H1 HackerOne LIVE
Kiwi.com
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.kiwi.com
- managed triage
- yes
- response efficiency
- 81%
- first response
- 49h avg
- time to bounty
- 427h avg
19 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
auth.skypicker.com | domain | yes | critical | 2026-09-20 |
http://www.kiwi.com/stories | domain | yes | high | 2026-09-20 |
jobs.kiwi.com | domain | yes | medium | 2026-09-20 |
tequila.kiwi.com | domain | yes | critical | 2026-09-20 |
www.kiwi.com | domain | yes | critical | 2026-09-20 |
com.skypicker.Skypicker | mobile | yes | critical | 2026-09-20 |
com.skypicker.main | mobile | yes | critical | 2026-09-20 |
https://github.com/kiwicom/js-iam-middleware | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/k8s-vault-operator | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/kiwi-cache | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/kiwi-json | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/kiwi-structlog-config | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/konfetti | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/navigation-compose-typed | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/orbit | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/pg2avro | source code | yes | high | 2026-09-20 |
https://github.com/kiwicom/request-session | source code | yes | high | 2026-09-20 |
*.kiwi.com | wildcard | yes | critical | 2026-09-20 |
*.skypicker.com | wildcard | yes | critical | 2026-09-20 |
23 out of scope — black ICE, don't touch
kiwistore.kiwi.comdomainlink.kiwi.comdomainmail.skypicker.comdomainnyrujhhu3yuk.nest.skypicker.comdomainoutbound.intercom.kiwi.comdomainpackages.kiwi.comdomainretool.skypicker.comdomainrooms.kiwi.comdomainstatus.kiwi.comdomainvacation.kiwi.comdomain*._domainkey.kiwi.comwildcard*.coupons.kiwi.comwildcard*_domainkey.skypicker.comwildcard*cars.kiwi.comwildcard*citi-sign.kiwi.comwildcard*code.kiwi.comwildcard*experiences.kiwi.comwildcard*learn.kiwi.comwildcard*ov.kiwi.comwildcard*parking.kiwi.comwildcard*sg.kiwi.comwildcardemail*kiwi.comwildcardemail*skypicker.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.