Skip to content
Sign in

Bug bounty program

HH

Hyatt Hotels

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
59
Disclosed reports
1
Subdomains
3,607

Most upvoted reports1

Most upvoted reports of Hyatt Hotels
ReportWeaknessDisclosedBountyVotes
Hyatt WeChat Secret, Baidu AK Secret, and mysql db credentials inadvertantly made publicly available#478813No weakness recorded–$30016

Subdomains3,607

Root
Scope:In scope
Name suggests
First seen
Text fileClear filters15 names
Subdomains of Hyatt Hotels
NameScopeFirst seen
assets.hyatt.comIn scope2026-11-14
newsroom.images.hyatt.comIn scope2026-11-14
meetings.hyatt.comIn scope2026-11-14
mobileapp.hyatt.comIn scope2026-11-14
ebsext.oft.hyatt.comIn scope2026-11-14
soaext.oft.hyatt.comIn scope2026-11-14
sso.oft.hyatt.comauthIn scope2026-11-14
plannerrequest.hyatt.comIn scope2026-11-14
public.hyatt.comIn scope2026-11-14
roominglist.hyatt.comIn scope2026-11-14
salesportal.hyatt.comIn scope2026-11-14
scapegoat.hyatt.comIn scope2026-11-14
upsell.hyatt.comIn scope2026-11-14
world.hyatt.comIn scope2026-11-14
www.hyatt.comIn scope2026-11-14

15 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in