- Top reward
- No cash rewards
- Top severity paid
- High
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
1 asset you may test, 29 excluded.
Web 1
- gogogenius.stage.gogoair.cloud High No bounty
Out of scope (29)
- gogo705.com
- gogo750.com
- gogo-cards.com
- gogomuseumcafe.com
- gogo.mw
- gogosqueez.com
- gogotelugo.com
- gogotours.ca
- gogo-tours.fr
- http://gpden.gogoair.com
- http://gpmlb.gogoair.com
- https://gogo.aero
- https://gogo.to
- https://gosatcom.net
- https://satcomdirect.com.br
- https://satcomsimple.com
- https://satcomtest.com
- https://www.sdgov.gogoair.com
- legacy.gogoair.com
- www.aeroxr.com
- www.gogo574.com
- www.gogoair.com
- www.gogocloud.net
- www.gogocommercialaviation.com
- www.gogo*.*
- www.*.gogoair.*.com
- www.*gogo*.com
- www.*gogo.com
- www.gogo*.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Gogo VDP (via HackerOne)'s policy.
While testing
-
Please limit all research and testing from Monday 2PM GMT to Friday 11PM GMT
-
Exfiltrating or copying any data is strictly prohibited.
-
Only interact with accounts you own or for which you have explicit, documented permission.
-
Please add a custom HTTP header to all your testing traffic.
-
please limit requests to 10 requests per second.
Not accepted
-
Vulnerabilities without clear, reproducible steps or a working proof-of-concept (PoC).
-
Subdomain takeovers without a complete PoC.
-
Flaws in networking protocols, industry standards, or third-party software not controlled by Gogo.
-
Issues related to code, infrastructure, or services not owned or operated by Gogo.
-
Vulnerabilities requiring highly unlikely user interaction (e.g., a user manually pasting an XSS payload into their own browser).
-
Vulnerabilities that require physical access to a device, hardware modification, or social engineering.
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 43 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “DO NOT** submit ANY forms within ANY Gogo systems.”
-
Scope added
gogogenius.stage.gogoair.cloud
-
Scope added
gogo-cards.com (out of scope)
-
Scope added
gogo-tours.fr (out of scope)
-
Scope added
gogo.mw (out of scope)
-
Scope added
gogomuseumcafe.com (out of scope)
-
Scope added
gogosqueez.com (out of scope)
-
Scope added
gogotelugo.com (out of scope)
-
Scope added
gogotours.ca (out of scope)
-
Scope added
legacy.gogoair.com (out of scope)
-
Scope added
www.*.gogoair.*.com
-
Scope added
gogo705.com (out of scope)
-
Scope added
www.gogo574.com (out of scope)
-
Scope added
http://gpden.gogoair.com (out of scope)
-
Scope added
http://gpmlb.gogoair.com (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
DO NOT submit ANY forms within ANY Gogo systems.
📜 The Rules of Engagement: Our VDP Guidelines Welcome, researchers! To ensure a productive and positive partnership, we've established the following guidelines for our Vulnerability Disclosure Program. We ask that you read and adhere to these rules throughout your testing.
✈️ Our Core Principles: Your Code of Conduct Your trust is essential to us. We expect all researchers to act in good faith and uphold the highest ethical standards.
Testing Window: Please limit all research and testing from Monday 2PM GMT to Friday 11PM GMT
Rule Description
- Act in Good Faith Your activities should be focused on finding and reporting vulnerabilities, not disrupting, damaging, or harming Gogo, our systems, our data, or our users.
- Protect Our Data Exfiltrating or copying any data is strictly prohibited. Your testing should be limited to verifying the existence of a vulnerability.
- Respect User Privacy You must not access, modify, or compromise the data or privacy of our customers or employees. Only interact with accounts you own or for which you have explicit, documented permission.
🔧 Technical Guidelines for Testing To ensure the stability of our services, please follow these technical rules.
-
Identify Yourself: Please add a custom HTTP header to all your testing traffic. This helps our team distinguish your research from malicious activity.
-
Header: X-HackerOne-Research: [Your-H1-Username]
-
Responsible Automated Scanning: Automated scanning is welcome, but it must be throttled to a reasonable rate to avoid impacting our services. As a guideline, please limit requests to 10 requests per second. Excessive scanning may lead to your IP being blocked.
DO NOT submit ANY forms within ANY Gogo systems.
📝 Reporting & Disclosure: How to Work With Us Clear communication is key to a successful VDP.
- Prompt & Detailed Reports: Report any potential vulnerability to us promptly through the HackerOne platform. High-quality reports are essential for our team to validate and fix issues.
Your report must include:
- Detailed, Reproducible Steps: If we cannot reproduce the issue, we cannot triage it.
- One Vulnerability Per Report: Please submit a single, distinct vulnerability in each report. The only exception is when chaining vulnerabilities is necessary to demonstrate impact.
- First-to-Find: We operate on a first-come, first-served basis. When duplicate vulnerabilities are reported, we will only award the first reproducible report received.
- Confidentiality & Disclosure: To protect our users, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the HackerOne platform without our express written consent. Always follow HackerOne's disclosure guidelines.
🎯 Target-Rich Environment: Qualifying Vulnerabilities We are most interested in vulnerabilities that have a clear and demonstrable security impact. We encourage creative and impactful findings.
Examples include:
Web & Application Security:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Insecure Direct Object References (IDOR)
- Open Redirects (with demonstrated impact)
Authentication & Access Control:
- Authentication or Authorization Bypasses
- Privilege Escalation
- Directory Traversal
Data & Injection:
- Flaws Injection Vulnerabilities (e.g., SQL, LDAP, XML, command)
- Server-Side Code Execution (RCE)
Information & Configuration:
- Information Disclosure (with proven, real-world impact)
- Security Misconfigurations that expose sensitive data or enable a realistic attack scenario
⛔ Out of Scope: What Not to Report The following findings are considered out of scope. Reports for these issues will not be accepted.
Reports Lacking Evidence:
- Vulnerabilities without clear, reproducible steps or a working proof-of-concept (PoC).
- Subdomain takeovers without a complete PoC.
Non-Actionable or Third-Party Issues:
- Flaws in networking protocols, industry standards, or third-party software not controlled by Gogo.
- Issues related to code, infrastructure, or services not owned or operated by Gogo.
Unrealistic Scenarios:
- Vulnerabilities requiring highly unlikely user interaction (e.g., a user manually pasting an XSS payload into their own browser).
- Vulnerabilities that require physical access to a device, hardware modification, or social engineering.
Prohibited Targets & Actions:
DO NOT target onboard aircraft systems or avionics. DO NOT target internal corporate IT systems or employee-only portals. DO NOT perform Denial of Service (DoS) or resource exhaustion attacks. DO NOT engage in social engineering of Gogo staff, contractors, or customers. DO NOT attempt to create accounts within ANY Gogo systems. DO NOT submit ANY forms within ANY Gogo systems.
Thank you for your partnership in helping keep Gogo and our users safe! We look forward to your contributions.