- Top reward
- $5,500
- Top severity paid
- Critical
- Assets in scope
- 18
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,500
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,500 from $1,000 |
| High |
|
$2,000 from $500 |
| Medium |
|
$500 from $100 |
| Low |
|
$200 from $50 |
- Response
-
Within 7 days
| First Response | 7 days |
- Safe harbor
-
Partial
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
18 assets you may test, 4 excluded.
Wildcard domains 15
- *.budgetair.com Critical
- *.cheaptickets.nl Critical
- *.flugladen.de Critical
- *.mytrainpal.com
- *.staging.travix.com Critical No bounty
- *.trainpal.com
- *.trainpal.com,*.mytrainpal.com Critical
- *.travix.com Critical
- *.travix.io Critical
- *.trip.biz Critical
- *.trip.com Critical
- *.triplinkintl.com Critical
- *.tyo-masters.co.jp Critical
- *.vayama.com Critical
- *.vliegwinkel.nl Critical
Android apps 1
- com.trip.android Critical
iOS apps 1
- com.trip.ios Critical
Products and areas 1
- <locale>.trip.com Critical
Out of scope (4)
- *.development.travix.com
- *.dev.travix.com
- *.playground.travix.com
- *.stg.travix.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Trip.com (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
-
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Not accepted
-
Account brute force，but unable to login valid Account
-
Self-XSS、Pdf-XSS、Flash-based XSS
-
Email Spoof
-
Session fixation
-
Clickjacking/UI redressing
-
HTTPS/SSL/TLS Related Issues
-
CSV injection
-
Phishing attacks
-
Software version disclosure
-
Login/logout/unauthenticated/low-impact CSRF
-
Session not invalidated after logout
-
Missing security-related HTTP headers which do not lead directly to a vulnerability
-
SSRF vulnerability that cannot obtain the relevant server information of the Intranet, but simple accessed dns log without any impact
-
HTML injection and cannot execute JavaScript code
-
Any activity that could lead to the disruption of our service (DoS, DDoS)
-
Attacks only affecting obsolete browsers or operating systems
-
Reflected/DOM Cross Site Scripting
-
Open Redirect(Receiving only Open Redirect can lead to sensitive parameter leakage in URL)
-
Email or SMS Bombing (There is no upper limit or frequency limit for sending)
-
Ordinary system information leakage，such as phpinfo
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 17 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “| First Response | 7 days |”
-
Scope removed
app.blueskytravelvietnam.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Trip.com Group looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe. ==** Before submitting a vulnerability report, please read our policy first**==
Response Targets
Trip.com Group will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 7 days |
| Time to Triage | 7 days |
| Time to Bounty | 30 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Test Plan
Trip Program Scope：
| Application Level | Application Description |
|---|---|
| High priority | https://<locale>.trip.com Main page entry related business (can switch to multiple languages) |
| Low priority | Except for High priority applications, *. trip.com domain related applications |
| Low priority | *.trainpal.com && *.mytrainpal.com |
Travix Program Scope
| Application Level | Application Description |
|---|---|
| Low priority | *.travix.com |
| Low priority | *.travix.io |
| Low priority | *.cheaptickets.nl |
| Our business attracts customers from two main sources: |
- Partners (Skyscanner, Google Flights, Kayak, etc..) which redirect customers to our website.
- Direct (Customer visiting our website directly via ads or loyal customer)
Then when a customer lands on our website via a partner or direct, they go to one of our 50 websites, however, focus on this website: https://www.cheaptickets.nl/ .
During that flow, the FE (https://www.cheaptickets.nl) will call multiple Public Backend APIs under .traivx.com, Those Public Backend APIs will call another Internal Backend APIs under (.traivx.com and *.traivx.io) and finally return the results to the FE.
Given the above information, we are interested to find out how deeply you can investigate our system to find sensitive vulnerabilities which can lead to gaining access inside the system, leaking customer data (PII) or committing fraud.
Note regarding Travix infrastructure: Travix is currently undergoing a domain migration and governance project. We will not be accepting DNS-related reports until the end of July, as all such issues will be addressed as part of this internal initiative.
Out of scope bounties
There is no bounty, but we will confirm the vulnerability and award Hacker reputation:
- Sites that use third-party services,such as：https://jobs.careers.trip.com/、https://learninghub.travix.com/. etc
- The problem of employee account and password leakage on the dark web，Not system administrator account leakage
- The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these platforms can be leveraged to compromise production and infra stack, these bugs will be considered in scope for bounty.
Out of scope vulnerabilities
There will be no reward for such vulnerability and no Hacker reputation will be awarded:
- Account brute force，but unable to login valid Account
- Self-XSS、Pdf-XSS、Flash-based XSS
- Email Spoof
- Session fixation
- Clickjacking/UI redressing
- HTTPS/SSL/TLS Related Issues
- CSV injection
- Phishing attacks
- Software version disclosure
- Login/logout/unauthenticated/low-impact CSRF
- Session not invalidated after logout
- Missing security-related HTTP headers which do not lead directly to a vulnerability
- SSRF vulnerability that cannot obtain the relevant server information of the Intranet, but simple accessed dns log without any impact
- HTML injection and cannot execute JavaScript code
- Any activity that could lead to the disruption of our service (DoS, DDoS)
- Attacks only affecting obsolete browsers or operating systems
- Any url with "inrule" in its name. (e.g. inrule-bq.prd.travix.com). See attached list for out of scope
- Testing against Partners (Skyscanner, Google Flights, Kayak, etc..) is out of scope
Reward standards
Our maximum bounty is $5,500 USD The following table lists typical reward ranges by severity, and the actual rewards may fluctuate based on the average value, depending on the actual application scenario of the vulnerability and the level of detail in your report.
| Vulnerability Type | Vulnerability Description | Average Bounty for high-priority asset | Average Bounty for lower-priority asset |
|---|---|---|---|
| Remote Code Execution (RCE) | Access to system privileges directly,Including but not limited to command execution, code execution, Webshell, etc. | $5500 | $1500 |
| SQL Injection | SQL injection vulnerability, which can obtain sensitive database information | $2500 | $1000 |
| Sensitive Data Exposure | Leakage of a large amount of user plaintext sensitive information, including but not limited to: mobile phone number, bank card information, ID card information, order information, email, address, etc. | $2000 | $800 |
| Server Side Request Forgery (SSRF) | An SSRF vulnerability that can access trip's intranet and has echo content | $1500 | $500 |
| Authorization Flaw | Serious unauthorized sensitive operations, including but not limited to unauthorized modification of important information on accounts, ordinary operations on orders, and modification of important business configurations. | $1000 | $300 |
| Logic flaw | logical design flaws and process flaws | $500 | $200 |
| Local file read | Vulnerability to read arbitrary system files, which can read important sensitive files. | $500 | $200 |
| Stored Cross Site Scripting | Only Store xss, not reflective/dom xss. For the storage xss problem of multiple pages caused by the same data, it can only be considered as one. | $200 | $50 |
==** We do not charge the following low-risk vulnerabilities here as they will not receive effective rewards, but you can submit such vulnerabilities through Trip SRC（ https://src.trip.com ）: **==
- Reflected/DOM Cross Site Scripting
- Cross-Site Request Forgery (CSRF vulnerabilities that can lead to leakage of sensitive user information or account hijacking，No general operations charged, general data modification)
- Open Redirect(Receiving only Open Redirect can lead to sensitive parameter leakage in URL)
- Email or SMS Bombing (There is no upper limit or frequency limit for sending)
- Ordinary system information leakage，such as phpinfo
- ...
Thank you for helping keep Trip.com Group and our users safe!