H1 HackerOne LIVE
Eternal
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.eternal.com
- managed triage
- no
- response efficiency
- 100%
- first response
- 1h avg
- time to bounty
- 123h avg
34 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.grofers.com | domain | yes | critical | 2026-09-20 |
api2.grofers.com | domain | yes | critical | 2026-09-20 |
bistro-api.blinkit.com | domain | yes | critical | 2026-09-20 |
blinkit.com | domain | yes | critical | 2026-09-20 |
https://mcp-server.zomato.com/mcp | domain | yes | critical | 2026-09-20 |
winecellar.zomato.com | domain | yes | critical | 2026-09-20 |
434613896 | mobile | yes | critical | 2026-09-20 |
6670203019 | mobile | yes | critical | 2026-09-20 |
6670536058 | mobile | yes | critical | 2026-09-20 |
960335206 | mobile | yes | critical | 2026-09-20 |
com.application.zomato | mobile | yes | critical | 2026-09-20 |
com.application.zomato.district | mobile | yes | critical | 2026-09-20 |
com.application.zomatomerchant | mobile | no | critical | 2026-09-20 |
com.blinkit.bistro | mobile | yes | critical | 2026-09-20 |
com.grofers.customerapp | mobile | yes | critical | 2026-09-20 |
All Assets (other than Blinkit) | other | yes | critical | 2026-09-20 |
Data Protection Program | other | yes | critical | 2026-09-20 |
Scope Questions: Items not explicitly listed here | other | no | critical | 2026-09-20 |
Tier 1 | other | yes | critical | 2026-09-20 |
Tier 2 | other | yes | critical | 2026-09-20 |
Tier 3 | other | yes | critical | 2026-09-20 |
*.district.in | wildcard | yes | critical | 2026-09-20 |
*.edition.in | wildcard | yes | critical | 2026-09-20 |
*.eternal.com | wildcard | yes | critical | 2026-09-20 |
*.hyperpure.com | wildcard | yes | critical | 2026-09-20 |
*.insider.in | wildcard | yes | critical | 2026-09-20 |
*.runnr.in | wildcard | yes | critical | 2026-09-20 |
*.ticketnew.com | wildcard | yes | critical | 2026-09-20 |
*.tktnew.com | wildcard | yes | critical | 2026-09-20 |
*.zdev.net | wildcard | yes | critical | 2026-09-20 |
*.zomans.com | wildcard | yes | critical | 2026-09-20 |
*.zomato.com | wildcard | yes | critical | 2026-09-20 |
http://*.grofer.io | wildcard | yes | critical | 2026-09-20 |
http://*.grofers.com | wildcard | yes | critical | 2026-09-20 |
15 out of scope — black ICE, don't touch
blog.zomato.comdomainbusiness-blog.zomato.comdomaincommunity.zomato.comdomaindev.hyperpure.comdomaindevapi.hyperpure.comdomaindevpod.hyperpure.comdomainsend.zomato.comdomainsuccess.zomato.comdomainwww.zomatobook.comdomaincom.application.zomato.orderingmobile*.ali.zomans.comwildcard*.bstro.iowildcard*.zomatoportugal.comwildcardhttp://*.blinkit.supportwildcardstaging*.runnr.inwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.