Bug bounty program
HH
Hyatt Hotels
Most upvoted reports1
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Hyatt WeChat Secret, Baidu AK Secret, and mysql db credentials inadvertantly made publicly available#478813 | No weakness recorded | – | $300 | 16 |
Subdomains3,607
| Name | Scope | First seen |
|---|---|---|
| test.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| test1.hyatt.comtest | Not in the scope | 2026-11-14 |
| test2.hyatt.comtest | Not in the scope | 2026-11-14 |
| test3.hyatt.comtest | Not in the scope | 2026-11-14 |
| ca.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| gds.uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat-idm.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat-oam.hyatt.comtest | Not in the scope | 2026-11-14 |
| wfm.uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| crs.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| crs.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| eoi.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.test.hyatt.comtest | Not in the scope | 2026-11-14 |
| apigw-uat.hyatt.comapi, test | Not in the scope | 2026-11-14 |
| prio.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| upms.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| upms.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| apihub-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa.private.hyatt.cominternal, test | Not in the scope | 2026-11-14 |
| rates.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| rates.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| sales.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| tools.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| apibahn-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| booker.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| cascade-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| gemapi.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| public.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| public.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| test.hyview.hyatt.comtest | Not in the scope | 2026-11-14 |
| uat.private.hyatt.cominternal, test | Not in the scope | 2026-11-14 |
| upsell.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| venafi.test.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.ca.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.gds.uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.wfm.uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| cdvault.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| reserve.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| reserve.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| sectigo.test.hyatt.comtest | Not in the scope | 2026-11-14 |
| booker01.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| booker02.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| hpecontent-qa.hyatt.comtest | Not in the scope | 2026-11-14 |
| scapegoat-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| api-wechat-uat.hyatt.comapi, test | Not in the scope | 2026-11-14 |
| hpecontent-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa.reservation.hyatt.comtest | Not in the scope | 2026-11-14 |
| hcombooker.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| hcombooker.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| ibpwechatapi-qa.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.qa-hyatt-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| olsonbiapps.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| salesportal.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| internal-eoi.uat1.hyatt.cominternal, test | Not in the scope | 2026-11-14 |
| txtconcierge.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.scapegoat-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| kronos-slashdb-uat.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-ivr-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-pms-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-pos-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.qa.reservation.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-hcom-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| servicemanager.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| servicemanager.uat3.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-apple-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| upgrade-request.uat1.hyatt.comtest | Not in the scope | 2026-11-14 |
| upgrade-request.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-points-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| qa-hyatt-gp-reserve-ws.hyatt.comtest | Not in the scope | 2026-11-14 |
| sandboxsalesportal.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
| www.sandboxsalesportal.uat2.hyatt.comtest | Not in the scope | 2026-11-14 |
15 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.