Scope Data

In Scope Assets:

• URL: https://app.glean.com/login?qe=https://bug-bounty-be.glean.com&skip_to_sso=1
• URL: Backend endpoint: bug-bounty-be.glean.com
• URL: https://marketplace.atlassian.com/apps/1222714/scio-search-crawler-for-confluence?hosting=cloud&tab=overview
• URL: https://marketplace.atlassian.com/apps/1222715/scio-search-crawler-for-jira?hosting=cloud&tab=overview
• URL: https://marketplace.atlassian.com/apps/1229003/glean-activity-plugin-for-jira-cloud?hosting=cloud&tab=overview

In Scope Assets:

• URL: https://www.hostgator.com.br/
• URL: https://financeiro.hostgator.com.br

Out of Scope Assets:

• URL: Anything not explicitly listed as "In Scope". (OOS)
• URL: https://carrinho.hostgator.com.br/ (OOS)

In Scope Assets:

• URL: https://bugcrowd.hotdoc.com.au
• URL: https://bugcrowd.hotdoc.com.au/api
• URL: https://bugcrowd.hotdoc.com.au/dashboard

Out of Scope Assets:

• ANDROID: Android App (OOS)
• IOS: IoS App (OOS)
• URL: https://try.hotdoc.com.au/hotdoc-profiles (OOS)

In Scope Assets:

• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• ANDROID: REDACTED
• IOS: REDACTED
• OTHER: REDACTED
• OTHER: REDACTED
• OTHER: REDACTED

Out of Scope Assets:

• URL: REDACTED (OOS)
• URL: REDACTED (OOS)
• URL: REDACTED (OOS)
• URL: REDACTED (OOS)
• OTHER: REDACTED (OOS)

In Scope Assets:

• URL: https://www.beautyexpert.com/
• URL: https://www.cultbeauty.co.uk/
• URL: https://www.dermstore.com
• URL: https://www.espaskincare.com/
• URL: https://www.exantediet.com/
• URL: https://www.eyeko.com/
• URL: https://www.glossybox.com/
• URL: https://www.growgorgeous.com/
• URL: https://www.hqhair.com/
• URL: https://www.illamasqua.com/
• URL: https://www.mioskincare.com/
• URL: https://www.mankind.co.uk/
• URL: https://www.mybag.com/
• URL: https://www.myvitamins.com/
• URL: https://www.powerman.co.uk/
• URL: https://www.thehut.com/
• URL: https://checkout.myvitamins.com
• URL: https://checkout.eyeko.com
• URL: https://checkout.glossybox.com

In Scope Assets:

• OTHER: https://chrome.google.com/webstore/detail/ibotta-browser-extension/mfaedmjlefifhnhpgipjjiiekchaimpk?hl=en-US
• ANDROID: http://market.android.com/details?id=com.ibotta.android
• IOS: http://itunes.apple.com/us/app/ibotta/id559887125
• URL: https://content-server.ibotta.com/graphql
• URL: https://api.ibotta.com
• URL: https://api.ibops.net
• URL: https://api.int.ibops.net
• URL: https://api.int.ibops.net/customer-loyalty-service
• URL: https://api.ibops.net/ad-management
• OTHER: Ibotta App Data & Memory
• URL: https://app.ibotta.com/sign-in
• URL: http://ibotta.com
• URL: https://backend.ibotta.com/

Out of Scope Assets:

• URL: http://sampling.ibotta.com/ (OOS)
• URL: https://backend.ibotta.com/duplicate_receipt_moderation (OOS)
• URL: https://ir.ibotta.com (OOS)
• URL: https://trust.ibotta.com (OOS)
• URL: legal.ibotta.com (OOS)
• URL: *dev.ibotta.com (OOS)

In Scope Assets:

• URL: https://www.ifood.com.br
• URL: https://marketplace.ifood.com.br
• URL: https://wsloja.ifood.com.br
• URL: https://gestordepedidos.ifood.com.br
• ANDROID: https://play.google.com/store/apps/details?id=br.com.brainweb.ifood&hl=pt_BR
• IOS: https://apps.apple.com/br/app/ifood-pedir-comida-e-mercado/id483017239
• URL: https://*.movilepay.com
• URL: https://*.movilepay.com.br
• URL: https://shop.ifood.com.br
• URL: https://static-images.ifood.com.br
• URL: https://developer.ifood.com.br
• URL: https://api.fstr.rocks
• URL: https://rc.fstr.rocks
• URL: https://www.zoop.com.br
• URL: https://www.zoop.ws
• URL: https://www.minhaconta.zoop.com.br
• URL: https://dash.zoop.com.br/
• URL: https://www.contadigital.ifoodpago.com.br/
• URL: https://play.google.com/store/apps/details?id=br.com.movilepay.banking.application&hl=pt_BR
• URL: https://portal.iFoodpago.com.br

Out of Scope Assets:

• URL: blog-empresas.ifood.com.br (OOS)
• URL: blog-parceiros.ifood.com.br (OOS)
• URL: *.ecomanda.com.br (OOS)
• URL: *.ecomanda.app (OOS)
• URL: *.allin.movilepay.com (OOS)
• URL: *.starsoft.movilepay.com (OOS)
• OTHER: Gestor de Pedidos - Desktop Client (OOS)

In Scope Assets:

• URL: https://passport.immutable.com/
• URL: https://auth.immutable.com
• OTHER: https://github.com/immutable/ts-immutable-sdk/tree/main/packages/passport/
• URL: https://hub.immutable.com/
• URL: https://play.immutable.com
• URL: https://api.immutable.com
• URL: https://api.x.immutable.com/
• URL: *.immutable.com
• URL: *.imtbl.com
• CIDR: testnet.immutable.com
• CIDR: *.testnet.immutable.com
• URL: https://link.x.immutable.com/
• URL: https://market.immutable.com/
• URL: https://docs.immutable.com/
• URL: imx.community
• URL: https://guildofguardians.com
• OTHER: *.guildofguardians.com

Out of Scope Assets:

• OTHER: *.godsunchained.com (OOS)
• OTHER: *.gogbackend.com (OOS)
• OTHER: gogbackend.com (OOS)
• OTHER: godsunchained.com (OOS)
• OTHER: Anything that does not belong to Immutable (OOS)
• OTHER: Any data exposure bug that are classified as Public Data such as Ethereum Wallet Address, NFT Purchase activity, or other public blockchain activity. (OOS)
• OTHER: *.dev.x.immutable.com, *.sandbox.x.immutable.com, *.dev.x.immutable.com, *.sandbox.imtbl.com, *.dev.imtbl.com, *.ropsten.x.immutable.com, ropsten.imx.community (see brief for exceptions) (OOS)

In Scope Assets:

• URL: https://*.imperva.com
• URL: https://www.cloudvector.com/
• URL: https://*.incapsula.com
• URL: https://supportportal.thalesgroup.com
• URL: PTaaS Reference

Out of Scope Assets:

• URL: http://docs.imperva.com/ (OOS)
• URL: http://docs-be.imperva.com/ (OOS)

In Scope Assets:

• URL: https://indeed.com
• URL: https://*.indeedflex.com
• URL: https://apis.indeed.com/graphql
• ANDROID: https://play.google.com/store/apps/details?id=com.indeed.android.jobsearch
• IOS: https://apps.apple.com/us/app/indeed-job-search/id309735670
• ANDROID: https://play.google.com/store/apps/details?id=com.syftapp.android
• IOS: https://apps.apple.com/gb/app/indeed-flex-job-search/id1013812731
• URL: Career Scout
• URL: https://*.indeed.tech
• URL: https://*.indeed.net
• URL: https://resume.com
• URL: https://wowjobs.ca
• IOS: https://apps.apple.com/us/app/%E5%B1%A5%E6%AD%B4%E6%9B%B8%E4%BD%9C%E6%88%90-%E3%82%A4%E3%83%B3%E3%83%87%E3%82%A3%E3%83%BC%E3%83%89/id1484451230
• ANDROID: https://play.google.com/store/apps/details?id=com.indeed.resume
• IOS: https://apps.apple.com/us/app/indeed-connect-for-employers/id6443822731
• URL: https://chromewebstore.google.com/detail/indeed-recruiter-extensio/kiodpphbmnmcmnfgpnmkkhmkllnlflef
• OTHER: Any host/web property/mobile app verified to be owned by Indeed

In Scope Assets:

• IOS: https://developers.intercom.com/installing-intercom/docs/about-the-sdk-ios
• URL: https://api.intercom.com
• URL: https://app.intercom.com
• URL: *.intercomassets.com / *.intercomcdn.com
• URL: https://app.intercom.io/
• ANDROID: https://developers.intercom.com/installing-intercom/docs/about-the-sdk-android
• URL: https://www.intercom.com/

In Scope Assets:

• HARDWARE: iRobot Romoba™ 105
• HARDWARE: iRobot Romoba™ 205
• HARDWARE: iRobot Romoba™ 405
• HARDWARE: iRobot Romoba™ 505
• HARDWARE: iRobot Romoba™ 705
• IOS: https://apps.apple.com/us/app/roomba-home/id6504274697
• ANDROID: https://play.google.com/store/apps/details?id=com.irobot.home.prime
• URL: https://aspen-ecommerce-prod.iot.irobotapi.com/dev/v1/ecommerce/entitlements
• URL: https://aspen-ecommerce-prod.iot.irobotapi.com/dev/v1/ecommerce/entitlements/{entitlement_id}
• URL: iRobot API Endpoint
• URL: https://zuora-ecommerce-prod.iot.irobotapi.com/dev/v1/ecommerce/notifications/raas
• URL: https://aspen-ecommerce-prod.iot.irobotapi.com/dev/v1/ecommerce/robots/{robot_id}/entitlements
• URL: https://aspen-ecommerce-prod.iot.irobotapi.com/dev/v1/ecommerce/users/{user_id}/entitlements
• URL: https://www.irobot.com
• URL: https://www.irobot.ca/en_CA
• URL: https://www.irobot.ca/fr_CA/home
• URL: https://www.irobot.at/
• URL: https://www.irobot.be/
• URL: https://www.irobot.de/
• URL: https://www.irobot.es/
• URL: https://www.irobot.fr/
• URL: https://www.irobot.co.uk/
• URL: https://www.irobot.ie/
• URL: https://www.irobot.nl/
• URL: https://www.irobot.pt/
• URL: https://www.homesupport.irobot.com
• URL: https://media.irobot.com
• URL: https://investor.irobot.com

In Scope Assets:

• URL: *.jora.com
• URL: *.jora.xyz
• IOS: https://apps.apple.com/us/app/jora-jobs-job-search-app/id917565665
• ANDROID: https://play.google.com/store/apps/details?id=com.jora.android&hl=en_US

Out of Scope Assets:

• URL: *.joralocal.com.au (OOS)

In Scope Assets:

• URL: https://api-payments-secure-prod.skippayments.com
• URL: https://takeawaypay.azurefd.net/en/takeawaypay/
• URL: https://takeaway.pay-creditcard.takeaway.com/
• URL: pay.{business_critical_assets} *see business assets for more information
• URL: https://global-payments-web.payments.pmt-1.eu-west-1.production.jet-external.com
• URL: https://rest.api.eu-central-1.production.jet-external.com
• URL: https://uk.api.just-eat.io
• URL: https://aus.api.just-eat.io/
• URL: https://api-skipthedishes.skipthedishes.com
• URL: https://i18n.api.just-eat.io
• URL: https://cw-api.takeaway.com
• URL: https://www.thuisbezorgd.nl/
• URL: https://menulog.com.au
• URL: https://takeaway.com
• URL: https://skipthedishes.com
• URL: https://just-eat.dk
• URL: https://lieferando.de
• URL: https://pyszne.pl
• URL: https://bistro.sk
• URL: https://just-eat.es
• URL: https://www.just-eat.co.uk
• URL: https://just-eat.ch
• URL: https://10bis.co.il
• URL: https://scoober.com
• URL: https://just-eat.com
• URL: https://skippayments.com
• ANDROID: https://play.google.com/store/apps/developer?id=Takeaway.com
• ANDROID: https://play.google.com/store/apps/developer?id=Just-Eat+Holding+Limited
• ANDROID: https://play.google.com/store/apps/developer?id=10bis.co.il+ltd.
• ANDROID: https://play.google.com/store/apps/developer?id=Skip+Canada
• IOS: https://apps.apple.com/nz/developer/just-eat-com/id383091095
• IOS: https://apps.apple.com/it/developer/takeaway-com-central-core-b-v/id329472762
• IOS: https://apps.apple.com/us/developer/skipthedishes/id969229980
• IOS: https://apps.apple.com/us/developer/10bis-co-il-ltd/id434368194
• URL: https://www.justeattakeaway.com
• URL: https://just-eat.io/
• URL: https://api.justeat-int.com
• URL: https://yourdelivery.de
• URL: https://just-data.io
• URL: https://jet-external.com
• OTHER: https://github.com/justeattakeaway

In Scope Assets:

• OTHER: https://marketplace.atlassian.com/apps/1215199/backbone-issue-sync-for-jira?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/1217608/scroll-documents-for-confluence?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/7019/scroll-pdf-exporter-for-confluence?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/24982/scroll-word-exporter-for-confluence?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/1217037/scroll-exporter-extensions?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/253/scroll-imagemap-for-confluence?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/1211636/scroll-viewport-for-confluence?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/1226295/variants-for-scroll-documents?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/7019/scroll-pdf-exporter-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/24982/scroll-word-exporter-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/420604/scroll-html-exporter-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/1210818/scroll-versions-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/1211616/scroll-translations-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/253/scroll-imagemap-for-confluence?hosting=datacenter&tab=overview
• OTHER: https://marketplace.atlassian.com/apps/1215199/backbone-issue-sync-for-jira?hosting=datacenter&tab=overview
• OTHER: https://marketplace.atlassian.com/apps/1217608/scroll-documents-for-confluence?hosting=datacenter&tab=overview
• OTHER: https://marketplace.atlassian.com/apps/1226295/variants-for-scroll-documents?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/1211636/scroll-viewport-for-confluence?hosting=datacenter
• OTHER: https://marketplace.atlassian.com/apps/1227238/translations-for-scroll-documents?hosting=cloud
• OTHER: https://marketplace.atlassian.com/apps/1227238/translations-for-scroll-documents?hosting=datacenter
• URL: https://marketplace.atlassian.com/apps/420604/scroll-html-exporter-for-confluence?hosting=cloud&tab=overview
• OTHER: https://marketplace.atlassian.com/apps/1224799/scroll-content-quality-for-confluence

Out of Scope Assets:

• OTHER: Any other subdomains of k15t.com, including but not limited to www.k15t.com, www.k15t.de and help.k15t.com (OOS)
• URL: https://marketplace.atlassian.com/* (OOS)

In Scope Assets:

• URL: https://www.remove.bg
• URL: https://www.designify.com
• URL: https://www.kaleido.ai
• URL: https://www.unscreen.com

In Scope Assets:

• OTHER: https://www.keepersecurity.com/download.html
• IOS: https://www.keepersecurity.com/download.html
• OTHER: https://www.microsoft.com/en-us/p/keeperchat/9pdqtcpn4kxn#activetab=pivot:overviewtab
• URL: https://keepersecurity.com
• OTHER: https://www.keepersecurity.com/download.html
• URL: https://keepersecurity.com/vault
• URL: https://docs.keeper.io/keeper-bridge/
• IOS: https://apps.apple.com/app/id1216446440
• ANDROID: https://play.google.com/store/apps/details?id=com.keepersecurity.chat&hl=en_US&gl=US
• OTHER: https://apps.apple.com/us/app/keeperchat/id1273303729?mt=12
• ANDROID: https://play.google.com/store/apps/details?id=com.callpod.android_apps.keeper&hl=en_US&gl=US
• OTHER: https://docs.keeper.io/kcm
• URL: https://keepersecurity.com/console
• URL: https://docs.keeper.io/en/v/secrets-manager
• URL: https://docs.keeper.io/sso-connect-guide/
• URL: https://docs.keeper.io/sso-connect-cloud/

In Scope Assets:

• URL: https://kw-bugcrowd-pub.bounty.kiteworks.dev/

Out of Scope Assets:

• URL: https://bugcrowd-pub.bounty.kiteworks.dev (OOS)

In Scope Assets:

• OTHER: Kohl’s entire public digital footprint that is not Out-Of-Scope(See list below)
• URL: https://www.kohls.com
• IOS: https://www.kohls.com/feature/app.jsp
• ANDROID: https://www.kohls.com/feature/app.jsp

Out of Scope Assets:

• URL: apply.kohls.com (OOS)
• URL: *kohls.com/kohlscredit/prequal (OOS)
• OTHER: *kohlsecommerce.com/kohlscredit/prequal (OOS)
• URL: corporate.kohls.com (OOS)
• URL: productchampions.kohls.com (OOS)
• URL: link-preprod.kohls.com (OOS)
• URL: developer.kohls.com (OOS)
• URL: lclive.kohls.com (OOS)
• URL: author-mykohls.kohls.com (OOS)
• URL: mykohls-origin.kohls.com (OOS)
• URL: origin-stage65-corporate.kohls.com (OOS)
• URL: origin-stage65-mykohls.kohls.com (OOS)
• URL: author-stage65-mykohls.kohls.com (OOS)
• URL: stage65-corporate.kohls.com (OOS)
• URL: stage65-mykohls.kohls.com (OOS)
• URL: author-qa65-mykohls.kohls.com (OOS)
• URL: mykohls.kohls.com (OOS)
• URL: any domain with archaius.json endoint is out of scope (OOS)
• URL: *kohls.com/feature/pre-qual/prequal_inquiry.jsp?icid=prequalfooter (OOS)
• URL: *kohls.com/checkout/prequal_inquiry.jsp#/preQualEligible (OOS)
• URL: *kohlsecommerce.com/feature/pre-qual/prequal_inquiry.jsp?icid=prequalfooter (OOS)
• URL: *kohlsecommerce.com/checkout/prequal_inquiry.jsp#/preQualEligible (OOS)
• URL: vp-*.kohls.com (OOS)
• URL: *qa*.kohls.com (OOS)
• URL: wfh*.kohls.com (OOS)
• URL: kconnect.kohls.com (OOS)
• URL: connection.kohls.com (OOS)
• URL: kohlsmerch.kohls.com/ (OOS)

In Scope Assets:

• URL: https://kucoin.com
• IOS: https://apps.apple.com/us/app/kucoin-buy-bitcoin-crypto/id1378956601?mt=8
• ANDROID: https://play.google.com/store/apps/details?id=com.kubi.kucoin

Out of Scope Assets:

• URL: support.kucoin.plus (OOS)
• URL: store.kucoin.com (OOS)
• URL: docs.kucoin.com (OOS)
• URL: intro.kucoin.com (OOS)
• URL: cert.kucoin.com (OOS)
• URL: sandbox.kucoin.com (OOS)
• URL: passport.kucoin.com (OOS)
• URL: *-sdb.kucoin.com (OOS)
• URL: *-sandbox.kucoin.com (OOS)

In Scope Assets:

• URL: https://manager.thefork.com
• URL: https://secure.thefork.com
• URL: https://payment.lafourchette.com
• URL: https://api.thefork.io
• IOS: https://apps.apple.com/app/thefork-manager-neo/id1295795281
• ANDROID: https://play.google.com/store/apps/details?id=com.lafourchette.tfm3
• URL: https://www.theforkmanager.com

Out of Scope Assets:

• URL: *.myfourchette.com (OOS)
• URL: www.myfourchette.com (OOS)
• URL: website.theforkmanager.com (OOS)
• URL: *.lafourchette.rest (OOS)
• URL: login.theforkmanager.com (OOS)
• OTHER: https://developer.thefork.io/ (OOS)

In Scope Assets:

• URL: https://lastpass.com
• OTHER: https://lastpass.com/misc_download2.php
• OTHER: https://lastpass.com/misc_download2.php
• URL: https://support.lastpass.com
• OTHER: Workstation MFA (WMFA)
• URL: https://blog.lastpass.com
• URL: https://admin.lastpass.com
• URL: https://auth.lastpass.com
• URL: https://accounts.lastpass.com
• URL: https://www.lastpass.com
• ANDROID: https://play.google.com/store/apps/details?id=com.lastpass.lpandroid
• ANDROID: https://play.google.com/store/apps/details?id=com.lastpass.authenticator&hl=en_US&gl=US
• IOS: https://apps.apple.com/us/app/lastpass-password-manager/id324613447
• IOS: https://apps.apple.com/us/app/lastpass-authenticator/id1079110004

Out of Scope Assets:

• URL: https://identity.lastpass.com (OOS)
• OTHER: Lastpass CLI tool (OOS)
• URL: https://info.lastpass.com (OOS)
• URL: https://forums.lastpass.com (OOS)

In Scope Assets:

• URL: https://api.test.latitudefinancial.com
• URL: https://master.servicecentre.digitalservicing-np.lfscnp.com/
• URL: https://master.servicecentre-nz.digitalservicing-np.lfscnp.com/
• URL: https://28degreescard.com.au
• URL: https://buyersedge.co.nz
• URL: https://carecredit.com.au
• URL: https://gemcreditline.co.nz
• URL: https://gemfinance.co.nz
• URL: https://gemvisa.com.au
• URL: *.genoapay.co.nz
• URL: *.genoapay.com
• URL: https://gomastercard.com.au
• URL: https://interestfree.com.au
• URL: *.latitudefinancial.co.nz
• URL: *.latitudefinancial.com
• URL: *.latitudefinancial.com.au
• URL: https://latitudeinfinity.com.au
• URL: *.latitudepay.com.au
• URL: *.latitudepay.com
• URL: https://umiloans.com.au
• URL: https://images.latitudepayapps.com/
• URL: https://app.latitudepayapps.com/
• URL: *.test.*.lfscnp.com
• URL: *.dev.*.lfscnp.com
• URL: *.sandbox.*.lfscnp.com
• URL: *.-np.*.lfscnp.com

Out of Scope Assets:

• URL: https://investors.latitudefinancial.com.au (OOS)
• OTHER: https://auth.latitudefinancial.com (OOS)
• OTHER: https://auth.*.latitudefinancial.com (OOS)
• OTHER: *.latitudefs.com (OOS)
• URL: https://*.my.latitudepay.com/ (OOS)
• URL: https://*.sg.latitudepay.com/ (OOS)
• URL: https://my.latitudepay.com (OOS)
• URL: https://sg.latitudepay.com (OOS)
• URL: https://t.latitudefinancial.com/* (OOS)
• URL: https://p.latitudefinancial.com (OOS)
• URL: https://payments.latitudefinancial.com/hosted/*,https://payments.latitudefinancial.com/embed/*,https://payments-api.latitudefinancial.com/* (OOS)

In Scope Assets:

• URL: https://manager.trial.lsk.lightspeed.app/
• URL: https://hq.breadcrumb.com/hq/restaurants/bounty-cafe-2/

Out of Scope Assets:

• URL: https://lightspeedhq.com/trial (OOS)
• OTHER: https://pos-admin.trial.lsk.lightspeed.app (OOS)

In Scope Assets:

• URL: https://secure.vendhq.com
• URL: https://developers.vendhq.com/
• URL: https://payment-connectors.vendhq.com/
• URL: https://www.vendhq.com/
• URL: https://store.retail.lightspeed.app
• IOS: https://apps.apple.com/us/app/ecwid-ecommerce/id626731456
• ANDROID: https://play.google.com/store/apps/details?id=com.ecwid.android&pli=1
• URL: https://app.ecwid.com/api/v3/

Out of Scope Assets:

• URL: x-series-support.lightspeedhq.com (OOS)
• URL: vendhq.force.com (OOS)
• URL: vendimageuploadcdn.global.ssl.fastly.net (OOS)
• URL: partners.vendhq.com (OOS)
• URL: track.api.vendhq.com (OOS)
• URL: your-store.vendecommerce.com (OOS)
• URL: partnerportal.vendhq.com (OOS)
• OTHER: https://support.ecwid.com/hc/en-us (OOS)
• URL: https://www.ecwid.com/ (OOS)

In Scope Assets:

• URL: proxy-production.lime.bike
• URL: web-message.lime.bike
• URL: web-message-high.lime.bike
• IOS: https://apps.apple.com/ca/app/lime-supply/id1620058457
• URL: web-production.lime.bike
• URL: external-api.lime.bike
• URL: Data.lime.bike
• IOS: https://apps.apple.com/ca/app/lime-ridegreen/id1199780189
• ANDROID: https://play.google.com/store/apps/details?id=com.limebike
• ANDROID: https://play.google.com/store/apps/details?id=com.lime.supply&hl=en_US
• URL: admintool.lime.bike
• URL: juicer.lime.bike
• URL: https://data.limeinternal.com
• URL: help.lime.bike
• URL: https://admintool.lime.bike
• URL: ops.lime.bike
• URL: https://lp.lime.bike/
• URL: https://orchard.limeinternal.com
• URL: https://www.li.me/
• URL: https://gpt.lime.bike

Out of Scope Assets:

• URL: community.li.me (bevy) (OOS)
• URL: *.airflow.limeinternal.com (legacy domain) (OOS)
• URL: https://help.li.me (Zendesk) (OOS)
• URL: *.limeinternal.com (OOS)
• URL: *.lime.bike (OOS)
• URL: https://li.me (HubSpot) (OOS)

In Scope Assets:

• URL: https://linktr.ee
• URL: https://linktree.com
• URL: https://tr.ee
• URL: *.linktree-extensions.com
• IOS: https://linktree.app.link/LinktreeWebsite?utm_medium=Linktree_Footer
• ANDROID: https://linktree.app.link/LinktreeWebsite?utm_medium=Linktree_Footer
• URL: https://*.plannthat.com
• IOS: https://apps.apple.com/au/app/plann-preview-for-instagram/id1106201141
• ANDROID: https://play.google.com/store/search?q=plann&c=apps
• URL: https://odesli.co
• URL: https://odesli.com
• URL: https://song.link
• URL: https://songlink.io
• URL: https://album.link
• URL: https://artist.link
• URL: https://pods.link
• URL: https://playlist.link
• URL: https://mylink.page

Out of Scope Assets:

• URL: https://filestack.com (OOS)
• URL: https://freshdesk.com (OOS)
• URL: https://blstr.xyz (OOS)
• URL: https://blstr.co (OOS)
• URL: https://community.linktr.ee (OOS)

In Scope Assets:

• URL: https://shop.lululemon.com
• OTHER: *.lululemon.com
• IOS: https://apps.apple.com/us/app/lululemon/id920098546
• URL: https://www.lululemon.com.au/
• URL: https://www.lululemon.de/
• URL: https://www.lululemon.es/
• URL: https://www.eu.lululemon.com/
• URL: https://www.lululemon.fr/
• URL: https://www.lululemon.com.hk/
• URL: https://www.lululemon.co.jp/
• URL: http://www.lululemon.co.kr/
• URL: https://www.lululemon.co.nz/
• URL: https://www.lululemon.co.uk/

Out of Scope Assets:

• URL: *.lululemon.cn (OOS)
• URL: https://fr.shop.lululemon.com (OOS)
• URL: https://www.lululemon.me (OOS)
• URL: https://careers.lululemon.com/ (OOS)
• URL: https://info.lululemon.com (OOS)
• URL: https://pnimage.lululemon.com (OOS)
• URL: AEM - Assets (OOS)
• URL: AEM - Sites (OOS)
• URL: https://www.mirror.co/ (OOS)

In Scope Assets:

• ANDROID: https://play.google.com/store/apps/details?hl=en&id=co.bitx.android.wallet
• IOS: https://apps.apple.com/app/bitx-wallet/id927362479
• URL: https://mobileapi.staging.luno.com/
• URL: https://staging.luno.com/
• URL: https://ajax.staging.luno.com/
• URL: https://api.staging.luno.com/
• URL: https://app.staging.luno.com/

In Scope Assets:

• URL: https://www.crateandbarrel.me
• URL: https://api-prod.thatconceptstore.com/
• IOS: https://apps.apple.com/app/id1503045795
• ANDROID: https://play.google.com/store/apps/details?id=com.maf.thatandroid
• URL: https://thatconceptstore.com
• URL: https://www.cb2.ae/en
• URL: https://www.allsaints.me/
• URL: https://www.lululemon.me
• URL: https://lapi.yellowblocks.me
• URL: https://www.shiseido.me/
• URL: lego.me
• URL: psychobunny.me
• URL: fashion4less.me

Out of Scope Assets:

• URL: www.americangirlmena.com (OOS)

In Scope Assets:

• URL: https://www.sharerewards.com/
• IOS: https://apps.apple.com/us/app/share-rewards/id1465450657
• ANDROID: https://play.google.com/store/apps/details?id=com.maf.share&hl=en_US&gl=US
• URL: https://www.vtcprodapi.maf.ae/svc/svcHifi.svc/SaveOCRReceipt
• URL: https://production.maf.auth0.com/api/v2/
• URL: https://production.maf.auth0.com
• URL: https://maf-holding-prod.apigee.net

In Scope Assets:

• URL: https://www.malloftheemirates.com
• ANDROID: https://play.google.com/store/apps/details?id=com.belongi.moe
• IOS: https://apps.apple.com/app/mall-of-the-emirates-moe/id1449578693
• URL: https://api.mafshoppingmalls.com/
• URL: https://www.premogiftcards.com
• URL: https://identity.majidalfuttaim.com

In Scope Assets:

• URL: https://www.simplify.com/commerce/
• URL: https://www.mastercard.us/en-us.html
• URL: https://www.mastercard.ch/de-ch.html
• URL: https://www.mastercard.ch/fr-ch.html
• URL: https://www.mastercard.com.au/en-au.html
• URL: https://www.mastercard.nl/nl-nl.html
• URL: https://developer.mastercard.com
• URL: https://donate.mastercard.com
• URL: https://demo.priceless.com/
• URL: https://priceless.com/golf/
• URL: https://performancemarketing.mastercard.com/portal/
• URL: https://src.mastercard.com/profile/enroll
• URL: https://src.mastercard.com/*
• URL: SRC integration on https://masterpassteststore.com/. Only the Masterpass checkout functionality is in scope
• URL: Finicity Connect
• URL: Finicity- Data Services
• URL: Finicity Decisioning
• URL: https://www.finicity.com
• URL: https://consumer.finicityreports.com
• URL: Finicity- Open Banking Payment History application
• URL: Finicity - OBB (Open Banking Business Service)
• URL: https://pioneer.truata.com/
• OTHER: Public Others Target

In Scope Assets:

• ANDROID: https://play.google.com/store/search?q=mattermost&c=apps
• IOS: https://apps.apple.com/us/app/mattermost/id1257222717
• OTHER: https://mattermost.com/apps/
• URL: https://bugcrowd-*your-own-instance*.cloud.mattermost.com/
• OTHER: https://github.com/mattermost/mattermost-plugin-jira
• OTHER: https://github.com/mattermost/mattermost-plugin-zoom
• OTHER: https://github.com/mattermost/mattermost-plugin-github
• OTHER: https://github.com/mattermost/mattermost-plugin-gitlab
• OTHER: https://github.com/mattermost/mattermost-plugin-calls
• OTHER: https://github.com/mattermost/mattermost-plugin-playbooks
• OTHER: https://github.com/mattermost/mattermost-plugin-boards
• OTHER: https://github.com/mattermost/mattermost-plugin-ai
• OTHER: https://github.com/mattermost/mattermost-plugin-mscalendar
• OTHER: https://github.com/mattermost/mattermost-plugin-msteams-meetings

In Scope Assets:

• OTHER: REDACTED
• IOS: REDACTED
• ANDROID: REDACTED
• URL: REDACTED
• URL: REDACTED

In Scope Assets:

• URL: https://mgm.mo
• URL: https://mgm.mo
• URL: https://booking.mgm.mo/
• URL: https://jobs.mgm.mo
• URL: https://static.mgm.mo
• URL: https://Mlife.mo
• URL: https://www.tickets.mgm.mo/
• IOS: https://apps.apple.com/mo/app/%E7%BE%8E%E9%AB%98%E6%A2%85%E6%9C%83%E5%93%A1%E6%9C%8D%E5%8B%99-mgm-membership-rewards/id6444925665?l=en-GB
• ANDROID: https://play.google.com/store/apps/details?id=mo.mgm.app
• URL: http://mobileapp-gaming.mgm.mo
• URL: http://mobileapp-non-gaming.mgm.mo/

Out of Scope Assets:

• URL: https://opay.icbc.com (OOS)
• URL: https://mgmchinaholdings.com (OOS)
• URL: https://hq.hero-cloud.com/ (OOS)

In Scope Assets:

• URL: https://identity.monash.edu/
• URL: mix.monash.edu
• URL: https://connect.monash.edu
• URL: https://identity.monash.edu
• URL: https://www.monash.edu
• URL: https://staff.monash
• URL: http://apps.connect.monash.edu/
• URL: eassessment.monash.edu
• URL: https://fileshare.ze.monash.edu
• URL: https://cms.mobile.monash/
• URL: https://mobile.monash/
• URL: https://status.mobile.monash/
• URL: https://monashcollege.edu.au
• URL: https://online.monash.edu/
• IOS: https://apps.apple.com/us/app/monash-study/id1462126829
• ANDROID: https://play.google.com/store/apps/details?id=edu.monash.monashmobile
• URL: https://myapp.monash.edu/
• URL: https://alumni-friends.monash.edu
• URL: https://agent.apps.monash.edu/
• URL: https://compulsoryunits.monash.edu/
• URL: https://monash.app.nutrip.com
• URL: https://*.gp.monash.edu
• URL: https://studentplacements.monash.edu
• URL: https://unihub.monash.edu/
• URL: https://interviews.monash.edu/
• URL: https://shop.monash.edu/
• URL: https://mlivetickets.monash.edu
• URL: https://partner.apps.monash.edu
• ANDROID: https://play.google.com/store/apps/details?id=com.scu.bsafe
• IOS: https://apps.apple.com/au/app/monash-bsafe/id1462241951
• URL: https://forms.apps.monash.edu/
• URL: https://formative.eassessment.monash.edu/
• URL: https://www.monashprofessional.edu.au/
• URL: https://account-registration.monash.edu/
• URL: http://pay.monashcollege.edu.au/
• URL: https://evigilation.monash.edu
• URL: https://student.monash
• URL: https://mids.monash.edu/
• URL: https://ims.monash.edu
• URL: https://research.monash.edu/
• URL: https://researchmgt.monash.edu/
• URL: https://move.monash.edu/
• URL: mix-qat.monash.edu/*
• URL: mix-dev.monash.edu/*

In Scope Assets:

• URL: https://wwws-staging.moneytree.jp/link/
• URL: https://vault-staging.getmoneytree.com
• URL: https://redash-staging.getmoneytree.com/
• URL: https://app-staging.getmoneytree.com
• URL: https://wwws-staging.moneytree.jp/link/mobile/
• URL: https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38d99a6e8e9fc87c866f5aa82bdc2569c464b2323a55e0b28f658efa678e9623&redirect_uri=https://wwws-staging.moneytree.jp/link/mobile/callback&response_type=token&scope=guest_read+accounts_read+transactions_read+request_refresh
• URL: https://myaccount-staging.getmoneytree.com
• URL: https://business-staging.getmoneytree.com/
• URL: https://jp-api-staging.getmoneytree.com
• ANDROID: https://play.google.com/store/apps/details?id=jp.moneytree.moneytree&hl=en_AU&gl=US
• IOS: https://apps.apple.com/vc/app/moneytree-finance-made-easy/id586847189

Out of Scope Assets:

• URL: moneytree.jp (OOS)
• URL: Any production asset of Moneytree KK (excepting the iOS app) (OOS)
• URL: getmoneytree.com (OOS)

In Scope Assets:

• ANDROID: https://play.google.com/store/apps/details?id=com.tranzmate&hl=en_US
• IOS: https://apps.apple.com/us/app/moovit-all-transit-options/id498477945
• IOS: https://support.moovitapp.com/hc/en-us/articles/11389054527122-WayFinder-Augmented-Reality-helper-to-find-your-stop-iPhone-only

Out of Scope Assets:

• URL: Every Web App is Out Of Scope. (OOS)
• OTHER: Every app not related to the Moovit mobile application. (OOS)
• OTHER: Any WebView sources or web application rendered within the mobile applications (OOS)

In Scope Assets:

• ANDROID: All Motorola Devices running Android 13 and above.

Out of Scope Assets:

• OTHER: Vulnerabilities related to web-app related issues (OOS)

In Scope Assets:

• URL: https://staging-prime.navan.com

Out of Scope Assets:

• OTHER: tripactions.com (OOS)

In Scope Assets:

• URL: https://secure.neogov.com
• URL: https://login.neogov.com
• URL: https://performance.neogov.com
• URL: https://learn.neogov.com
• URL: https://api.neogov.com
• URL: https://onboard.neogov.com
• URL: https://unified.neogov.com
• URL: https://eforms.neogov.com
• URL: https://cdn.neogov.com
• URL: https://www.governmentjobs.com
• URL: https://analytics.neogov.com
• URL: https://powerdms.com/
• URL: https://secure.cuehit.net
• URL: https://app.agency360.com
• URL: https://securesignin.neogov.com
• URL: https://securesignin.powerdms.com/
• URL: https://hr.neogov.com

In Scope Assets:

• IOT: Nighthawk Pro Gaming Switch
• IOT: Nighthawk Router
• IOT: Nighthawk Switch
• IOS: Nighthawk iOS App
• ANDROID: Nighthawk Android App
• IOT: Orbi
• IOS: Orbi iOS App
• ANDROID: Orbi Android App
• IOT: Insight Managed Smart Cloud Wireless Access Point
• URL: https://api.netgear.com
• IOS: Insight iOS App
• ANDROID: Insight Android App
• URL: CHP Cloud Portal
• IOT: Meural

In Scope Assets:

• URL: https://one.newrelic.com
• ANDROID: https://play.google.com/store/apps/details?id=com.newrelic.rpm
• IOS: https://apps.apple.com/ie/app/new-relic/id594038638
• OTHER: *.nr-data.net
• OTHER: *.nr-ops.net
• URL: https://docs.newrelic.com/
• URL: https://newrelic.com/
• URL: https://newrelic.com/blog
• URL: https://support.newrelic.com/
• URL: https://forum.newrelic.com
• URL: https://knowledge.newrelic.com/
• URL: https://learn.newrelic.com/
• URL: https://developer.newrelic.com/

Out of Scope Assets:

• URL: https://status.newrelic.com (OOS)
• OTHER: New Relic open source software repos in github.com not in the list of agents or on docs.newrelic.com; New Relic Example Code, New Relic Experimental and Archived repos are explicitly out of scope. (OOS)
• URL: https://iopipe.com (OOS)

In Scope Assets:

• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED
• URL: REDACTED

In Scope Assets:

• URL: Anything Owned by Northwestern Mutual on the Public Internet Not Listed as Out of Scope
• URL: 216.20.176.0/20
• URL: https://northwesternmutual.com
• URL: https://*.nml.com
• URL: https://*.nmfn.com
• ANDROID: https://play.google.com/store/apps/details?id=com.nm.nm&hl=en_US&gl=US
• IOS: https://apps.apple.com/us/app/northwestern-mutual/id1132579006
• URL: Anything that Clearly Affects Northwestern Mutual But is Not Own by Northwestern Mutual

Out of Scope Assets:

• URL: northwesternmutual.com/find-a-financial-advisor/ (OOS)
• URL: northwesternmutual.com/financial/advisor/* (OOS)
• URL: northwesternmutual.com/careers-apply/ (OOS)
• URL: northwesternmutual.com/report-a-death/ (OOS)
• URL: northwesternmutual.com/notice-of-long-term-care-form/ (OOS)
• URL: northwesternmutual.com/financial-professionals/?name=* (OOS)
• URL: northwesternmutual.com/notice-of-disability-form/ (OOS)
• URL: northwesternmutual.com/notice-of-group-disability-form/ (OOS)
• URL: Any Domain that Follows the Pattern */webforms/nmfnForms/* (OOS)
• URL: servicenmfn.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (OOS)
• URL: servicenmfnstage.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (OOS)
• URL: servicenmfntest.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (OOS)
• URL: service.nmfn.com/webforms/nmfnForms/* (OOS)
• URL: servicestage.nmfn.com/webforms/nmfnForms/* (OOS)
• URL: servicetest.nmfn.com/webforms/nmfnForms/* (OOS)
• URL: calculator.northwesternmutual.com (OOS)
• URL: clientwise.com (OOS)
• URL: cloud.em.northwesternmutual.com (OOS)
• URL: events.nmfn.com (OOS)
• URL: eventscloud.com (OOS)
• URL: ftph1.northwesternmutual.com (OOS)
• URL: gbpwealth.com (OOS)
• URL: icims.com (OOS)
• URL: ideas.northwesternmutual.com (OOS)
• URL: m3.nml.com (OOS)
• URL: metrics.northwesternmutual.com (OOS)
• URL: metricssecure.northwesternmutual.com (OOS)
• URL: mymhs.nmfn.com (OOS)
• URL: mynmcu.com (OOS)
• URL: nmcreative.space (OOS)
• URL: nmis-stage.netxinvestor.com (OOS)
• URL: nmresearchlibrary.nml.com (OOS)
• URL: northwesternmutual.starssmp.com (OOS)
• URL: northwesternmutualdigitalexplab.com (OOS)
• URL: northwesternmutualinnercircle.com (OOS)
• URL: nwm.benselect.com (OOS)
• URL: opportunities.northwesternmutual.com (OOS)
• URL: opportunities.northwesternmutual.com.career.page (OOS)
• URL: pugetsound.nmfn.com (OOS)
• URL: sparks-financial.com (OOS)
• URL: theandersonfinancialgroupnm.com (OOS)
• URL: themint.org (OOS)
• URL: u.nm.com (OOS)
• URL: northwesternmutual.jobinfo.com (OOS)

In Scope Assets:

• ANDROID: https://play.google.com/store/apps/details?id=com.nu.production&hl=pt_BR&gl=US&pli=1
• IOS: https://apps.apple.com/br/app/nubank-conta-e-cart%C3%A3o/id814456780
• URL: prod-*.nubank.com.br
• URL: prod-*.nu.com.mx
• URL: prod-*.nu.com.co
• OTHER: https://nubank.com.br/
• OTHER: https://nubank.com.mx
• OTHER: https://nubank.com.co
• URL: https://www.nuinvest.com.br/

Out of Scope Assets:

• URL: *nuinternational.com (OOS)
• OTHER: *nat-a.nubank.com.br (OOS)
• URL: international.nubank.com.br (OOS)

In Scope Assets:

• OTHER: https://octopus.com/downloads
• OTHER: https://octopus.com/downloads

In Scope Assets:

• URL: *.octopus.com
• OTHER: https://github.com/OctopusDeploy
• URL: https://octopus.com

Out of Scope Assets:

• URL: *.octopus.app (OOS)
• URL: artifactorysample.octopus.com (OOS)
• URL: bamboosample.octopus.com (OOS)
• URL: jenkinssample.octopus.com (OOS)
• URL: teamcitysample.octopus.com (OOS)
• URL: nexussample.octopus.com (OOS)
• URL: myget.octopus.com (OOS)
• URL: partners.octopus.com (OOS)
• URL: trust.octopus.com (OOS)
• OTHER: i.octopus.com (OOS)

In Scope Assets:

• OTHER: REDACTED