Bug bounty program
AV
Avalara
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 14
- Disclosed reports
- 0
- Subdomains
- 3,938
Most upvoted reports0
No report of this program is publicly disclosed
Subdomains3,938
| Name | Scope | First seen |
|---|---|---|
| asm-gateway.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| earchive-tr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| earchive-tr-dr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-fr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-fr-b2g.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-fr-dr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-fr-g2b.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-tr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| einvoicing-tr-dr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| mandate-utility-services-fr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| mandate-utility-services-fr-dr.elr.sbx.avalara.comtest | In scope | 2026-11-14 |
| api.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api-jobs.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api-web.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| filevalidator.sbx.avalara.comtest | In scope | 2026-11-14 |
| filevalidator-wss.sbx.avalara.comtest | In scope | 2026-11-14 |
| goliveingestion.sbx.avalara.comtest | In scope | 2026-11-14 |
| goliverecommendation.sbx.avalara.comtest | In scope | 2026-11-14 |
| hscode-self-classify.sbx.avalara.comtest | In scope | 2026-11-14 |
| id.sbx.avalara.comtest | In scope | 2026-11-14 |
| identity.sbx.avalara.comauth, test | In scope | 2026-11-14 |
| imports.sbx.avalara.comtest | In scope | 2026-11-14 |
| portal.inposia.sbx.avalara.comtest | In scope | 2026-11-14 |
| integrations-bff.sbx.avalara.comtest | In scope | 2026-11-14 |
| api.kyc.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| int.kyc.sbx.avalara.comtest | In scope | 2026-11-14 |
| localization-webhook.sbx.avalara.comtest | In scope | 2026-11-14 |
| managed-support-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| mcp.sbx.avalara.comtest | In scope | 2026-11-14 |
| catalog.midgard.sbx.avalara.comtest | In scope | 2026-11-14 |
| dq.midgard.sbx.avalara.comtest | In scope | 2026-11-14 |
| taxcodes.midgard.sbx.avalara.comtest | In scope | 2026-11-14 |
| taxcodes-prod.midgard.sbx.avalara.comtest | In scope | 2026-11-14 |
| ps.sbx.avalara.comtest | In scope | 2026-11-14 |
| httvalidator.ps.sbx.avalara.comtest | In scope | 2026-11-14 |
| api-apt.pt.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| ptrp.sbx.avalara.comtest | In scope | 2026-11-14 |
| api.ptrp.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| reporting-agent.sbx.avalara.comtest | In scope | 2026-11-14 |
| omni.reports.sbx.avalara.comtest | In scope | 2026-11-14 |
| returns.sbx.avalara.comtest | In scope | 2026-11-14 |
| returns-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| returnsreference.sbx.avalara.comtest | In scope | 2026-11-14 |
| shopify-connector.sbx.avalara.comtest | In scope | 2026-11-14 |
| squarespace-connector.sbx.avalara.comtest | In scope | 2026-11-14 |
| strr.sbx.avalara.comtest | In scope | 2026-11-14 |
| chat.support.sbx.avalara.comtest | In scope | 2026-11-14 |
| tradecompliance.sbx.avalara.comtest | In scope | 2026-11-14 |
| transferpricing.sbx.avalara.comtest | In scope | 2026-11-14 |
| translations-webhook.sbx.avalara.comtest | In scope | 2026-11-14 |
| usermanagement.sbx.avalara.comtest | In scope | 2026-11-14 |
| vatreporting.sbx.avalara.comtest | In scope | 2026-11-14 |
| bff.vatreporting.sbx.avalara.comtest | In scope | 2026-11-14 |
| omni.vatreporting.sbx.avalara.comtest | In scope | 2026-11-14 |
| vatreturns.sbx.avalara.comtest | In scope | 2026-11-14 |
| api.vatreturns.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| seattle-idm.avalara.com | In scope | 2026-11-14 |
| seattle-vdi.avalara.comvpn | In scope | 2026-11-14 |
| secure.avalara.com | In scope | 2026-11-14 |
| servicedesk.avalara.com | In scope | 2026-11-14 |
| shakerate.avalara.com | In scope | 2026-11-14 |
| shopify-connector.avalara.com | In scope | 2026-11-14 |
| www.shopify-connector.avalara.com | In scope | 2026-11-14 |
| shopify-extractor.avalara.com | In scope | 2026-11-14 |
| simplify.avalara.com | In scope | 2026-11-14 |
| sre-test.simplify.avalara.comtest | In scope | 2026-11-14 |
| sj-cdp.avalara.com | In scope | 2026-11-14 |
| skylab.avalara.com | In scope | 2026-11-14 |
| smallbusiness-europe.avalara.com | In scope | 2026-11-14 |
| assessment.smallbusiness-europe.avalara.com | In scope | 2026-11-14 |
| bff.smallbusiness-europe.avalara.com | In scope | 2026-11-14 |
| dev.smallbusiness-europe.avalara.comdev | In scope | 2026-11-14 |
| assessment.dev.smallbusiness-europe.avalara.comdev | In scope | 2026-11-14 |
| bff.dev.smallbusiness-europe.avalara.comdev | In scope | 2026-11-14 |
| forms.dev.smallbusiness-europe.avalara.comdev | In scope | 2026-11-14 |
| forms.smallbusiness-europe.avalara.com | In scope | 2026-11-14 |
| qa.smallbusiness-europe.avalara.comtest | In scope | 2026-11-14 |
| assessment.qa.smallbusiness-europe.avalara.comtest | In scope | 2026-11-14 |
| bff.qa.smallbusiness-europe.avalara.comtest | In scope | 2026-11-14 |
| forms.qa.smallbusiness-europe.avalara.comtest | In scope | 2026-11-14 |
| staging.smallbusiness-europe.avalara.comstaging | In scope | 2026-11-14 |
| assessment.staging.smallbusiness-europe.avalara.comstaging | In scope | 2026-11-14 |
| bff.staging.smallbusiness-europe.avalara.comstaging | In scope | 2026-11-14 |
| forms.staging.smallbusiness-europe.avalara.comstaging | In scope | 2026-11-14 |
| smetrics.avalara.com | In scope | 2026-11-14 |
| smtp1.avalara.commail | In scope | 2026-11-14 |
| smtp2.avalara.commail | In scope | 2026-11-14 |
| sponsor.avalara.com | In scope | 2026-11-14 |
| sqlssrs-acprd.avalara.com | In scope | 2026-11-14 |
| sqlssrs-cupprd.avalara.com | In scope | 2026-11-14 |
| sqlssrs-cupsbx.avalara.com | In scope | 2026-11-14 |
| squarespace-connector.avalara.com | In scope | 2026-11-14 |
| sso.avalara.comauth | In scope | 2026-11-14 |
| vatreporting.staging.avalara.comstaging | In scope | 2026-11-14 |
| stateconsole.avalara.com | In scope | 2026-11-14 |
| status.avalara.commonitoring | In scope | 2026-11-14 |
| avapayar.stg.avalara.comstaging | In scope | 2026-11-14 |
| cashapp.stg.avalara.comstaging | In scope | 2026-11-14 |
| store.avalara.com | In scope | 2026-11-14 |
| strr.avalara.com | In scope | 2026-11-14 |
3,938 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.