YWH YesWeHack LIVE
Doctolib
up to€50,000
Open on YesWeHack ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- managed triage
- no
9 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
Special scenarios (see description) | domain | · | · | 2026-09-20 |
pro.doctolib.(fr|de|it) (see "Free features for healthcare professionals")) | domain | · | · | 2026-09-20 |
www.doctolib.(fr|de|it) | domain | · | · | 2026-09-20 |
*.siilo.com | executable | · | · | 2026-09-20 |
http://play.google.com/store/apps/details?id=fr.doctolib.www | mobile | · | · | 2026-09-20 |
https://apps.apple.com/fr/app/doctolib/id925339063 | mobile | · | · | 2026-09-20 |
https://apps.apple.com/ie/app/doctolib-siilo/id1083002150 | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.siilo.android&hl=en | mobile | · | · | 2026-09-20 |
*.doctolib.(fr|de|it|com|net) | wildcard | · | · | 2026-09-20 |
26 out of scope — black ICE, don't touch
Any *.sslip.io, *.nip.io, AWS ELB / load-balancer hostname, or raw IPv4 / IPv6 addressotherCraft CMS on www.siilo.com, plus siilo.com marketing / staging sub-domains (l.siilo.com, l-dev.siilo.com, web.siilo.com, web-dev.siilo.com, www-admin.siilo.com, mjt-dev.siilo.com, att-dev-nl.siilo.com, sandbox-nl.siilo.com, connect.siilo.com, prod-nl-web.siilo.com)otherLook-alike, typo-squatting or expired domains not owned by Doctolib (e.g. www.dioctolib.de, doctolib.fr.evil.com, doctodketest.tk, doctolib-poc.partner-experience.com)otherNote: should you discover a critical issue within an asset that falls outside the program's scope, we would appreciate it and may choose to offer a reward at our discretion.otherPublic GitHub repositories we do not own (such as student projects doing)otherThere is no IDOR on /api/security/tanker_groups via subject_idotherThird-party assets linked from our products (e.g. login.decathlon.net, wallet.esw.esante.gouv.fr, preprod.alaxione.fr, hooks.zapier.com, cron.signitic.app, job-boards.greenhouse.io, docto.digitalstack.it, and any hospital-specific or customer-specific host)otherapi.tanker.io (Accessing the tanker private key is normal functioning of the Tanker protocol)otherbilling-client-logs.billing.doctolib.fr | api-external.datascience.doctolibdata.comothercommunity.doctolib.com | .fr | .de | .itotherdevelopers.doctolib.comotherdmp.doctolib.fr | dmp-prd-aws-*.doctolib.frotherdoctocommit.doctolib.frotherdoctolib-ps-ehr-downloads.s3.amazonaws.comotherdoctolib.atlassian.net and any *.atlassian.net pathotherdoctolib.zendesk.com | siilo.zendesk.comotherexceptions.doctolib.fr | .deotherfb.doctolib.com | fb-dev.doctolib.frotherfm.doctolib.fr | fm.doctolib.it | voip.doctolib.de and other decommissioned / dangling Doctolib sub-domainsotherinfo.doctolib.com | .fr | .de | .itothermedia.doctolib.comotherpro-app.doctolib.comothershare.doctolib.netotherstatus.doctolib.com | .fr | .itotherstore.doctolib.comothervettore.it and any related Vettore assetsother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.