H1 HackerOne LIVE
British Airways VDP
no bountyVDP
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://britishairways.com
- managed triage
- yes
- response efficiency
- 69%
- first response
- 39h avg
- time to bounty
- 9h avg
7 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
http://www.britishairways.com/nx | domain | no | critical | 2026-09-20 |
www.britishairways.com | domain | no | critical | 2026-09-20 |
com.ba.mobile | mobile | no | critical | 2026-09-20 |
com.britishairways.BAFlights | mobile | no | critical | 2026-09-20 |
Security vulnerabilities that are identified in digital properties owned, operated, or controlled by British Airways are considered in scope. | other | no | critical | 2026-09-20 |
*.ba.com | wildcard | no | critical | 2026-09-20 |
*.britishairways.com | wildcard | no | critical | 2026-09-20 |
3 out of scope — black ICE, don't touch
accounts.britishairways.comdomainholiday.britishairways.comdomainTesting is not permitted on internal systems, employee portals, onboard aircraft systems, third-party services, or any assets using external networks or domains not directly owned or controlled by British Airwaysother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.