JetBlue
Vulnerability disclosure program on HackerOne jetblue.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 16
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Full
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, and will work with you to understand and resolve the issue quickly.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
16 assets you may test, 9 excluded.
Web 15
- accounts.jetblue.com Critical No bounty
- api.jetblue.com Critical No bounty
- api.paisly.jetblue.com Critical No bounty
- azrest.jetblue.com Critical No bounty
- book.jetblue.com Critical No bounty
- checkin.jetblue.com Critical No bounty
- experience.jetblue.com Critical No bounty
- help.jetblue.com Critical No bounty
- jetbluevacations.com Critical No bounty
- magnolia.jetblue.com Critical No bounty
- mobile.jetblue.com Critical No bounty
- movil.jetblue.com Critical No bounty
- paisly.jetblue.com Critical No bounty
- www.jetblue.com Critical No bounty
- www.truebluetravel.com Critical No bounty
Wildcard domains 1
- *.jetblue.com Critical No bounty
Out of scope (9)
- Vendor/Partner
- bluesky.cl
- interstitials.travelproducts.jetblue.com
- irisimagegenprd.travelproducts.jetblue.com
- jbdealsfeed-stgnew.jetblue.com
- oe.travelproducts.jetblue.com
- prod.travelproducts.jetblue.com
- travelproducts.jetblue.com
- www.bluesky.cl
Rules
What the policy asks of you, and the bug types it won't reward, quoted from JetBlue (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
You must comply with all applicable laws while carrying out your research.
-
Do not submit a high volume of low-quality reports obtained by the use of automated scanning tools.
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
-
Only use exploits to the extent necessary to confirm a vulnerability.
-
Once you’ve established that a vulnerability exists, or encountered any of the sensitive data outlined below, you must stop your test and notify us immediately.
-
Keep confidential any information about discovered vulnerabilities.
Not accepted
-
Network denial of service (DoS or DDoS) tests.
-
Physical security compromises
-
Social Engineering
-
Spamming and Phishing
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
JetBlue is committed to protecting the security of our systems and our customer's information. To meet our goals, we encourage and support ethical security researchers in reporting vulnerabilities they’ve discovered, in accordance with this Vulnerability Disclosure Policy.
This policy describes what systems and types of research are covered under this policy and how to send us vulnerability reports. By submitting information about a potential vulnerability, you agree to this Policy.
Guidelines
- You must comply with all applicable laws while carrying out your research.
- Inform us as soon as possible, upon discovery of a potential security vulnerability. We will prioritize and remediate the reported vulnerability at our sole discretion.
- Do not submit a high volume of low-quality reports obtained by the use of automated scanning tools.
- Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
- Only use exploits to the extent necessary to confirm a vulnerability. Do not use an exploit to compromise or extract data, establish command line access and/or persistence, or use the exploit to “pivot” to other systems. Once you’ve established that a vulnerability exists, or encountered any of the sensitive data outlined below, you must stop your test and notify us immediately.
- Keep confidential any information about discovered vulnerabilities.
Scope
Any services not expressly listed in the Scope section, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in JetBlue systems from our business partners fall outside of this policy’s scope and should be reported directly to the business partner according to their disclosure policy (if any).
The following test types are not authorized:
- Network denial of service (DoS or DDoS) tests.
- Physical security compromises
- Social Engineering
- Spamming and Phishing
If you encounter any of the below on our systems while testing within the scope of this policy, stop your testing and report it to the program immediately:
- Personally identifiable information
- Financial information (e.g. credit card or bank account numbers)
- Proprietary information or trade secrets of companies of any party
- Any other data that is not intentionally shared over public filings, web pages etc.
Authorization
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, and will work with you to understand and resolve the issue quickly.
Reporting a Vulnerability
Reports should include:
- Description of the location and potential impact of the vulnerability.
- A detailed description of the steps required to reproduce the vulnerability. Proof of concept (POC) scripts, screenshots, and screen captures are all helpful. Please use extreme care to properly label and protect any exploit code.
- Any technical information and related materials we would need to reproduce the issue.
Please keep your vulnerability reports current by updating your report with any new information as it becomes available. We may share your vulnerability reports with any affected business partners.
Coordinated Disclosure
At JetBlue, we believe that public disclosure of vulnerabilities is an essential part of the vulnerability disclosure process, and that one of the best ways to make software better is to enable everyone to learn from each other’s mistakes.
At the same time, we believe that disclosure in absence of a readily available patch tends to increase risk rather than reduce it, and so we ask that you refrain from sharing your report with others while we work on our patch. If you believe there are others that should be informed of your report before the patch is available, please let us know so we can make arrangements.
We may want to coordinate an advisory with you to be published simultaneously with the patch, but you are also welcome to self-disclose if you prefer. By default, we prefer to disclose everything, but we will never publish information about you or our communications with you without your permission. In some cases, we may also have some sensitive information that should be redacted, and so please check with us before self-disclosing.