Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Alshaya

By Alshaya Group Vulnerability disclosure program on HackerOne alshaya.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
182
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 1 day
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 1 days | First Response | 1 day |
Safe harbor
Full Golden Standard Safe Harbor applies.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

182 assets you may test, 7 excluded.

Wildcard domains 81

  • *.ahwetzeitounakuwait.com Critical No bounty
  • *.aloyoga.ae Critical No bounty
  • *.aloyoga.com.kw Critical No bounty
  • *.aloyoga.com.qa Critical No bounty
  • *.alshaya.com Critical No bounty
  • *.alshayaenterprises.com Critical No bounty
  • *.americaneagle.ae Critical No bounty
  • *.americaneagle.com.bh Critical No bounty
  • *.americaneagle.com.eg Critical No bounty
  • *.americaneagle.com.jo Critical No bounty
  • *.americaneagle.com.kw Critical No bounty
  • *.americaneagle.com.qa Critical No bounty
  • *.americaneagle.com.sa Critical No bounty
  • *.amitinoura.com Critical No bounty
  • *.aura-mena.com Critical No bounty
  • *.aura-mena-uat.alshaya.com Critical No bounty
  • *.babelkwt.com Critical No bounty
  • *.bathandbodyworks.ae Critical No bounty
  • *.bathandbodyworks.com.bh Critical No bounty
  • *.bathandbodyworks.com.eg Critical No bounty
  • *.bathandbodyworks.com.kw Critical No bounty
  • *.bathandbodyworks.com.qa Critical No bounty
  • *.bathandbodyworks.com.sa Critical No bounty
  • *.bathandbodyworks.com.tr Critical No bounty
  • *.bathandbodyworks.jo Critical No bounty
  • *.bathandbodyworks.pl Critical No bounty
  • *.bathandbodyworks.ro Critical No bounty
  • *.bebabelkuwait.com Critical No bounty
  • *.bouchonbakeryme.com Critical No bounty
  • *.carrier.alshaya.com Critical No bounty
  • *.debenhams.ae Critical No bounty
  • *.debenhams.com.kw Critical No bounty
  • *.debenhams.sa Critical No bounty
  • *.footlocker.ae Critical No bounty
  • *.footlocker.com.bh Critical No bounty
  • *.footlocker.com.eg Critical No bounty
  • *.footlocker.qa Critical No bounty
  • *.kidzaniakuwait-tickets.com Critical No bounty
  • *.lepainquotidienme.com Critical No bounty
  • *.mothercare.ae Critical No bounty
  • *.mothercare.com.eg Critical No bounty
  • *.mothercare.com.kw Critical No bounty
  • *.mothercare.com.sa Critical No bounty
  • *.mothercare.qa Critical No bounty
  • *.muji.ae Critical No bounty
  • *.muji.bh Critical No bounty
  • *.muji.com.kw Critical No bounty
  • *.muji.com.sa Critical No bounty
  • *.muji.qa Critical No bounty
  • *.payless.com.kw Critical No bounty
  • *.paylessshoes.ae Critical No bounty
  • *.pfchangsme.com Critical No bounty
  • *.pinkberryme.com Critical No bounty
  • *.pizzaexpresskw.com Critical No bounty
  • *.potterybarn.ae Critical No bounty
  • *.potterybarn.com.kw Critical No bounty
  • *.potterybarn.com.sa Critical No bounty
  • *.potterybarnkids.ae Critical No bounty
  • *.potterybarnkids.com.kw Critical No bounty
  • *.potterybarnkids.com.sa Critical No bounty
  • *.raisingcanesme.com Critical No bounty
  • *.shakeshack.co.uk Critical No bounty
  • *.shaya.com.tr Critical No bounty
  • *.shayakahve.com.tr Critical No bounty
  • *.starbucks.az Critical No bounty
  • *.starbuckscardtr.com Critical No bounty
  • *.starbucks.com.kz Critical No bounty
  • *.starbucks.com.tr Critical No bounty
  • *.supplier.alshaya.com Critical No bounty
  • *.tamanna.com Critical No bounty
  • *.tekzone.me Critical No bounty
  • *.victoriassecret.ae Critical No bounty
  • *.victoriassecret.com.kw Critical No bounty
  • *.victoriassecret.com.qa Critical No bounty
  • *.victoriassecret.com.sa Critical No bounty
  • *.victoriassecret.com.tr Critical No bounty
  • *.victoriassecret.pl Critical No bounty
  • *.visionexpress.me Critical No bounty
  • *.westelm.ae Critical No bounty
  • *.westelm.com.kw Critical No bounty
  • *.westelm.com.sa Critical No bounty

Web 78

  • ae.boots.com Critical No bounty
  • ae.charlottetilbury.com Critical No bounty
  • ae.cos.com Critical No bounty
  • ae.cosstores.com Critical No bounty
  • ae.hm.com Critical No bounty
  • ae.shopjustice.me Critical No bounty
  • apigw.dev.alshaya.com Critical No bounty
  • apps.havelockone.com Critical No bounty
  • bakimonarim.shaya.com.tr Critical No bounty
  • bn.boots.com Critical No bounty
  • boysweb.shaya.com.tr Critical No bounty
  • boyswebtest.shaya.com.tr Critical No bounty
  • card.starbucks.com.kz Critical No bounty
  • ccareapuat.alshaya.com Critical No bounty
  • cloudconnect.havelockone.com Critical No bounty
  • cloud.havelockone.com Critical No bounty
  • coms.carrier.alshaya.com Critical No bounty
  • comsuat.carrier.alshaya.com Critical No bounty
  • customercare.alshaya.com Critical No bounty
  • dev.alshaya.com Critical No bounty
  • devimages.alshaya.com Critical No bounty
  • eg.hm.com Critical No bounty
  • gtmsservice.alshaya.com Critical No bounty
  • internaljobs.alshaya.com Critical No bounty
  • jenkins.alshaya.com Critical No bounty
  • jobsearch.alshaya.com Critical No bounty
  • kuwait.kidzania.com Critical No bounty
  • kw.boots.com Critical No bounty
  • kw.charlottetilbury.com Critical No bounty
  • kw.cos.com Critical No bounty
  • kw.cosstores.com Critical No bounty
  • kw.hm.com Critical No bounty
  • kw.shopjustice.me Critical No bounty
  • media.bathandbodyworks.ro Critical No bounty
  • media.victoriassecret.cz Critical No bounty
  • mft.dev.alshaya.com Critical No bounty
  • odi.dev.alshaya.com Critical No bounty
  • onlinepos.shaya.com.tr Critical No bounty
  • onlinestaffstore.alshaya.com Critical No bounty
  • opsassistbrandedsolutions.shaya.com.tr Critical No bounty
  • parallels.havelockone.com Critical No bounty
  • pmp.shaya.com.tr Critical No bounty
  • prodimages.alshaya.com Critical No bounty
  • qa.charlottetilbury.com Critical No bounty
  • qa.hm.com Critical No bounty
  • qt.boots.com Critical No bounty
  • sa.boots.com Critical No bounty
  • sa.charlottetilbury.com Critical No bounty
  • sa.cos.com Critical No bounty
  • sa.cosstores.com Critical No bounty
  • sa.hm.com Critical No bounty
  • sa.shopjustice.me Critical No bounty
  • sbuxopsassist.shaya.com.tr Critical No bounty
  • soa.dev.alshaya.com Critical No bounty
  • starbucks.az Critical No bounty
  • suppliertraining.alshaya.com Critical No bounty
  • tracking.victoriassecret.cz Critical No bounty
  • victoriassecretbeauty.ro Critical No bounty
  • victoriassecret.cz Critical No bounty
  • victoriassecret.ro Critical No bounty
  • vpn.shaya.com.tr Critical No bounty
  • www.ahwetzeitounakuwait.com Critical No bounty
  • www.amitinoura.com Critical No bounty
  • www.babelkwt.com Critical No bounty
  • www.bathandbodyworks.ro Critical No bounty
  • www.bebabelkuwait.com Critical No bounty
  • www.bouchonbakeryme.com Critical No bounty
  • www.customercare.alshaya.com Critical No bounty
  • www.dev.alshaya.com Critical No bounty
  • www.havelockone.com Critical No bounty
  • www.lepainquotidienme.com Critical No bounty
  • www.pfchangsme.com Critical No bounty
  • www.pinkberryme.com Critical No bounty
  • www.pizzaexpresskw.com Critical No bounty
  • www.raisingcanesme.com Critical No bounty
  • www.shayakahve.com.tr Critical No bounty
  • www.starbucks.az Critical No bounty
  • www.victoriassecretbeauty.ro Critical No bounty

iOS apps 13

  • 6472633752 Critical No bounty
  • AE + Aerie Middle East_MENA_IOS_1547602361 Critical No bounty
  • Alo GCC_GCC_IOS_1664702687 Critical No bounty
  • Aura MENA - Rewarding Loyalty_MENA_IOS_1532694353 Critical No bounty
  • Bath&BodyWorks_MENA_IOS_1541576878 Critical No bounty
  • Boots Middle East_MENA_IOS_1537064114 Critical No bounty
  • Debenhams MENA_MENA_IOS_1603834040 Critical No bounty
  • Foot Locker MENA_MENA_IOS_1563808574 Critical No bounty
  • H&M MENA - Shop Fashion Online_MENA_IOS_1445040108 Critical No bounty
  • id6472633752 Critical No bounty
  • Mothercare MENA Baby/Kids Shop_MENA_IOS_1563370517 Critical No bounty
  • starbucks-t%C3%BCrkiye/id1100698915?l=tr Critical No bounty
  • Victoria's Secret MENA_MENA_IOS_1559906965 Critical No bounty

Android apps 10

  • AE + Aerie Middle East_MENA_ANDROID_com.aeo.mena Critical No bounty
  • Alo GCC_GCC_ANDROID_com.aloyoga.mena Critical No bounty
  • Aura MENA - Rewarding Loyalty_MENA_ANDRIOD_com.alshaya.aura Critical No bounty
  • Bath&BodyWorks_MENA_ANDROID_com.bbw.mena Critical No bounty
  • com.chipotle.mena Critical No bounty
  • com.starbucks.tr Critical No bounty
  • Foot Locker MENA_MENA_ANDROID_com.footlocker.mena Critical No bounty
  • H&M MENA - Shop Fashion Online_MENA_ANDROID_com.hm.mena Critical No bounty
  • Mothercare MENA_MENA_ANDROID_com.mothercare.mena Critical No bounty
  • Victoria's Secret MENA_MENA_ANDROID_com.vs.mena Critical No bounty
Out of scope (7)
  • crm.alshayamarketing.com
  • thebodyshop.cz
  • *.thebodyshop.com.bh
  • *.thebodyshop.com.kw
  • *.thebodyshop.com.tr
  • *.thebodyshop.pl
  • *.thebodyshop.qa

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Alshaya (via HackerOne)'s policy.

While testing

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Do not use automated scanners/tools (Such as Tenable/Nessus, Qualys, WebInspect, Acunetix or any other automated tool)
  • Do no perform DoS/DDoS tests and spamming.
  • Do not threaten or attempt to extort Alshaya.
  • Do not exploit beyond what is necessary to demonstrate vulnerability presence.
  • You must notify Alshaya immediately if you access, modify, delete, or store Alshaya data.

Not accepted

  • Clickjacking on pages with no sensitive actions
  • Unauthenticated/logout/login CSRF
  • Insecure Cookie Settings on non-sensitive cookies
  • Information regarding software versions or web server versions/banners where there is no evidence these versions are impacted by a security flaw
  • Attacks requiring MITM or physical access to a user's device
  • Previously known vulnerable libraries without a working Proof of Concept
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability
  • Known SSL issues
  • SSL Forward Secrecy or HSTS not enabled
  • Weak SSL/TLS cipher suites
  • Content spoofing and text injection issues without showing an attack vector or without being able to modify HTML/CSS
  • Subdomain takeovers without a complete proof of concept
  • Missing email best practices (e.g., invalid, incomplete, or missing SPF/DKIM/DMARC records)
  • Missing security headers
  • Spam vulnerability, mail spoofing, mail bomb, etc
  • Self-XSS

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    *.aura-mena-uat.alshaya.com

  2. Scope added

    id6472633752

  3. Scope added

    apigw.dev.alshaya.com

  4. Scope added

    media.bathandbodyworks.ro

  5. Scope added

    media.victoriassecret.cz

  6. Scope added

    mft.dev.alshaya.com

  7. Scope added

    odi.dev.alshaya.com

  8. Scope added

    soa.dev.alshaya.com

  9. Scope added

    tracking.victoriassecret.cz

  10. Scope added

    www.customercare.alshaya.com

  11. Scope added

    www.dev.alshaya.com

  12. Scope added

    www.starbucks.az

  13. Scope added

    www.victoriassecretbeauty.ro

  14. Scope added

    com.starbucks.tr

  15. Scope added

    starbucks-t%C3%BCrkiye/id1100698915?l=tr

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

About Alshaya Group

  • Alshaya Group is a dynamic family-owned enterprise, first established in Kuwait in 1890. With a consistent record of growth and innovation, Alshaya Group is one of the world’s leading brand franchise operators, offering an unparalleled choice of well-loved international brands to customers.
  • Alshaya Group’s portfolio extends across MENA, Türkiye and Europe, with thousands of stores, cafes, restaurants and leisure destinations, as well as a growing online and digital business.
  • Operating in multiple sectors including Fashion, Food, Health & Beauty, Pharmacy, Home Furnishings and Leisure & Entertainment, Alshaya Group colleagues are united by a commitment to authentically deliver great customer service and brand experiences.
  • Fresh, modern and relevant, Alshaya’s constantly evolving portfolio reflects the choices and lifestyle of its customers. From flagship stores and restaurants in prestige malls, through to local coffee shops, drive-thrus and online, Alshaya Group brings customers the brands they love in the places they want to be. Brands such as Starbucks, H&M, Mothercare, Debenhams, American Eagle Outfitters, P.F. Chang’s, The Cheesecake Factory, The Body Shop, M.A.C, Victoria’s Secret, Boots, Pottery Barn and KidZania.
  • In addition to its retail operations, the Alshaya Group is active in several other sectors, including real estate, automotive, hotels, trading and investments. Learn more about the company at www.alshaya.com or on Instagram https://www.instagram.com/alshayagroup/, and Facebook at www.facebook.com/Alshaya.

Information Security at Alshaya

At Alshaya we take Cybersecurity seriously and our Information Security Team is working hard to protect Alshaya information assets, services and products and the confidentiality of customer information. It's one of our top priorities to make sure we comply with all up-to-date security requirements and prove that our customers data is always safeguarded.

Purpose

Knowing that the global security research community frequently makes contributions to the security of the Internet, Alshaya believes that a relationship with this community will also improve our security. As a result, if you have information about a vulnerability, we want to hear from you! This is a VDP (Vulnerability Disclosure Program) which is part of Alshaya efforts to collaborate between outside security researchers and Alshaya. If you are a security researcher or expert and believe you’ve identified security-related issues with any of the Alshaya in-scope assets, we would appreciate you disclosing it to us responsibly. By submitting a report, you acknowledge and agree to the terms and conditions contained in this Policy. You also acknowledge that, to the extent they are not inconsistent with this Policy; you are subject to:

Response Targets

Alshaya will make a best effort to meet the following SLAs for hackers participating in our program:

Type of Response SLA in business days
First Response 1 day
Time to Triage 3 to 5 days
Time to Resolution depends on severity and complexity

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

Program Rules

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • You must not collect, disclose, destroy, compromise, alter, interfere with, or transfer any proprietary or confidential Alshaya or data belonging to Alshaya business partners, customers, employees, franchisees, owners, shareholders, vendors, or any other party directly or indirectly affiliated with Alshaya. Actions such as storing Alshaya data in public internet services such as Pastebin are strictly prohibited. You must notify Alshaya immediately if you access, modify, delete, or store Alshaya data.
  • Do not use automated scanners/tools (Such as Tenable/Nessus, Qualys, WebInspect, Acunetix or any other automated tool)
  • You should also use your best effort not to harm the availability or stability of our services. Do no perform DoS/DDoS tests and spamming.
  • All submissions must also abide by HackerOne Code of Conduct
  • Do not threaten or attempt to extort Alshaya. We will not recognize your efforts if you threaten to withhold the security issue from us or if you threaten to release the vulnerability or any exposed data to the public.
  • Alshaya may change the rules of the Vulnerability Disclosure Program at any time.
  • Do not exploit beyond what is necessary to demonstrate vulnerability presence.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • Clickjacking on pages with no sensitive actions
  • Unauthenticated/logout/login CSRF
  • Insecure Cookie Settings on non-sensitive cookies
  • Bugs requiring inordinate amounts of user interaction or prior knowledge of user secrets such as session tokens or CSRF values
  • Information regarding software versions or web server versions/banners where there is no evidence these versions are impacted by a security flaw
  • Attacks requiring MITM or physical access to a user's device
  • Previously known vulnerable libraries without a working Proof of Concept
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability
  • Known SSL issues
  • SSL Forward Secrecy or HSTS not enabled
  • Weak SSL/TLS cipher suites
  • Common Automated Tooling including Acunetix, Nessus, and Qualys ammong otherss should be avoided; however, use of Burp Suite and other custom tools are allowed
  • Any activity that could lead to the disruption of our service (DoS)
  • Content spoofing and text injection issues without showing an attack vector or without being able to modify HTML/CSS
  • Avoid privacy violations, destruction of data, and interruption or degradation of our services
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited
  • Do not test the physical security of Alshaya properties
  • Vulnerabilities disclosed without a working proof-of-concept or clear reproducible steps
  • Subdomain takeovers without a complete proof of concept
  • Attacks which require internal network access or are from Alshaya employees or contractors
  • Attacks requiring MITM or physical access to a user's device
  • Missing email best practices (e.g., invalid, incomplete, or missing SPF/DKIM/DMARC records)
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
  • Missing security headers
  • Spam vulnerability, mail spoofing, mail bomb, etc
  • Self-XSS

Safe Harbor

Golden Standard Safe Harbor applies.

Thank you for helping keep Alshaya and our users safe!