Trip.com Group looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe. ==** Before submitting a vulnerability report, please read our policy first**==

Response Targets

Trip.com Group will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Test Plan

Trip Program Scope：

Travix Program Scope

• Partners (Skyscanner, Google Flights, Kayak, etc..) which redirect customers to our website.
• Direct (Customer visiting our website directly via ads or loyal customer)

Then when a customer lands on our website via a partner or direct, they go to one of our 50 websites, however, focus on this website: https://www.cheaptickets.nl/ .

During that flow, the FE (https://www.cheaptickets.nl) will call multiple Public Backend APIs under .traivx.com, Those Public Backend APIs will call another Internal Backend APIs under (.traivx.com and *.traivx.io) and finally return the results to the FE.

Given the above information, we are interested to find out how deeply you can investigate our system to find sensitive vulnerabilities which can lead to gaining access inside the system, leaking customer data (PII) or committing fraud.

Out of scope bounties

There is no bounty, but we will confirm the vulnerability and award Hacker reputation:

• Sites that use third-party services,such as：https://jobs.careers.trip.com/、https://learninghub.travix.com/. etc
• The problem of employee account and password leakage on the dark web，Not system administrator account leakage
• The staging.travix.com & stg.travix.com & dev.travix.com & development.travix.com & playground.travix.com is in scope, but no bounties will be awarded for bugs found in these platforms. If these platforms can be leveraged to compromise production and infra stack, these bugs will be considered in scope for bounty.

Out of scope vulnerabilities

There will be no reward for such vulnerability and no Hacker reputation will be awarded:

• Account brute force，but unable to login valid Account
• Self-XSS、Pdf-XSS、Flash-based XSS
• Email Spoof
• Session fixation
• Clickjacking/UI redressing
• HTTPS/SSL/TLS Related Issues
• CSV injection
• Phishing attacks
• Software version disclosure
• Login/logout/unauthenticated/low-impact CSRF
• Session not invalidated after logout
• Missing security-related HTTP headers which do not lead directly to a vulnerability
• SSRF vulnerability that cannot obtain the relevant server information of the Intranet, but simple accessed dns log without any impact
• HTML injection and cannot execute JavaScript code
• Any activity that could lead to the disruption of our service (DoS, DDoS)
• Attacks only affecting obsolete browsers or operating systems
• Any url with "inrule" in its name. (e.g. inrule-bq.prd.travix.com). See attached list for out of scope
• Testing against Partners (Skyscanner, Google Flights, Kayak, etc..) is out of scope

Reward standards

Our maximum bounty is $5,500 USD  The following table lists typical reward ranges by severity, and the actual rewards may fluctuate based on the average value, depending on the actual application scenario of the vulnerability and the level of detail in your report.

==** We do not charge the following low-risk vulnerabilities here as they will not receive effective rewards, but you can submit such vulnerabilities through Trip SRC（ https://src.trip.com ）: **==

• Reflected/DOM Cross Site Scripting 
• Cross-Site Request Forgery (CSRF vulnerabilities that can lead to leakage of sensitive user information or account hijacking，No general operations charged, general data modification)
• Open Redirect(Receiving only Open Redirect can lead to sensitive parameter leakage in URL)
• Email or SMS Bombing (There is no upper limit or frequency limit for sending)
• Ordinary system information leakage，such as phpinfo
• ...

Thank you for helping keep Trip.com Group and our users safe!