Hyatt Hotels

HackerOne live web

Bug bounty program on HackerOne. Official listing: https://hackerone.com/hyatt. Scope and rules are controlled by the program — always verify against the official listing before testing.

Max bounty

$10K

Starts

2018-09-10

In-scope assets

Last updated

2026-06-16

In-scope assets

Type	Asset	Detail
web	assets.hyatt.com
web	blueskytours.globalbookingsolutions.com	Does not include additional subdomains.
web	book.applevacations.com
web	book.beachbound.com
web	book.booktandl.com
web	book.cheapcaribbean.com	Do not target additional subdomains.
web	booking.applevacations.com
web	booking.beachbound.com
web	booking.cheapcaribbean.com
web	confluence.hyattdev.com
web	ebsext.oft.hyatt.com
web	hyatt.com
web	login.www.vaxvacationaccess.com
web	meetings.hyatt.com
web	mobileapp.hyatt.com
web	new.www.vaxvacationaccess.com
web	newsroom.images.hyatt.com
web	plannerrequest.hyatt.com
web	public.hyatt.com
web	res.blueskytours.globalbookingsolutions.com
web	res.funjet.com
web	res.hyattinclusivecollection.com
web	res.secretsresorts.com
web	res.universalorlandovacations.com
web	res.vacations.buschgardens.com
web	res.vacations.discoverycove.com
web	res.vacations.seaworld.com
web	res.vacations.sesameplace.com
web	res.vacations.united.com
web	res.vacations.universalstudioshollywood.com
web	reservations.wynnvacations.com
web	rezagent.triseptsolutions.com
web	roominglist.hyatt.com
web	salesportal.hyatt.com
web	scapegoat.hyatt.com
web	shop.wyndhamvacationownership.trisept.travel
web	soaext.oft.hyatt.com
web	sso.oft.hyatt.com
web	upsell.hyatt.com
web	vacations.travelimpressions.com
web	vacations.united.com	Does not include additional subdomains.
web	vacations.universalstudioshollywood.com
web	world.hyatt.com
web	www.applevacations.com	Does not include additional subdomains.
web	www.beachbound.com	Does not include additional subdomains.
web	www.blueskytours.com
web	www.cheapcaribbean.com	Do not target additional subdomains.
web	www.funjet.com
web	www.hyatt.com
web	www.hyattconnect.com
web	www.hyattinclusivecollection.com
web	www.triseptapi.com
web	www.triseptdemo.com
web	www.triseptsolutions.com
web	www.universalorlandovacations.com
web	www.wynnvacations.com

Watching Hyatt Hotels? BountyHunt monitors every in-scope repo and tells you the moment a commit, release, or scope change lands — in the app, by webhook, or straight to your agent over MCP.

Track this program