BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.
Programs / Expedia Group Bug Bounty
NR Unrated
Expedia Group Bug Bounty
Expedia Group Bug Bounty HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Expedia Group Bug Bounty? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Program metrics HackerOne · published

HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 23 Sep 2026.

What it pays, by severity

Critical $2,850 avg 61 reports firm
High $2,556 avg 159 reports firm
Medium $958 avg 309 reports firm
Low $283 avg 147 reports firm

$810,000 paid to researchers in total, $55,000 of it in the last 90 days. Lifetime figure as HackerOne prints it: evidence this program has paid, not a promise about any one report.

Intake & responsiveness · last 90 days

Reports received
613
in 90 days
Resolved
684
all time, last one today
Participants
466
hunters engaged
Response efficiency
92%
meeting its targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received · day by day, last 22 days 122–613
25 Aug 613 reports 23 Sep

Response targets it sets itself

First response
2 days
Triage
4 days
Bounty
15 days
Resolution
30 days

A target the program declared, not a measurement of it being met.

Getting in the door

bounty amounts hidden

Over 32 days (315 snapshots): intake up 491 reports; response efficiency up 29 points; 90-day payout up $27,450.

See how this programme’s report load compares to others →

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

504 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 thezodd 2,987 10 / 16 63%
1 yumi 1,852 60 / 74 81%
2 shailesh4594 1,800 65 / 70 93%
3 rezaghgh 1,270 15 / 32 47%
4 jerry_x 1,116 10 / 10 100%
5 bug_vs_me 1,008 2 / 4 50%
6 todayisnew 842 28 / 63 44%
7 zonduu 809 31 / 38 82%
8 p0lygl0t 740 15 / 25 60%
9 godiego 655 17 / 24 71%
10 zulln 568 13 / 14 93%
11 bombon 551 15 / 20 75%
12 skydesperados 511 7 / 15 47%
13 d0xing 482 20 / 40 50%
14 comwrg 464 10 / 15 67%
15 ch1naa 455 18 / 18 100%
16 proabiral 416 18 / 27 67%
17 sachin_kr 388 12 / 16 75%
18 nagli 367 10 / 17 59%
19 j_m 334 12 / 14 86%
20 derision 324 15 / 18 83%
21 carbon61 314 10 / 20 50%
22 p4fg 300 12 / 18 67%
23 tosun 290 2 / 2 100%
24 iieitaimuss 288 4 / 6 67%

Showing the top 25 of 504 credited on HackerOne.

Program profile HackerOne · imported

Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 16 Sep 2026.

Expedia Group is the world’s travel platform, with an extensive brand portfolio that includes some of the world’s most trusted online travel brands.

Responsiveness
91% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Open
Launched
Nov 2022
Scope entries
112 HackerOne’s count

Scope

110 assets
AssetTypeEligibilityMax severity
*.abritel.fr WILDCARD ✓ bounty Critical
*.bookabach.co.nz WILDCARD ✓ bounty Critical
*.carrentals.com WILDCARD ✓ bounty Critical
*.cheaptickets.com WILDCARD ✓ bounty Critical
*.ean.com URL ✓ bounty Critical
Show all 110 assets
AssetTypeEligibilityMax severity
*.escapia.com WILDCARD ✓ bounty Critical
*.expedia-aarp.com WILDCARD ✓ bounty Critical
*.expedia.com WILDCARD ✓ bounty Critical
*.expediaagents.com WILDCARD ✓ bounty Critical
*.expediacruises.com WILDCARD ✓ bounty Critical
*.expediagroup.com WILDCARD ✓ bounty Critical
*.expediapartnercentral.com WILDCARD ✓ bounty Critical
*.expediapartnersolutions.com WILDCARD ✓ bounty Critical
*.fewo-direkt.de WILDCARD ✓ bounty Critical
*.flights.com WILDCARD ✓ bounty Critical
*.hoteis.com URL ✓ bounty Critical
*.hoteles.com URL ✓ bounty Critical
*.hotels.com URL ✓ bounty Critical
*.hotwire.com WILDCARD ✓ bounty Critical
*.hotwirepartnercentral.com WILDCARD ✓ bounty Critical
*.lastminute.co.nz WILDCARD ✓ bounty Critical
*.lastminute.com.au WILDCARD ✓ bounty Critical
*.orbitz.com WILDCARD ✓ bounty Critical
*.stayz.com.au WILDCARD ✓ bounty Critical
*.tigets.com WILDCARD ✓ bounty Critical
*.tiqets.com WILDCARD ✓ bounty Critical
*.travelocity.ca WILDCARD ✓ bounty Critical
*.travelocity.com WILDCARD ✓ bounty Critical
*.vrbo.com WILDCARD ✓ bounty Critical
*.wotif.com WILDCARD ✓ bounty Critical
1245772818 APPLE STORE APP ID ✓ bounty Critical
284803487 APPLE STORE APP ID ✓ bounty Critical
284971959 APPLE STORE APP ID ✓ bounty Critical
403546234 APPLE STORE APP ID ✓ bounty Critical
427916203 APPLE STORE APP ID ✓ bounty Critical
483394780 APPLE STORE APP ID ✓ bounty Critical
506426310 APPLE STORE APP ID ✓ bounty Critical
531549799 APPLE STORE APP ID ✓ bounty Critical
566635048 APPLE STORE APP ID ✓ bounty Critical
642441300 APPLE STORE APP ID ✓ bounty Critical
880759727 APPLE STORE APP ID ✓ bounty Critical
com.carrentals GOOGLE PLAY APP ID ✓ bounty Critical
com.cheaptickets GOOGLE PLAY APP ID ✓ bounty Critical
com.ebookers GOOGLE PLAY APP ID ✓ bounty Critical
com.expedia.bookings GOOGLE PLAY APP ID ✓ bounty Critical
com.hcom.android GOOGLE PLAY APP ID ✓ bounty Critical
com.homeaway.android GOOGLE PLAY APP ID ✓ bounty Critical
com.hotwire.hotels GOOGLE PLAY APP ID ✓ bounty Critical
com.orbitz GOOGLE PLAY APP ID ✓ bounty Critical
com.travelocity.android GOOGLE PLAY APP ID ✓ bounty Critical
com.vrbo.android GOOGLE PLAY APP ID ✓ bounty Critical
com.wotif.android GOOGLE PLAY APP ID ✓ bounty Critical
http://www.cruiseshipcenters.com/api/searchcenter URL ✓ bounty Critical
www.abritel.fr URL ✓ bounty Critical
www.bookabach.co.nz URL ✓ bounty Critical
www.carrentals.com URL ✓ bounty Critical
www.cheaptickets.com URL ✓ bounty Critical
www.ebookers.ch URL ✓ bounty Critical
www.ebookers.com URL ✓ bounty Critical
www.ebookers.de URL ✓ bounty Critical
www.ebookers.fi URL ✓ bounty Critical
www.ebookers.fr URL ✓ bounty Critical
www.ebookers.ie URL ✓ bounty Critical
www.egadvertising.com URL ✓ bounty Critical
www.expedia-aarp.com URL ✓ bounty Critical
www.expedia.com URL ✓ bounty Critical
www.expediacruises.com URL ✓ bounty Critical
www.expediagroup.com URL ✓ bounty Critical
www.expediapartnercentral.com URL ✓ bounty Critical
www.expediataap.com URL ✓ bounty High
www.fewo-direkt.de URL ✓ bounty Critical
www.flights.com URL ✓ bounty Critical
www.hotels.com URL ✓ bounty Critical
www.hotwire.com URL ✓ bounty Critical
www.hotwirepartnercentral.com URL ✓ bounty Critical
www.lastminute.co.nz URL ✓ bounty Critical
www.lastminute.com.au URL ✓ bounty Critical
www.mrjet.se URL ✓ bounty Critical
www.orbitz.com URL ✓ bounty Critical
www.stayz.com.au URL ✓ bounty Critical
www.tigets.com URL ✓ bounty Critical
www.tiqets.com URL ✓ bounty Critical
www.travelocity.ca URL ✓ bounty Critical
www.travelocity.com URL ✓ bounty Critical
www.vrbo.com URL ✓ bounty Critical
www.wotif.com URL ✓ bounty Critical
987675995 APPLE STORE APP ID submit only Critical
apartmentjet.com URL out None
blog.hotels.com URL out None
bookus.expediacruises.com URL out None
china.airasiago.com URL out None
com.expediapartnercentral GOOGLE PLAY APP ID submit only Critical
comms.ean.com URL out None
discoveryhub.expediapartnersolutions.com URL out None
gco-get.expediapartnersolutions.com URL out None
gco.expediapartnersolutions.com URL out None
https://*.expedia.com/ WILDCARD out None
https://www.abritel.fr/api/track URL out None
info.expediapartnersolutions.com URL out None
resources.ean.com URL out None
status.expediapartnersolutions.com URL out None
support.ean.com URL out None
support.expediapartnersolutions.com URL out None
sure.expediapartnersolutions.com URL out None
taap-ui-bundles-test.expediapartnersolutions.com URL out None
taap-ui-bundles.expediapartnersolutions.com URL out None
taapacademy.expediapartnersolutions.com URL out None
thailand.airasiago.com URL out None
www.expediaagents.com URL out None
www.expediapartnersolutions.com URL out None

HackerOne lists 112 scope entries; its public listing groups many assets under one label, so identical entries are shown once.