# Marriott Bug Bounty Program: bug bounty program on HackerOne

> Marriott Bug Bounty Program is a bug bounty program on HackerOne. Its critical reports have paid an average of $10,050 across 68 reports (HackerOne figures, November 7, 2026). It received 247 reports in the 90 days to November 7, 2026, about 2.8 per in-scope asset.

- **Company:** Marriott Bug Bounty Program
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/marriott
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** February 3, 2020
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/marriott

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $10,050 | 68 |
| High | $7,895 | 176 |
| Medium | $1,892 | 288 |
| Low | $625 | 200 |

- Reports received in the last 90 days: 247 (about 2.8 per in-scope asset)
- Bounties paid in the last 90 days: $62,587
- Bounties paid in total: $638,998
- Researchers participating: 428
- Response efficiency: 98%
- First-response target: 2 days
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 87 assets in scope (82 bounty-eligible), 45 out of scope. The policy page is the authority.

- `*.apigatewayc.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.apigwc.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.artifactory.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.dcfgateway.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.gateway.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.marriott.com` (OTHER): in scope, bounty-eligible, max severity critical
- `*.mgs.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.sba.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.starwoodhotels.com` (OTHER): in scope, bounty-eligible, max severity critical
- `*gateway-apc.marriott.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*uat.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `activities.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `activities.marriott.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `airandcar.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- `apcgateway.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `app-insiders.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `auth-apc.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `beta-wwws.givex.com*` (OTHER): in scope, bounty-eligible, max severity critical
- `bilt.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `bpa2.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `bsp.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `cache.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `careers.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- `careers.marriott.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `channel-portal.homes-and-villas.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `ci-propertyconversionportal.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `clean.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `com.marriott` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.marriott.mrt` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `contentportal.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `contentportalauth.marriott.com` (URL): in scope, bounty-eligible, max severity medium
- `cpp.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- `dcfgateway*.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- `device.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `editionhotels.com` (URL): in scope, bounty-eligible, max severity critical
- `efast.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `eidhelp.marriott.com` (URL): in scope, bounty-eligible, max severity high
- `eleganthotels.com` (URL): in scope, bounty-eligible, max severity medium
- `esupplier.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- `gateway*.marriott.com` (URL): in scope, bounty-eligible, max severity critical
- and 92 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.