Marriott Bug Bounty Program
By Marriott Bug bounty on HackerOne marriott.com
- Top reward
- $11,000
- Top severity paid
- Critical
- Assets in scope
- 59
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $11,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$11,000 from $8,001 |
| High |
|
$8,000 from $6,000 |
| Medium |
|
$3,429 from $600 |
| Low |
|
$599 from $300 |
- Response
-
Within 2 days
| First Response | 2 days |
- Safe harbor
-
Full
Marriott supports good-faith security research and will honor Safe Harbor protections when rules are followed.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
59 assets you may test, 40 excluded.
Web 50
- apcgateway.marriott.com High
- app-insiders.marriott.com Medium
- auth-apc.marriott.com High
- bilt.marriott.com Medium
- bpa2.marriott.com High
- bsp.marriott.com Medium
- channel-portal.homes-and-villas.marriott.com Medium
- ci-propertyconversionportal.marriott.com Medium
- contentportalauth.marriott.com Medium
- contentportal.marriott.com Medium
- cpp.marriott.com Critical
- dcfgateway*.marriott.com Critical
- device.marriott.com High
- editionhotels.com Critical
- eidhelp.marriott.com High
- esupplier.marriott.com Critical
- gateway*.marriott.com Critical
- help.marriott.com Critical
- homes-and-villas.marriott.com Critical
- hotshoppeservices.com Medium
- https://gatewaydsapprd.marriott.com/v1 Critical
- https://gatewaydsapprd.marriott.com/v2 Critical
- joinmarriottbonvoy.com Medium
- join.marriott.com Medium
- joinrewards.marriott.com Medium
- lawmanager.marriott.com Critical
- marrtool.com Critical
- mds.marriott.com Medium
- meetmarriottbonvoy.marriott.com Medium
- mgs.marriott.com Critical
- moments.marriottbonvoy.com Critical
- ocijlbex1prd.marriott.com Medium
- owa.marriott.com Medium
- passwordchallenge.marriott.com Critical
- prod-mipaasiaasservices.marriott.com Medium
- reservations.all-inclusive.marriott.com Critical No bounty
- smetrics.marriott.com Medium
- splunk-phantom-nlb.marriott.com Low
- sso.marriott.com Critical
- travelagents.marriott.com High
- traveler.marriott.com High
- uat.marriott.com High No bounty
- uber.marriott.com Medium
- university.marriott.com Medium
- vacation.marriott.com Low
- wechat.api.marriott.com High
- www.giving.marriott.com Low
- www.marriott.com Critical
- www.members.marriott.com Low
- www.travel-brilliantly.marriott.com Medium
Wildcard domains 8
- *.apigatewayc.marriott.com High
- *.apigwc.marriott.com High
- *.artifactory.marriott.com High
- *.dcfgateway.marriott.com High
- *gateway-apc.marriott.com Critical
- *.gateway.marriott.com High
- *.mgs.marriott.com High
- *uat.marriott.com Medium No bounty
iOS apps 1
- 455004730 Critical
Out of scope (40)
- Not-Listed Assets
- all-inclusive.marriott.com
- apps.ritzcarlton.com
- clmagtest.marriott.com
- element-hotels.marriott.com
- fe.emergingtech-btsales.marriott.com
- gdstest.marriott.com
- gifts.marriott.com
- gis.marriott.com
- hotel-deals.marriott.com
- hotel-development.marriott.com
- hotelexcellence.marriott.com
- http://www.shopmarriott.com
- ifast.marriott.com
- jobs.marriott.com
- latinoamerica.marriott.com
- llmgw.codefest2026.marriott.com
- luxurybrands.marriott.com
- marriottfranchisetransactions.marriott.com
- marriottlearnourbrands.com
- marriott.tech
- meetings-excellence.marriott.com
- mi.bookmarriott.com
- milux.marriott.com
- mipartnerprivileges.marriott.com
- moments.marriott.com
- oasisprod.marriott.com
- ofhub.marriott.com
- psp.marriott.com
- springhillsuites.marriott.com
- ssm-marriottms.saviyntcloud.com
- towneplacesuites.marriott.com
- vacations.marriott.com
- www.github.com
- www.msg-gateway.marriott.com
- www.travelagents.marriott.com
- globaldesign.marriott.com/*
- *.phunware.com
- *.ritzcarlton.com
- *.ritzcarltonyachtcollection.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Marriott Bug Bounty Program (via HackerOne)'s policy.
While testing
-
Act within the defined rules published on HackerOne; and
-
Act within the defined scope published in the Program.
-
Store supporting evidence only within the Submission (i.e., you are prohibited from hosting files on your own device or on external hosting services);
-
Researchers must immediately stop all activity and notify Marriott, through HackerOne, if Researchers:
-
Unless expressly provided in writing by Marriott, all Submissions and related information must be kept confidential and may not be shared outside of the Program.
-
Do not discuss or write about any potential, current or resolved vulnerabilities without express consent from Marriott.
Not accepted
-
"Zero Days" Security flaws that have released an official patch in the last 31 business days
-
Web Cache Poisoning, DOM-Based XSS, Reflected XSS, UI redressing via custom .html files and HTML injection
-
Content spoofing, iframes, open redirects, CLRF or text injection without persistent modification or require user interaction
-
Leaked tokens, IDs, or cookies without proof of account takeover (ATO)
-
Automated tool/scan report with incomplete proof of concept and impact
-
Non-persistent DOM-based and Reflected XSS requiring user interaction (aka Phishing)
-
Intentional service disruption (e.g., DoS)
-
MITM attacks requiring access to the physical network or physical location like a hotel or office.
-
Leaked credentials from data stealing malware logs or 3rd party threat intelligence or from purchase cred buy packs.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 30 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
*moxymix*.marriott.com (out of scope)
-
Scope removed
*.sba.marriott.com
-
Scope added
uat.marriott.com
-
Scope removed
eswebdev.marriott.com (out of scope)
-
Scope removed
Phoenix Platform (out of scope)
-
Scope removed
gatewaydsaptst1.marriott.com
-
Scope removed
efast.marriott.com
-
Scope removed
activities.marriott.com
-
Scope removed
dcfgatewaytst1.marriott.com
-
Scope removed
http://www.shopmarriott.com
-
Scope removed
cache.marriott.com
-
Scope removed
giftcards.marriott.com
-
Scope removed
gatewaydsapdev2.marriott.com
-
Scope removed
gatewaydsaptst2.marriott.com
-
Scope removed
www.ritzcarlton.com
-
Scope removed
careers.marriott.com
-
Scope added
hotshoppeservices.com
-
Scope added
https://gatewaydsapprd.marriott.com/v1/
-
Scope removed
http://globaldesign.marriott.com (out of scope)
-
Scope added
gdstest.marriott.com (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
#Welcome to the Marriott Bug Bounty Program !
Marriott takes cybersecurity seriously. Individuals that participate in the Program by responsibly researching and reporting vulnerabilities help us to ensure the security and privacy of our customers and data.
#Program Terms
This Policy governs your participation in Marriott’s Bug Bounty Program and supersedes any conflicting HackerOne terms. By submitting a vulnerability report through HackerOne, you agree to this Policy.
Researchers must:
• Follow HackerOne’s Gold Standard Safe Harbor pledge and Community Code of Conduct ; • Act within the defined rules published on HackerOne; and • Act within the defined scope published in the Program.
Marriott supports good-faith security research and will honor Safe Harbor protections when rules are followed.
#Scope
Please review the Scopes tab to confirm which assets are in-scope and which are out-of-scope for the Marriott Bug Bounty Program. Any asset not listed in-scope is ineligible for bounty and will be marked N/A.
#Out-of-Scope Submissions
• "Zero Days" Security flaws that have released an official patch in the last 31 business days • Web Cache Poisoning, DOM-Based XSS, Reflected XSS, UI redressing via custom .html files and HTML injection • Content spoofing, iframes, open redirects, CLRF or text injection without persistent modification or require user interaction • Leaked tokens, IDs, or cookies without proof of account takeover (ATO) • Automated tool/scan report with incomplete proof of concept and impact • Non-persistent DOM-based and Reflected XSS requiring user interaction (aka Phishing) • Intentional service disruption (e.g., DoS) • MITM attacks requiring access to the physical network or physical location like a hotel or office. • Leaked credentials from data stealing malware logs or 3rd party threat intelligence or from purchase cred buy packs. • Shadowboxing/User Spoofing - creating your own account to have a known victim resource to exploit . This escapes the full attack chain of discovering victim accounts to exploit.
#Submission Requirements To qualify for a bounty, you first need to meet all the following requirements: • Agree and adhere to the requirements and conditions outlined in the Program Terms, Scope, Confidentiality and Disclosure, and Legal Sections within this policy; • Store supporting evidence only within the Submission (i.e., you are prohibited from hosting files on your own device or on external hosting services); • Provide a detailed summary of the exploit or chain of exploits, including: (i) type of issue; (ii) validation of company that owns the asset (this can be done via WHOIS records by emailing: [email protected]); (iii) product, version and configuration, where applicable; and (iv) list of impacted assets (i.e. websites, applications, software, etc); • Provide proof of the vulnerability (i.e. through screenshots, screen captures, etc); • Suggest mitigation or remediation actions; and • Provide your IP address, the dates you identified the potential vulnerability and performed testing, the web browser, testing tools, and mobile app version used during testing.
Failure to adhere to the above minimum guidelines may result in a #reduced reward.
#Rewards
Rewards are calculated based on the CVSS score assigned to the Submission and are at the sole discretion of Marriott. Marriott aims for consistent rewards, but previous reports or reward amounts should not be considered a precedent and should not be used to negotiate a higher reward.
Recipients of rewards are responsible for the payment of all applicable taxes.
#Response Times
Marriott understands the importance of the efforts of Researchers reporting vulnerabilities, as they regularly make valuable contributions to Marriott and the broader community. We take each Submission seriously and will investigate and take appropriate steps to resolve reported vulnerabilities.
Marriott will use its best efforts to meet the following timelines related to Submissions and to keep reporters informed throughout the process:
| Marriott Response | Estimated Response Time |
|---|---|
| First Response | 2 days |
| Time to Triage | 5 days |
| Time to Bounty | 20 days |
| Time to Resolution | Depends on severity and complexity |
#Confidentiality and Disclosure
Researchers must immediately stop all activity and notify Marriott, through HackerOne, if Researchers:
• Access any personal or confidential data related to Marriott, or its customers, employees, or other affiliated parties, or otherwise the data or accounts of others, except when Researchers have been provided express permission to access such accounts;
Unless expressly provided in writing by Marriott, all Submissions and related information must be kept confidential and may not be shared outside of the Program. For the protection of our customers, Marriott does not publicly disclose, discuss or confirm security matters before comprehensively investigating, diagnosing and fixing any known issues. Marriott does not permit any public disclosure about the Program or Submissions. Do not discuss or write about any potential, current or resolved vulnerabilities without express consent from Marriott.
#Legal
Marriott may be prohibited from issuing a reward if the reporter is: (i) a citizen or resident of an embargoed country; or (ii) on the US Treasury Department list of Specialty Designated Nations or the US Department of Commerce Denied Persons or Entity List, or any other restricted party list. Marriott reserves the right to update or terminate the Program at any time; changes are effective upon posting. Please review the Program page regularly for updates. Marriott employees and vendors are encouraged to participate in the Program, but they are not eligible for bounty payments.
Thank you for helping protect Marriott’s systems, data and customers.