hellofresh/hellofresh
42
In Scope
1
Out of Scope
In-Scope Assets (42)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| *.bcrc.io | WILDCARD | Yes | ||
| *.becoolcouriers.com.au | WILDCARD | Yes | ||
| *.becoolrefrigeratedcouriers.com.au | WILDCARD | Yes | ||
| *.chefsplate.com | WILDCARD | Yes | ||
| *.everyplate.com | WILDCARD | Yes | ||
| *.everyplate.com.au | WILDCARD | Yes | ||
| *.factor75.com | WILDCARD | Yes | ||
| *.goodchop.com | WILDCARD | Yes | ||
| *.greenchef.co.uk | WILDCARD | Yes | ||
| *.greenchef.com | WILDCARD | Yes | ||
| *.helloconnect.org | WILDCARD | Yes | ||
| *.hellofresh.<tld> | WILDCARD | Yes | ||
| *.youfoodz.com | WILDCARD | Yes | ||
| 1015997735 | IOS | Yes | - | |
| 1265572034 | IOS | Yes | - | |
| 1471311837 | IOS | Yes | - | |
| 1536589530 | IOS | Yes | - | |
| 1545961260 | IOS | Yes | - | |
| 970107419 | IOS | Yes | - | |
| Broken authentication or access control leading to PII exposure | OTHER | Yes | - | |
| Database query injection in applications that store customer data | OTHER | Yes | - | |
| IDOR or any logical flaw that cause PII exposure | OTHER | Yes | - | |
| Leaked secrets of critical systems (Bitrise, Github, AWS, etc.) | OTHER | Yes | - | |
| RCE in applications hosted on HelloFresh AWS | OTHER | Yes | - | |
| SSRF resulting in exposure of critical secrets (AWS API keys etc.) | OTHER | Yes | - | |
| Weak or leaked corporate credentials leading to PII exposure | OTHER | Yes | - | |
| com.chefsplate.ChefsPlate | ANDROID | Yes | ||
| com.everyplate.android | ANDROID | Yes | ||
| com.factor75.factor75 | ANDROID | Yes | ||
| com.greenchef.GreenChef | ANDROID | Yes | ||
| com.hellofresh.androidapp | ANDROID | Yes | ||
| com.youfoodz.app | ANDROID | Yes | ||
| https://api.becoolcouriers.com.au/ | URL | Yes | ||
| https://factorform.com/ | URL | Yes | ||
| https://greenchef.com/ | URL | Yes | ||
| https://portalv2.becoolcouriers.com.au/ | URL | Yes | ||
| https://www.chefsplate.com/ | URL | Yes | ||
| https://www.everyplate.com/ | URL | Yes | ||
| https://www.factor75.com/ | URL | Yes | ||
| https://www.goodchop.com/ | URL | Yes | ||
| https://www.hellofresh.com/ | URL | Yes | ||
| https://youfoodz.com/ | URL | Yes |
Out-of-Scope Assets (1)
| Asset | Category | Bounty | |
|---|---|---|---|
| blog.*.tld | WILDCARD | Yes |