most of our traffic routes through urbanclap.com. Other subdomains mentioned in scope are for internal purpose and either are password protected or Google auth protected. We do not wish anyone to login to mentioned domains and hence they are critical for us to find vulnerabilities in.\n\n**partner.urbancompany.com is one of the critical subdomains within this asset.**\n\nTesting Directions:\n* A user can Sign Up using his phone number and email ID from the website home page or app. Do ensure that you are reachable on the mobile number that you shall use to register with us. While creating account reporters should use their own HackerOne email address like [handle]@wearehackerone.com",
        "integrity_requirement": null,
        "max_severity": "critical"
      }
    ],
    "out_of_scope": [
      {
        "asset_identifier": "Other urbancompany.com subdomains except for the ones in-scope",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "Examples of out-of-scope subdomains include but not limited to:\n- careers.urbancompany.com\n- careers.urbanclap.com\n- blog.urbancompany.com\n- blog.urbanclap.com\n- sherlock.urbanclap.com\n- sherlock.urbancompany.com \n- ops.urbanclap.com \n- ops.urbancompany.com\n- configs.urbanclap.com\n- configs.urbancompany.com\n- jarvis.urbanclap.com\n- jarvis.urbancompany.com\n- pro.urbanclap.com\n- dev*.urbanclap.com\n- All staging and dev subdomains",
        "integrity_requirement": null,
        "max_severity": "none"
      }
    ]
  }
}