New Year, New Scope!

Welcome to 2021, we are so happy to be here. In a previous message we promised that we would have some new scope for you all to look at in our public bug bounty program. The time has come, today is that day!

In line with our past strategy of featuring certain products or features during live hacking events, and then releasing them into scope for our public program, please review the changes to our program policy to make sure that you know exactly what has changed. This post should just serve you as a guide for what to look for.

New Assets

These assets were featured during H1-2010 (Qualifier and Final) and, just like many of our others, have some third party components to them and other bits and bobs that are out of scope for awards.  Please make sure you review our Policy page for further details. 

AOL Homepage

• www.aol.fr
• www.aol.de
• www.aol.co.uk
• www.aol.jp
• www.aol.in
• www.aol.ca
• www.aol.com

AOL Search

• search.aol.ca
• search.aol.co.uk
• search.aol.com
• recherche.aol.fr
• suche.aol.de

AOL Help

• help.aol.com
• assistance.aol.fr
• help.aol.co.uk
• hilfe.aol.de
• helpconnect.netscape.com
• help.compuserve.com

Yahoo Elections

This was implicitly included, but will now be separated as an explicit item. These pages most likely won’t have much that is interesting until the next US election cycle begins.

• https://www.yahoo.com/elections?ref=electionsNight
• https://www.yahoo.com/elections/senate?ref=electionsNight
• https://www.yahoo.com/elections/house?ref=electionsNight
• https://www.yahoo.com/elections/state/al?ref=electionsNight (and all other US state pages)

Media Platform Marketing Website

• *.verizondigitalmedia.com
• www.verizondigitalmedia.com (prod)
• stage-www.verizondigitalmedia.com (staging, only non-english content)
• research.verizondigitalmedia.com

Media Platforms Engineering Blog

• eng.verizondigitalmedia.com
• eng-staging.verizondigitalmedia.com

Flash - It’s gone

This makes up such a small market share to begin with, and most of the reports we have seen are not even really issues with our code so they haven’t earned awards. Flash has been officially end-of-lifed as of December 31, 2020. Starting January 1, 2021 our program will not award bounties for bugs related to Flash any longer. This aligns with our practices of (1) not awarding for bugs in third party code and (2) requiring proof of concepts to function within common operating environments. We think your time (and our money) is better spent finding other bugs that might be out there. Flash has been moved to the Out of Scope section of our policy.

That’s all for now. We will have more exciting news in the near future.