This disclosure program is limited to security vulnerabilities in systems owned by American Airlines. This program does not provide monetary rewards for bug submissions. American Airlines looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Response Targets

American Airlines will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Program Rules

• Do not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving explicit written authorization from American Airlines.
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• When submitting a report, you acknowledge you are subject to HackerOne's Disclosure Guidelines (as modified by this Program Policy regarding disclosure timelines), the HackerOne Finder Terms and Conditions and the HackerOne General Terms and Conditions.
• Do no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
• Avoid intentionally accessing the content of any American Airlines data in transit or data at rest, except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists.
• Do not exfiltrate any data under any circumstances.
• Do not compromise the privacy or safety of American Airlines personnel or any third parties.
• Do not intentionally compromise the intellectual property or commercial interests of any American Airlines personnel or entities, or any third parties.
• Do not conduct denial of service testing.
• Do not submit a high-volume of low-quality reports
• If at any point you are uncertain whether to continue testing, please engage with our team

#How to Submit a Report Please provide a detailed summary of the vulnerability, including:

• Type of issue
• Product, version, and configuration of software or asset containing the bug
• Step-by-step instructions to reproduce the issue (Proof-Of-Concept)
• Impact of the issue
• Suggested mitigation or remediation actions, as appropriate

By clicking “Contact Security Team,” you are indicating that you have read, understand, and agree to the guidelines described in this policy for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to digital products and information systems, and consent to having the contents of the communication and follow-up communications stored.

Submissions that require manipulation of data, network access, or physical attack against American Airlines offices or data centers and/or social engineering of our service desk, employees, or contractors will not be accepted. Submissions that result in the alteration or theft of American Airlines data or interruption or degradation of American Airlines systems will not be accepted.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Rate limiting or bruteforce issues on non-authentication endpoints
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing
• Open redirect - unless an additional security impact can be demonstrated
• Issues that require unlikely user interaction

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep American Airlines and our users safe!