Expedia Group VDP
By Expedia Group Vulnerability disclosure program on HackerOne expediagroup.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 33
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
==Please note this is a vulnerability disclosure program and does **not** award bounty.==
- Response
-
Within 2 days
Time to first response (from report submit) - 2 business days
- Safe harbor
-
Partial
If your activities are conducted in a manner consistent with these guidelines and legal action is initiated by a third party against you in connection with such activities, we will take steps to make it known that your actions were conducted in compliance with this policy.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
33 assets you may test, 5 excluded.
Wildcard domains 26
- *.abritel.fr Critical No bounty
- *.bookabach.co.nz Critical No bounty
- *.carrentals.com Critical No bounty
- *.cheaptickets.com Critical No bounty
- *.cruiseshipcenters.com Critical No bounty
- *.ean.com Critical No bounty
- *.ebookers.com Critical No bounty
- *.expedia.com Critical No bounty
- *.expediagroup.com Critical No bounty
- *.expediapartnercentral.com Critical No bounty
- *.expediapartnersolutions.com Critical No bounty
- *.fewo-direkt.de Critical No bounty
- *.flights.com Critical No bounty
- *.homeaway.com Critical No bounty
- *.hotels.com Critical No bounty
- *.hotwire.com Critical No bounty
- *.hotwirepartnercentral.com Critical No bounty
- *.lastminute.com.au Critical No bounty
- *.lastminute.co.nz Critical No bounty
- *.mrjet.se Critical No bounty
- *.orbitz.com Critical No bounty
- *.stayz.com.au Critical No bounty
- *.travelocity.ca Critical No bounty
- *.travelocity.com Critical No bounty
- *.vrbo.com Critical No bounty
- *.wotif.com Critical No bounty
Web 4
- http://www.cruiseshipcenters.com/api/searchcenter Critical No bounty
- www.ebookers.fi Critical No bounty
- www.expedia-aarp.com Critical No bounty
- www.vrbo.com Critical No bounty
Android apps 1
- com.expediapartnercentral Critical No bounty
iOS apps 1
- 987675995 Critical No bounty
Products and areas 1
- Other Expedia-owned Asset Critical No bounty
Out of scope (5)
- *.egadvertising.com
- *.expediaagents.com
- *.expediacruises.com
- *.hoteis.com
- *.hoteles.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Expedia Group VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
If registering for accounts on Expedia assets, please use your @wearehackerone.com email alias.
-
If you use automated scanners, please set a header with your HackerOne username in your scanner requests to help us distinguish researcher traffic from malicious activity.
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own.
-
Please combine reports if the same or similar root cause affects multiple endpoints, subdomains or assets.
-
Please reach out to us at [email protected] *before* engaging in conduct that is not addressed by this program policy.
Not accepted
-
Clickjacking on pages with no sensitive actions.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Any activity that could lead to the disruption of our service (DoS).
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Physical or social engineering attempts (this includes phishing attacks against EG employees).
-
Disclosure of known public files or directories.
-
Use of outdated software / library versions.
-
Reports from automated tools or scans.
-
Mail configuration issues including SPF, DKIM, DMARC settings.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 57 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
==Please note this is a vulnerability disclosure program and does not award bounty.==
Vulnerability Disclosure Guidelines
Expedia Group recognizes the important role that security researchers play in helping to keep Expedia Group and our customers secure. By submitting a vulnerability to us either directly or indirectly you acknowledge that you have read and agree to abide by these guidelines.
If you believe you’ve discovered a security bug or vulnerability, please report it to us as soon as possible.
We thank you in advance for your contributions to our vulnerability disclosure program and look forward to working with you!
Expedia Group’s global Security team manages the receipt and internal coordination of security vulnerabilities related to Expedia properties. We aim to keep all involved parties, both internal and external, informed of our progress on validating and remediating reported vulnerabilities.
Assets in scope for our vulnerability disclosure program include web and Mobile applications for: *.expedia.com, *.hotwire.com, *.orbitz.com, *.hotels.com, *.homeaway.com, *.cheaptickets.com, *.travelocity.com, *.wotif.com, *.cruiseshipcenters.com, *.lastminute.com.au, *.carrentals.com, *.expediapartnercentral.com
*Please note .lastminute.com is NOT owned by Expedia Group and is out of scope.
| Mobile Asset | iOS | Android | Windows |
|---|---|---|---|
| ExpediaPartnerCentral | iOS | Android | |
| Carrentals | iOS | Android |
Testing
If registering for accounts on Expedia assets, please use your @wearehackerone.com email alias.
If you use automated scanners, please set a header with your HackerOne username in your scanner requests to help us distinguish researcher traffic from malicious activity. (For example: X-hackerone: your_username)
Response Targets
Expedia Group will make a best effort to meet the following response targets for hackers participating in our program:
- Time to first response (from report submit) - 2 business days
- Time to triage (from report submit) - 2 business days
- Time to resolution - varies by severity, 2 to 120+ days
Disclosure Policy
- Do not disclose your reported findings to others until we’ve had an opportunity to respond and address them. By keeping your reports private until we resolve them, you’re helping keep Expedia Group secure for our entire community.
- Disclosure requests must be coordinated with and approved by Expedia Group.
- To the extent that you disclose information about a vulnerability that has been fixed, you will remove all identifying information and not use Expedia Group’s name or trademarks or logos in your disclosure, or represent that any work provided by you was approved or endorsed by Expedia Group.
- To the extent that you have discovered an otherwise unreported vulnerability within an Open Source module or component in use on an Expedia Group site, you may disclose in accordance with HackerOne’s Disclosure Guidelines, as long as you remove all references to Expedia Group.
- Please reach out to us at [email protected] before engaging in conduct that is not addressed by this program policy.
Program Rules
These Vulnerability Disclosure Guidelines are limited to security vulnerabilities in Expedia Group-owned assets
- Please provide detailed reports with reproducible steps.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own.
- Please combine reports if the same or similar root cause affects multiple endpoints, subdomains or assets.
- Many of our sites share a common platform. Because of this, a vulnerability reported on one domain may exist on another domain if the sites are in the same platform. For example, an issue reported for expedia.com may also be present in the exact same way on expedia.co.in and the issue can be resolved on both sites with the same fix. We ask that you take the time to replicate the issue in other sites, and if replicating, please include all occurrences in one report instead of submitting them as multiple reports. We treat the issue as a single vulnerability and will close out others as duplicates.
#Out of scope vulnerabilities When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Clickjacking on pages with no sensitive actions.
- Unauthenticated/logout/login CSRF.
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Any activity that could lead to the disruption of our service (DoS).
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Physical or social engineering attempts (this includes phishing attacks against EG employees).
- Disclosure of known public files or directories.
- Use of outdated software / library versions.
- Reports from automated tools or scans.
- Mail configuration issues including SPF, DKIM, DMARC settings.
Safe Harbor
If your activities are conducted in a manner consistent with these guidelines and legal action is initiated by a third party against you in connection with such activities, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Expedia Group and our users safe!