Bug bounty program
AV
Avalara
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 14
- Disclosed reports
- 0
- Subdomains
- 3,938
Most upvoted reports0
No report of this program is publicly disclosed
Subdomains3,938
| Name | Scope | First seen |
|---|---|---|
| api.avalara.comapi | In scope | 2026-11-14 |
| api.int.avalara.comapi | In scope | 2026-11-14 |
| api.ips.avalara.comapi | In scope | 2026-11-14 |
| api.kyc.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.uat.avalara.comapi, test | In scope | 2026-11-14 |
| tax.api.avalara.comapi | In scope | 2026-11-14 |
| api.ptrp.avalara.comapi | In scope | 2026-11-14 |
| api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| api-apt.pt.avalara.comapi | In scope | 2026-11-14 |
| google.api.avalara.comapi | In scope | 2026-11-14 |
| api.biztech.avalara.comapi | In scope | 2026-11-14 |
| api.capital.avalara.comapi | In scope | 2026-11-14 |
| api.kyc.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.returns.avalara.comapi | In scope | 2026-11-14 |
| returns-api.avalara.comapi | In scope | 2026-11-14 |
| api.ptrp.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.thegrove.avalara.comapi | In scope | 2026-11-14 |
| taxrates.api.avalara.comapi | In scope | 2026-11-14 |
| api.eu-west-1.avalara.comapi | In scope | 2026-11-14 |
| api.hopscotch.avalara.comapi | In scope | 2026-11-14 |
| api.marketing.avalara.comapi | In scope | 2026-11-14 |
| api.trustfile.avalara.comapi | In scope | 2026-11-14 |
| api.us-east-1.avalara.comapi | In scope | 2026-11-14 |
| api.us-west-2.avalara.comapi | In scope | 2026-11-14 |
| www.api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| api-apt.pt.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.connectors.avalara.comapi | In scope | 2026-11-14 |
| api.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api.vatreturns.avalara.comapi | In scope | 2026-11-14 |
| exemptions.api.avalara.comapi | In scope | 2026-11-14 |
| google.api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| landedcost.api.avalara.comapi | In scope | 2026-11-14 |
| mylodgetax.api.avalara.comapi | In scope | 2026-11-14 |
| onboarding.api.avalara.comapi | In scope | 2026-11-14 |
| api.capital.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| returns-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| internal.api.kyc.avalara.comapi, internal | In scope | 2026-11-14 |
| returns-api.emea.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.eu-west-1.avalara.comapi, test | In scope | 2026-11-14 |
| api.uat.us-west-2.avalara.comapi, test | In scope | 2026-11-14 |
| qa.onboarding.api.avalara.comapi, test | In scope | 2026-11-14 |
| api-pub.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api-web.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.sbx.exemptions.avalara.comapi, test | In scope | 2026-11-14 |
| api.vatreturns.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.web.exemptions.avalara.comapi | In scope | 2026-11-14 |
| dev.onboarding.api.avalara.comapi, dev | In scope | 2026-11-14 |
| exemptions.api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| taxcode-api.avatax.avalara.comapi | In scope | 2026-11-14 |
| www.landedcost.api.avalara.comapi | In scope | 2026-11-14 |
| www.mylodgetax.api.avalara.comapi | In scope | 2026-11-14 |
| api-jobs.exemptions.avalara.comapi | In scope | 2026-11-14 |
| managed-support-api.avalara.comapi | In scope | 2026-11-14 |
| perf.landedcost.api.avalara.comapi, test | In scope | 2026-11-14 |
| avatax-api.eu-west-1.avalara.comapi | In scope | 2026-11-14 |
| returns-api.sbx.emea.avalara.comapi, test | In scope | 2026-11-14 |
| stable-api.trustfile.avalara.comapi | In scope | 2026-11-14 |
| api-web.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.sbx.web.exemptions.avalara.comapi, test | In scope | 2026-11-14 |
| sandbox.landedcost.api.avalara.comapi, test | In scope | 2026-11-14 |
| sandbox.onboarding.api.avalara.comapi, test | In scope | 2026-11-14 |
| api-jobs.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.intuition.hopscotch.avalara.comapi | In scope | 2026-11-14 |
| managed-support-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| avatax-api.sbx.eu-west-1.avalara.comapi, test | In scope | 2026-11-14 |
| api.eu-west-1.extractor.studio.avalara.comapi | In scope | 2026-11-14 |
| obligations-failover.api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| www.api.eu-west-1.extractor.studio.avalara.comapi | In scope | 2026-11-14 |
3,938 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.