UPLINK OK // SYNC 35M AGO

H1 HackerOne LIVE

Airbnb

domainmobileotherwildcard
pays bountiesTABLE ↗ Open on HackerOne ↗
listed
before tracking
tracked since
2026-09-20
website
https://www.airbnb.com
managed triage
no
response efficiency
100%
first response
10h avg
time to bounty
126h avg

27 targets in scope

assettypebountymax sevseen
api.airbnb.comdomain yes critical2026-09-20
assets.airbnb.comdomain yes critical2026-09-20
callbacks.airbnb.comdomain yes critical2026-09-20
m.airbnb.comdomain yes critical2026-09-20
next.airbnb.comdomain yes critical2026-09-20
one.airbnb.comdomain yes critical2026-09-20
open.airbnb.comdomain yes critical2026-09-20
support-api.airbnb.comdomain yes critical2026-09-20
www.airbnb.comdomain yes critical2026-09-20
www.hoteltonight.comdomain yes critical2026-09-20
com.airbnb.androidmobile yes critical2026-09-20
com.airbnb.appmobile yes critical2026-09-20
com.luxuryretreats.iosmobile yes critical2026-09-20
Localized airbnb sites listed at the link below:other yes critical2026-09-20
*.airbnb-aws.comwildcard yes critical2026-09-20
*.airbnb.comwildcard yes critical2026-09-20
*.airbnb.orgwildcard yes critical2026-09-20
*.airbnbcitizen.comwildcard yes critical2026-09-20
*.airbnbpayments.comwildcard yes critical2026-09-20
*.atairbnb.comwildcard yes critical2026-09-20
*.byairbnb.comwildcard yes critical2026-09-20
*.hoteltonight-test.comwildcard yes critical2026-09-20
*.hoteltonight.comwildcard yes critical2026-09-20
*.luxuryretreats.comwildcard yes critical2026-09-20
*.muscache.comwildcard yes critical2026-09-20
*.musta.chwildcard yes critical2026-09-20
*.withairbnb.comwildcard yes critical2026-09-20
8 out of scope — black ICE, don't touch

Change log

get alerts ↗

No changes since we started tracking on 2026-09-20.