Vimeo Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 48, "average_time_to_first_program_response": 4, "average_time_to_report_resolved": 4367, "handle": "vimeo", "id": 0, "managed_program": true, "name": "Vimeo", "offers_bounties": true, "offers_swag": false, "response_efficiency_percentage": 97, "submission_state": "open", "url": "https://hackerone.com/vimeo", "website": "https://vimeo.com", "targets": { "in_scope": [ { "asset_identifier": "*.cloud.vimeo.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Upload endpoints such as \\ *.cloud.vimeo.com", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.magisto.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**EXCEPTION** - Subdomains owned/controlled/managed/etc by a 3rd party.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.vhx.tv", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**EXCEPT for community.vhx.tv, 3rd party sites and EXCEPT a single-customer configured site**\n\nThe vulnerability must affect every site in order to be valid.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.vimeo.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "See scope/program for more definitive information. Does not include 3rd parties under vimeo.com domain names. Subject to realization we missed one.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1491791513", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "425194759", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "486781045", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "493086499", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "VHX Branded Customer Android Apps", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**Vulnerabilities must affect ANY/ALL VHX branded Android apps and not just a single VHX customer app**", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "VHX Branded Customer Roku Apps", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**Vulnerabilities must affect ANY/ALL VHX branded Roku apps and not just a single VHX customer app**", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "VHX Branded Customer iOS Apps", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "**Vulnerabilities must affect ANY/ALL VHX branded iOS apps and not just a single VHX customer app**", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "api.vhx.tv", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "api.vimeo.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "applause1.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "channelstore.roku.com/details/48061/vhx", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Roku App", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "checkout.vimeo.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "This is an S3 bucket behind a CDN. We will be responsible for things WE can control about this (Content, S3 permissions, CDN headers, etc). For items beyond our control, those are not in scope.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.magisto", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.vimeo.android.videoapp", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "com.vimeocreate.videoeditor.moviemaker", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "embed.vhx.tv", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "http://vimeo.com/api", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Legacy API endpoints such as vimeo.com/api", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "http://vimeo.com/create", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "http://vimeo.com/ondemand", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Vimeo On Demand hosted sites: https://vimeo.com/ondemand", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "magisto.com,www.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "player.vimeo.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "staging.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "vhx.tv", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "The VHX homepage at vhx.tv redirects to a login page at ott.vimeo.com. Please submit these reports to the VHX program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Only as it integrates with Vimeo. For anything about it itself, please report on the Magisto program", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "vimeopro.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Vimeo Pro portfolios hosted on vimeopro.com", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "www.vimeo.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "*.boost.livestream.com,boost.livestream.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This is a 3rd party (AMP.LIVE).", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.cdn.magisto.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This domain is out-of-scope for testing and bounty effective 6/26/2020 11:30 EDT", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.dev.magisto.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.email.vimeo.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd party", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.livestream.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.new.livestream.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.test.magisto.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.wibbitz.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Do not perform any testing on these assets.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.wirewax.app", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Do not perform any testing on these assets.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.wirewax.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Do not perform any testing on these assets.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "935740658", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "The base VHX app is no longer in scope as of 3/15/2019. Please test on branded apps.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "All", "asset_type": "WINDOWS_APP_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "No MS versions will be accepted.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Any previously owned/sold hardware", "asset_type": "HARDWARE", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "The hardware side of Livestream has been sold to a non-Vimeo company. Even though we have integrations with much of it still, we can not take reports for it.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Livestream software (Producer, Studio)", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Out of scope: any attacks of the install process, that require additional configuration files, dll, etc that are put onto the machine via virus, malware, confidence, etc.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "applause2.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "billing-account.vimeo.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "com.livestream.livestream", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "delta.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "donations.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "epsilon.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "eta.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "gamma.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "help.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This is Zendesk, 3rd party.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "http://www.magisto.com/blog", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "int001.vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "int002.vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "int003.vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "int004.vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "int005vimeo.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "livestream.com/blog, *.livestream.com/blog, blog.livestream.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "WPEngine requires a different contract if you include it on a bug bounty program", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "livestreamapis.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "omega.magisto.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This domain is out-of-scope for testing and bounty effective 6/26/2020 11:30 EDT", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "publishing-api.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Even though its a Livestream name, and goes to Livestream Fastly, the backend is a 3rd party vendor.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "s3://static.intercast-livestream.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Its a 3rd party owned bucket, AMP.LIVE, publicly available. The content in there is made to be publicly available.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "status.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd party", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "store.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This is 3rd party/Shopify.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "tv.vhx", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This is out of scope effective 3/15/2019. Please use branded apps for testing.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "vimeo.atlassian.net", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Although it has the name VIMEO, this is not our instance.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "www.livestream.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" } ] } }

Vimeo

In scope

Recent changes

Community reports

Your notes

Out of scope