kiwicom

HackerOneView on HackerOne
RawAI Enhanced
10
In Scope
24
Out of Scope
In-Scope Assets (10)
AssetCategoryBountyQuick Links
*.kiwi.comWILDCARDYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
*.skypicker.comWILDCARDYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
auth.skypicker.comURLYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
com.skypicker.SkypickerIOSYes-
com.skypicker.mainANDROIDYes
Play StoreAPKPureAPKMirror
http://www.kiwi.com/storiesURLYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
https://github.com/kiwicom/*CODEYes-
jobs.kiwi.comURLYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
tequila.kiwi.comURLYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
www.kiwi.comURLYes
crt.shGoogleShodanSecurityTrailsWaybackDNSdumpsterVirusTotalAlienVault OTXGitHubFofa
Out-of-Scope Assets (24)
AssetCategoryBounty
*._domainkey.kiwi.comWILDCARDNo
*.coupons.kiwi.comWILDCARDNo
*_domainkey.skypicker.comWILDCARDNo
*cars.kiwi.comWILDCARDNo
*citi-sign.kiwi.comWILDCARDNo
*code.kiwi.comWILDCARDNo
*experiences.kiwi.comWILDCARDNo
*learn.kiwi.comWILDCARDNo
*ov.kiwi.comWILDCARDNo
*parking.kiwi.comWILDCARDNo
*sg.kiwi.comWILDCARDNo
email*kiwi.comWILDCARDNo
email*skypicker.comWILDCARDNo
https://github.com/kiwicom/pytest-recordingCODENo
kiwistore.kiwi.comURLNo
link.kiwi.comURLNo
mail.skypicker.comURLNo
nyrujhhu3yuk.nest.skypicker.comURLNo
outbound.intercom.kiwi.comURLNo
packages.kiwi.comURLNo
retool.skypicker.comURLNo
rooms.kiwi.comURLNo
status.kiwi.comURLNo
vacation.kiwi.comURLNo
Scope Changes (78)
Feb 25, 2026
ChangeAssetCategoryScopeTime
Added*_domainkey.skypicker.comWILDCARDOut of Scope19:09
Added*._domainkey.kiwi.comWILDCARDOut of Scope19:09
Added*.skypicker.comWILDCARDIn Scope19:09
Addedstatus.kiwi.comURLOut of Scope19:09
Added*cars.kiwi.comWILDCARDOut of Scope19:09
Added*parking.kiwi.comWILDCARDOut of Scope19:09
Addedjobs.kiwi.comURLIn Scope19:09
Addedhttps://github.com/kiwicom/*OTHERIn Scope19:09
Addedwww.kiwi.comURLIn Scope19:09
Addedlink.kiwi.comURLOut of Scope19:09
Addedvacation.kiwi.comURLOut of Scope19:09
Addedoutbound.intercom.kiwi.comURLOut of Scope19:09
Added*experiences.kiwi.comWILDCARDOut of Scope19:09
Addedcom.skypicker.skypickerIOSIn Scope19:09
Addedpackages.kiwi.comURLOut of Scope19:09
Addednyrujhhu3yuk.nest.skypicker.comURLOut of Scope19:09
Added*learn.kiwi.comWILDCARDOut of Scope19:09
Added*code.kiwi.comWILDCARDOut of Scope19:09
Addedcom.skypicker.mainANDROIDIn Scope19:09
Added*ov.kiwi.comWILDCARDOut of Scope19:09
Addedemail*kiwi.comWILDCARDOut of Scope19:09
Added*.kiwi.comWILDCARDIn Scope19:09
Addedmail.skypicker.comURLOut of Scope19:09
Added*citi-sign.kiwi.comWILDCARDOut of Scope19:09
Addedretool.skypicker.comURLOut of Scope19:09
Addedauth.skypicker.comURLIn Scope19:09
Addedtequila.kiwi.comURLIn Scope19:09
Addedhttp://www.kiwi.com/storiesURLIn Scope19:09
Addedrooms.kiwi.comURLOut of Scope19:09
Added*sg.kiwi.comWILDCARDOut of Scope19:09
Addedemail*skypicker.comWILDCARDOut of Scope19:09
Added*.coupons.kiwi.comWILDCARDOut of Scope19:09
Addedkiwistore.kiwi.comURLOut of Scope19:09
Addedhttps://github.com/kiwicom/pytest-recordingOTHEROut of Scope19:09
Feb 22, 2026
ChangeAssetCategoryScopeTime
Addedkiwistore.kiwi.comURLOut of Scope00:41
Addednyrujhhu3yuk.nest.skypicker.comURLOut of Scope00:41
Added*.coupons.kiwi.comWILDCARDOut of Scope00:41
Addedcom.skypicker.mainANDROIDIn Scope00:41
Addedcom.skypicker.skypickerIOSIn Scope00:41
Added*sg.kiwi.comWILDCARDOut of Scope00:41
Added*citi-sign.kiwi.comWILDCARDOut of Scope00:41
Addedtequila.kiwi.comURLIn Scope00:41
Added*parking.kiwi.comWILDCARDOut of Scope00:41
Addedemail*kiwi.comWILDCARDOut of Scope00:41
Added*learn.kiwi.comWILDCARDOut of Scope00:41
Added*.kiwi.comWILDCARDIn Scope00:41
Addedauth.skypicker.comURLIn Scope00:41
Addedstatus.kiwi.comURLOut of Scope00:41
Addedhttp://www.kiwi.com/storiesURLIn Scope00:41
Added*._domainkey.kiwi.comWILDCARDOut of Scope00:41
Added*_domainkey.skypicker.comWILDCARDOut of Scope00:41
Added*experiences.kiwi.comWILDCARDOut of Scope00:41
Addedlink.kiwi.comURLOut of Scope00:41
Added*.skypicker.comWILDCARDIn Scope00:41
Added*cars.kiwi.comWILDCARDOut of Scope00:41
Added*code.kiwi.comWILDCARDOut of Scope00:41
Addedvacation.kiwi.comURLOut of Scope00:41
Added*ov.kiwi.comWILDCARDOut of Scope00:41
Addedretool.skypicker.comURLOut of Scope00:41
Addedwww.kiwi.comURLIn Scope00:41
Addedpackages.kiwi.comURLOut of Scope00:41
Addedjobs.kiwi.comURLIn Scope00:41
Addedhttps://github.com/kiwicom/*OTHERIn Scope00:41
Addedoutbound.intercom.kiwi.comURLOut of Scope00:41
Addedhttps://github.com/kiwicom/pytest-recordingCODEOut of Scope00:41
Addedrooms.kiwi.comURLOut of Scope00:41
Addedemail*skypicker.comWILDCARDOut of Scope00:41
Addedmail.skypicker.comURLOut of Scope00:41
Feb 21, 2026
ChangeAssetCategoryScopeTime
Removedjobs.kiwi.comURLIn Scope21:38
Removedhttp://www.kiwi.com/storiesURLIn Scope21:38
Removedhttps://github.com/kiwicom/*CODEIn Scope21:38
Removedtequila.kiwi.comURLIn Scope21:38
Removedauth.skypicker.comURLIn Scope21:38
Removedcom.skypicker.skypickerIOSIn Scope21:38
Removedcom.skypicker.mainANDROIDIn Scope21:38
Removed*.skypicker.comWILDCARDIn Scope21:38
Removed*.kiwi.comWILDCARDIn Scope21:38
Removedwww.kiwi.comURLIn Scope21:38