Bug bounty program
JE
JetBlue
Most upvoted reports7
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Sensitive information disclosure on grafanaAnalysed#1448218 | No weakness recorded | 2024-02-26 | – | 45 |
| Dom-Based XSS on parameter ?vsid=Analysed#1452149 | Cross-site Scripting | 2022-12-30 | – | 27 |
| Access to tomcat-manager with default credsAnalysed#1267174 | Authentication | 2023-02-05 | – | 24 |
| Open RedirectionAnalysed#1267176 | Open Redirect | 2023-02-05 | – | 21 |
| Open Redirect - https://████████.jetblue.com/███?url=Analysed#1851969 | Open Redirect | 2023-03-13 | – | 21 |
| Open Redirect#1457736 | Open Redirect | 2023-01-29 | – | 13 |
| XSS via Vuln Rendertron Instance At `██████████.jetblue.com/render/*`Analysed#1853061 | Cross-site Scripting | 2023-06-20 | – | 13 |
Subdomains938
| Name | Scope | First seen |
|---|---|---|
| api.jetblue.comapi | In scope | 2026-11-14 |
| api-qa.jetblue.comapi, test | In scope | 2026-11-14 |
| az-api.jetblue.comapi | In scope | 2026-11-14 |
| api-dev.jetblue.comapi, dev | In scope | 2026-11-14 |
| api-int.jetblue.comapi | In scope | 2026-11-14 |
| api-stg.jetblue.comapi, staging | In scope | 2026-11-14 |
| www.api.jetblue.comapi | In scope | 2026-11-14 |
| b6-api-qa.jetblue.comapi, test | In scope | 2026-11-14 |
| api.paisly.jetblue.comapi | In scope | 2026-11-14 |
| b6-api-dev.jetblue.comapi, dev | In scope | 2026-11-14 |
| b6-api-int.jetblue.comapi | In scope | 2026-11-14 |
| webservices.jetblue.comapi | In scope | 2026-11-14 |
| www.api-stg.jetblue.comapi, staging | In scope | 2026-11-14 |
| api-dev-int-qa.jetblue.comapi, dev, test | In scope | 2026-11-14 |
| webservices-stg.jetblue.comapi, staging | In scope | 2026-11-14 |
| apimnkp.api-cua-stg.jetblue.comapi, staging | In scope | 2026-11-14 |
| disney.api.travelproducts.jetblue.comapi | In scope | 2026-11-14 |
| dev-api-run.travelproducts.jetblue.comapi, dev | In scope | 2026-11-14 |
| disney-qa.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
| www.disney-qa.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
| pushpnr-qa.switchfly.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
933 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.