Bug bounty program
AV
Avalara
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 14
- Disclosed reports
- 0
- Subdomains
- 3,936
Most upvoted reports0
No report of this program is publicly disclosed
Subdomains3,936
| Name | Scope | First seen |
|---|---|---|
| api.avalara.comapi | In scope | 2026-11-14 |
| exemptions.api.avalara.comapi | In scope | 2026-11-14 |
| google.api.avalara.comapi | In scope | 2026-11-14 |
| landedcost.api.avalara.comapi | In scope | 2026-11-14 |
| perf.landedcost.api.avalara.comapi, test | In scope | 2026-11-14 |
| sandbox.landedcost.api.avalara.comapi, test | In scope | 2026-11-14 |
| www.landedcost.api.avalara.comapi | In scope | 2026-11-14 |
| mylodgetax.api.avalara.comapi | In scope | 2026-11-14 |
| www.mylodgetax.api.avalara.comapi | In scope | 2026-11-14 |
| onboarding.api.avalara.comapi | In scope | 2026-11-14 |
| dev.onboarding.api.avalara.comapi, dev | In scope | 2026-11-14 |
| qa.onboarding.api.avalara.comapi, test | In scope | 2026-11-14 |
| sandbox.onboarding.api.avalara.comapi, test | In scope | 2026-11-14 |
| tax.api.avalara.comapi | In scope | 2026-11-14 |
| taxrates.api.avalara.comapi | In scope | 2026-11-14 |
| api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| obligations-failover.api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| www.api.auth1.avalara.comapi, auth | In scope | 2026-11-14 |
| taxcode-api.avatax.avalara.comapi | In scope | 2026-11-14 |
| api.biztech.avalara.comapi | In scope | 2026-11-14 |
| api.capital.avalara.comapi | In scope | 2026-11-14 |
| api.connectors.avalara.comapi | In scope | 2026-11-14 |
| returns-api.emea.avalara.comapi | In scope | 2026-11-14 |
| returns-api.sbx.emea.avalara.comapi, test | In scope | 2026-11-14 |
| api.eu-west-1.avalara.comapi | In scope | 2026-11-14 |
| avatax-api.eu-west-1.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.eu-west-1.avalara.comapi, test | In scope | 2026-11-14 |
| avatax-api.sbx.eu-west-1.avalara.comapi, test | In scope | 2026-11-14 |
| api.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api-jobs.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api-pub.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api-web.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.exemptions.avalara.comapi, test | In scope | 2026-11-14 |
| api.web.exemptions.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.web.exemptions.avalara.comapi, test | In scope | 2026-11-14 |
| api.hopscotch.avalara.comapi | In scope | 2026-11-14 |
| api.intuition.hopscotch.avalara.comapi | In scope | 2026-11-14 |
| api.int.avalara.comapi | In scope | 2026-11-14 |
| api.ips.avalara.comapi | In scope | 2026-11-14 |
| api.kyc.avalara.comapi | In scope | 2026-11-14 |
| internal.api.kyc.avalara.comapi, internal | In scope | 2026-11-14 |
| managed-support-api.avalara.comapi | In scope | 2026-11-14 |
| api.marketing.avalara.comapi | In scope | 2026-11-14 |
| api-apt.pt.avalara.comapi | In scope | 2026-11-14 |
| api.ptrp.avalara.comapi | In scope | 2026-11-14 |
| returns-api.avalara.comapi | In scope | 2026-11-14 |
| api.returns.avalara.comapi | In scope | 2026-11-14 |
| api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| exemptions.api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| google.api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.capital.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api-jobs.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api-web.exemptions.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.kyc.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| managed-support-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api-apt.pt.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.ptrp.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| returns-api.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.vatreturns.sbx.avalara.comapi, test | In scope | 2026-11-14 |
| api.eu-west-1.extractor.studio.avalara.comapi | In scope | 2026-11-14 |
| www.api.eu-west-1.extractor.studio.avalara.comapi | In scope | 2026-11-14 |
| api.thegrove.avalara.comapi | In scope | 2026-11-14 |
| api.trustfile.avalara.comapi | In scope | 2026-11-14 |
| stable-api.trustfile.avalara.comapi | In scope | 2026-11-14 |
| api.uat.avalara.comapi, test | In scope | 2026-11-14 |
| api.us-east-1.avalara.comapi | In scope | 2026-11-14 |
| api.us-west-2.avalara.comapi | In scope | 2026-11-14 |
| api.uat.us-west-2.avalara.comapi, test | In scope | 2026-11-14 |
| api.vatreturns.avalara.comapi | In scope | 2026-11-14 |
| api.acu.avalara.ioapi | In scope | 2026-11-14 |
| www.api.acu.avalara.ioapi | In scope | 2026-11-14 |
| api.avalara.ioapi | In scope | 2026-11-14 |
| taxcodeclassification.api.avalara.ioapi | In scope | 2026-11-14 |
| docufetch-int-api.epsilon.prd.eu-west-1.aws.avalara.ioapi | In scope | 2026-11-14 |
| docufetch-int-api.gamma.sbx.us-west-2.aws.avalara.ioapi, test | In scope | 2026-11-14 |
| api.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| api-tcs.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| api.kyc.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| api-int.kyc.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| carol-api-prblue.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| hercule-api.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| hercule-api-classification.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| holonet-api.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| pym-api-pr.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| workflows-api-pr.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| xbc-api-pr.midgard.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| api.ptrp.ci.avalara.ioapi, ci | In scope | 2026-11-14 |
| api.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| aa.api.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api.exemptions.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api-job.exemptions.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api-jobs.exemptions.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api-web.exemptions.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api.web.exemptions.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api.ips.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| returns-api.eu.foundation.raas.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| returns-api.foundation.raas.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api.batch.tss.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
| api.wfaas.dev.avalara.ioapi, dev | In scope | 2026-11-14 |
3,936 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.