- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 28
- Public CVEs
- 11
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
28 assets you may test.
Wildcard domains 28
- *.1688.com Critical No bounty
- *.9apps.com Critical No bounty
- *.alibaba.com Critical No bounty
- *.alibabagroup.com Critical No bounty
- *.alibaba-inc.com Critical No bounty
- *.alibabapictures.com Critical No bounty
- *.aliexpress.com Critical No bounty
- *.aligames.com Critical No bounty
- *.alimama.com Critical No bounty
- *.alios.cn Critical No bounty
- *.alisports.com Critical No bounty
- *.aliyun.com Critical No bounty
- *.amap.com Critical No bounty
- *.cainiao.com Critical No bounty
- *.damai.cn Critical No bounty
- *.dingtalk.com Critical No bounty
- *.ele.me Critical No bounty
- *.fliggy.com Critical No bounty
- *.shuqi.com Critical No bounty
- *.shuqireader.com Critical No bounty
- *.sm.cn Critical No bounty
- *.taobao.com Critical No bounty
- *.tmall.com Critical No bounty
- *.tudou.com Critical No bounty
- *.uc.cn Critical No bounty
- *.ucweb.com Critical No bounty
- www.lazada.*sixcountry Critical No bounty
- *.youku.com Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Alibaba VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Only listed targets are in scope.
-
Unless you are absolutely sure that the IP is within the program scope, do not make any testing on it.
Not accepted
-
Vulnerabilities affecting users of outdated browsers or platforms
-
Account brute force
-
Account takeover via CSRF/OAUTH etc.
-
CRLF
-
Self-XSS
-
Flash-based XSS
-
Tabnabbing
-
Email Spoof
-
Session fixation
-
Cache Poisoning
-
Content Spoofing
-
Supplychain attack
-
Credential Leakage
-
Missing cookie flags
-
Best practices/issues
-
HTML content injection
-
Mixed content warnings
-
Clickjacking/UI redressing
-
HTTPS/SSL/TLS Related Issues
-
Physical or social engineering attacks
-
Reflected file download attacks (RFD)
-
Issues that require unlikely user interaction
-
Login/logout/unauthenticated/low-impact CSRF
-
Unverified Results of automated tools or scanners
-
No SPF/DMARC in non-email domains/subdomains
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.1688.com
-
Scope added
*.9apps.com
-
Scope added
*.alibaba-inc.com
-
Scope added
*.alibaba.com
-
Scope added
*.alibabagroup.com
-
Scope added
*.alibabapictures.com
-
Scope added
*.aliexpress.com
-
Scope added
*.aligames.com
-
Scope added
*.alimama.com
-
Scope added
*.alios.cn
-
Scope added
*.alisports.com
-
Scope added
*.aliyun.com
-
Scope added
*.amap.com
-
Scope added
*.cainiao.com
-
Scope added
*.damai.cn
-
Scope added
*.dingtalk.com
-
Scope added
*.ele.me
-
Scope added
*.fliggy.com
-
Scope added
*.shuqi.com
-
Scope added
*.shuqireader.com
-
Scope added
*.sm.cn
-
Scope added
*.taobao.com
-
Scope added
*.tmall.com
-
Scope added
*.tudou.com
-
Scope added
*.uc.cn
-
Scope added
*.ucweb.com
-
Scope added
*.youku.com
-
Scope added
www.lazada.*sixcountry
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-21699 | The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests. | High 7.5 | 22 Aug 2023 |
| CVE-2021-43116 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login. | High 8.8 | 5 Jul 2022 |
| CVE-2022-25845 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode). | High 8.1 | 10 Jun 2022 |
| CVE-2021-44667 | A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters. | Medium 6.1 | 11 Mar 2022 |
| CVE-2021-33800 | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. | High 7.5 | 3 Nov 2021 |
| CVE-2021-29441 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechan | High 8.6 | 27 Apr 2021 |
| CVE-2021-29442 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by | High 8.6 | 27 Apr 2021 |
| CVE-2020-19676 | Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284) | Medium 5.3 | 30 Sep 2020 |
| CVE-2017-18349 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java. | Critical 9.8 | 23 Oct 2018 |
| CVE-2014-5976 | The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Medium 5.4 | 20 Sep 2014 |
| CVE-2007-0827 | The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove method with an invalid index argument, which is used as an offset for a function call. | Medium 6.8 | 7 Feb 2007 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Disclosure Policy
- As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Access
Researchers are free to create their own seller, buyer, etc., accounts on the in-scope applications. No credentials or privileged access will be provided by Alibaba, so accounts are limited to what users can create on their own.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Scope
Only listed targets are in scope. Other domains/assets owned by Alibaba but not listed, are not in scope.
Things to note about the Scope
** Most of our assets have a bypass honeypot system that detects all suspected attack behaviors and randomly spoofs them. There is a high possibility the "vulnerability" you find may be the result of a honeypot spoof. This includes: RCE, XXE, SQL Injection, SSRF, Arbitrary file reading, sensitive file/conetent leakage, and so on.**
Please note that if an IP belongs to Alibaba Cloud external customer, it's not in scope. If an IP's description contains 'Alicloud' or 'Aliyun' in the search result here: http://wq.apnic.net/static/search.html, there is a high chance this IP belongs to our external Alibaba Cloud external customer, which is not in scope. But please note that this is only a reference, not a hard and fast rule. Unless you are absolutely sure that the IP is within the program scope, do not make any testing on it.
Vulnerabilities in: .anydomain.com|cn/[/]login.htm .anydomain.com|cn/[/]mini[]login.htm .anydomain.com|cn/[/]icbu[]login.htm or patterns like above URLs, will consider as only ONE valid report because of the same back-end service. Also, vulnerabilities on different params of the same URL are consider as ONE valid report. Same vulnerabilities on different country sites are consider as ONE valid report.
Aliyuncs.com Front-end vulnerabilities on aliyuncs.com is not a 'trust' domain in our business. So the XSS, CSRF, Open Redirection etc. are not in scope. But server-end vulnerabilities are in scope.
RCE RCE on non-production environment, such as a cloud server, will no higher than High severity. RCE on test environment, such as testing webservers, demo sites, etc., will no higher than Medium severity. (We have many testing severs running online, those server are used only for testing purpose. RCE on those servers dosen't have significant impact.)
Stored XSS Only stored XSS (without user interaction) on main shop page, item detail page or chatting page (buyer to Seller) can be High severity, all other kinds of stored XSS will be no higher than Medium severity. Please note that following type vulnerabilities severity will not be assessed higher than Medium severity: Vulnerabilities that requires user visit certain URL or attacker controlled URL, for example:
- Reflected XSS
- Stored XSS that need to visit certain URL or need a user interaction
- CSRF
- CORS
- Jsonp Hijacking
- OAuth Hijacking
- Privilege Escalation
- Unused or abandoned subdomain takeover
- Arbitrary file upload that only leads to Stored XSS etc.
Assessment Guidelines for SSRF Vulnerability Severity Alibaba has identified four main types of SSRF for its businesses: 1.SSRF on Production Network Services 2.Blind SSRF on Production Network Services 3.SSRF on Cloud Server 4.Blind SSRF on Cloud Server
Please note that the severity of SSRFs may range from low to critical.
Open source project of Alibaba Open source project of Alibaba and Aliyun on Github is NOT in this program's scope.
Out of scope vulnerabilities
The following finding types are specifically excluded:
- Vulnerabilities affecting users of outdated browsers or platforms
- Account brute force
- Account takeover via CSRF/OAUTH etc.
- CRLF
- Self-XSS
- Flash-based XSS
- Tabnabbing
- Email Spoof
- Session fixation
- Cache Poisoning
- Content Spoofing
- Supplychain attack
- Credential Leakage
- Missing cookie flags
- Best practices/issues
- HTML content injection
- Mixed content warnings
- Clickjacking/UI redressing
- HTTPS/SSL/TLS Related Issues
- Physical or social engineering attacks
- Reflected file download attacks (RFD)
- Issues that require unlikely user interaction
- Login/logout/unauthenticated/low-impact CSRF
- Unverified Results of automated tools or scanners
- No SPF/DMARC in non-email domains/subdomains
- Attacks requiring MITM or physical access to a user's device
- Issues related to networking protocols or industry standards
- Carriage Return Line Feed injection without direct impact (CRLF)
- Error information disclosure that cannot be used to make a direct attack
- Missing security-related HTTP headers which do not lead directly to a vulnerability
- Reports of credentials exposed by other data breaches / known credential lists
Thank you for helping keep Alibaba VDP and our users safe!