Marriott Bug Bounty Program · in scope
Web applications
50 assets in scope
Every dot is an asset the program lists in scope. The first 31 are named here; the program's own page has the full scope.
Open Marriott Bug Bounty Program on HackerOneEvery one of the 50 is a mark on the map. Named now: 1 to 26, as listed first.
- apcgateway.marriott.com
- app-insiders.marriott.com
- auth-apc.marriott.com
- bilt.marriott.com
- bpa2.marriott.com
- bsp.marriott.com
- channel-portal.homes-and-villas.marriott.com
- ci-propertyconversionportal.marriott.com
- contentportal.marriott.com
- contentportalauth.marriott.com
- cpp.marriott.com
- dcfgateway*.marriott.com
- device.marriott.com
- editionhotels.com
- eidhelp.marriott.com
- esupplier.marriott.com
- gateway*.marriott.com
- help.marriott.com
- homes-and-villas.marriott.com
- hotshoppeservices.com
- https://gatewaydsapprd.marriott.com/v1/
- https://gatewaydsapprd.marriott.com/v2/
- join.marriott.com
- joinmarriottbonvoy.com
- joinrewards.marriott.com
- lawmanager.marriott.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.