Airbnb
HackerOne live webBug bounty program on HackerOne. Official listing: https://hackerone.com/airbnb. Scope and rules are controlled by the program — always verify against the official listing before testing.
Max bounty
$25K
Starts
2015-02-27
In-scope assets
23
Last updated
2026-07-10
In-scope assets
| Type | Asset | Detail |
|---|---|---|
| web | *.airbnb-aws.com | Lower Impact Scope |
| web | *.airbnb.com | Higher Impact Scope |
| web | *.airbnb.org | |
| web | *.airbnbcitizen.com | Lower Impact Scope |
| web | *.airbnbpayments.com | |
| web | *.atairbnb.com | Lower Impact Scope |
| web | *.byairbnb.com | Lower Impact Scope |
| web | *.hoteltonight-test.com | Lower Impact Scope |
| web | *.hoteltonight.com | Lower Impact Scope |
| web | *.luxuryretreats.com | Lower Impact Scope |
| web | *.muscache.com | Lower Impact Scope |
| web | *.musta.ch | |
| web | *.withairbnb.com | Lower Impact Scope |
| web | api.airbnb.com | Higher Impact Scope |
| web | assets.airbnb.com | Higher Impact Scope |
| web | callbacks.airbnb.com | Higher Impact Scope |
| web | m.airbnb.com | Higher Impact Scope |
| web | next.airbnb.com | Higher Impact Scope |
| web | one.airbnb.com | Higher Impact Scope |
| web | open.airbnb.com | Lower Impact Scope |
| web | support-api.airbnb.com | Higher Impact Scope |
| web | www.airbnb.com | Higher Impact Scope |
| web | www.hoteltonight.com | Lower Impact Scope |
Watching Airbnb? BountyHunt monitors every in-scope repo and tells you the moment a commit, release, or scope change lands — in the app, by webhook, or straight to your agent over MCP.
Track this program