Aeromexico VDP
By Aeromexico Vulnerability disclosure program on HackerOne aeromexico.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
This Vulnerability Disclosure Program does not offer monetary rewards or compensation of any kind.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 2 excluded.
Web 10
- https://amfacturacion.aeromexico.com Critical No bounty
- https://facturacion.aeromexico.com Critical No bounty
- https://portalfacturacioncargo.aeromexico.com Critical No bounty
- https://www.aeromexicobusiness.com Critical No bounty
- https://www.aeromexico.com/es-mx/aeromexico-rewards Critical No bounty
- https://www.aeromexicorewards.com Critical No bounty
- https://www.aeromexicovacations.com Critical No bounty
- http://www.aeromexico-delta.com Medium No bounty
- http://www.delta-aeromexico.com Medium No bounty
- http://www.vuela.aeromexico.com Low No bounty
Wildcard domains 3
- *.aeromexico.com Critical No bounty
- *.amlab7.com Medium No bounty
- www.aeromexico.com* Critical No bounty
Out of scope (2)
- https://www.aeromexico.com
- *www.aeromexico.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Aeromexico VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
-
Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
-
Researchers should add headers to requests such as: X-HackerOne-Research: [H1 username]
-
Post-exploitation of any vulnerability, including any loss-integrity modification or destruction of data.
-
Brute force, dictionary or password spraying attacks leading to account take over.
-
DOS/DDOS attacks.
-
Social engineering, phishing, vishing nor any type of social engineering attack.
-
Penetration testing to any infrastructure component.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 57 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Aeromexico Vulnerability Disclosure Policy
Aeromexico proudly looks forward to collaborating with the cybersecurity’s researcher community in order to keep our systems and information safe and resilient. This program is designed to engage with researchers to responsibly report any vulnerability achieving enhanced cybersecurity defenses. By participating in this program, you adhere to the requirements of the Hacker One Community Member Terms and Conditions (https://www.hackerone.com/terms/community) and Hacker One Vulnerability Disclosure Guidelines (https://www.hackerone.com/disclosure-guidelines), excepting for those conditions explicitly stated in this policy.
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization. Follow HackerOne's disclosure guidelines (https://www.hackerone.com/disclosure-guidelines).
Eligibility requirements In order to responsibly disclosure any vulnerability and to comply with the organization’s Vulnerability Disclosure Policy, the listed conditions must be followed:
Aeromexico does not accept vulnerability submissions from current employees, contractors, or their immediate family members.
This Vulnerability Disclosure Program does not offer monetary rewards or compensation of any kind.
Vulnerabilities in scope Any type of Cross site scripting (Stored, Reflected, DOM).
Any type of Injection (SQL, OS, XML).
Cross site request forgery (CSRF/XSRF) on authenticated forms or forms with sensitive actions.
Security misconfigurations with significant impact.
Business logic abuse with significant impact
Authentication/authorization bypass (broken access control).
Directory traversal - local file inclusion.
CRFL (Carriage Return Line Feed) attack.
Privilege Escalation (lateral and vertical).
Vulnerabilities out of scope When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
[List of out-of-scope items, unchanged por brevedad aquí, pero completamente incluido en el archivo.]
Scope Leniency This program will not accept submissions for assets that are not listed as in scope.
Program Rules Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
Session Layer: HTTP Headers Researchers should add headers to requests such as:
X-HackerOne-Research: [H1 username]
Restrictions The following actions are strictly prohibited:
Post-exploitation of any vulnerability, including any loss-integrity modification or destruction of data.
Brute force, dictionary or password spraying attacks leading to account take over.
DOS/DDOS attacks.
Social engineering, phishing, vishing nor any type of social engineering attack.
Penetration testing to any infrastructure component.
Testing any avionics system such as navigation system, entertainment system, aircraft’s Wi-Fi system.
Physical attacks within the proximity of aircrafts or airport facilities.
Note: Any non-compliance with this policy shall be considered as grounds for disqualification.
Thank you for helping keep Aeromexico and our users safe!