Marriott Bug Bounty Program

HackerOne live web

Bug bounty program on HackerOne. Official listing: https://hackerone.com/marriott. Scope and rules are controlled by the program — always verify against the official listing before testing.

Max bounty

$11K

Starts

2018-09-14

In-scope assets

Last updated

2026-10-13

In-scope assets

Type	Asset	Detail
web	*.apigatewayc.marriott.com
web	*.apigwc.marriott.com
web	*.artifactory.marriott.com
web	*.dcfgateway.marriott.com
web	*.gateway.marriott.com
web	*.mgs.marriott.com
web	*gateway-apc.marriott.com
web	apcgateway.marriott.com
web	app-insiders.marriott.com
web	auth-apc.marriott.com
web	bilt.marriott.com
web	bpa2.marriott.com
web	bsp.marriott.com
web	channel-portal.homes-and-villas.marriott.com
web	ci-propertyconversionportal.marriott.com
web	contentportal.marriott.com
web	contentportalauth.marriott.com
web	cpp.marriott.com
web	device.marriott.com
web	editionhotels.com
web	eidhelp.marriott.com
web	esupplier.marriott.com
web	help.marriott.com
web	homes-and-villas.marriott.com
web	join.marriott.com
web	joinmarriottbonvoy.com
web	joinrewards.marriott.com
web	lawmanager.marriott.com
web	marrtool.com
web	mds.marriott.com
web	meetmarriottbonvoy.marriott.com
web	mgs.marriott.com
web	moments.marriottbonvoy.com
web	ocijlbex1prd.marriott.com
web	owa.marriott.com
web	passwordchallenge.marriott.com
web	prod-mipaasiaasservices.marriott.com
web	reservations.all-inclusive.marriott.com
web	smetrics.marriott.com
web	splunk-phantom-nlb.marriott.com
web	sso.marriott.com
web	travelagents.marriott.com/
web	traveler.marriott.com
web	uber.marriott.com
web	university.marriott.com
web	vacation.marriott.com
web	wechat.api.marriott.com
web	www.giving.marriott.com
web	www.marriott.com
web	www.members.marriott.com
web	www.travel-brilliantly.marriott.com
web	https://gatewaydsapprd.marriott.com/v1/
web	https://gatewaydsapprd.marriott.com/v2/
web	hotshoppeservices.com
web	*uat.marriott.com
web	uat.marriott.com

Watching Marriott Bug Bounty Program? BountyHunt monitors every in-scope repo and tells you the moment a commit, release, or scope change lands — in the app, by webhook, or straight to your agent over MCP.

Track this program