Bug bounty program
JE
JetBlue
Most upvoted reports7
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Sensitive information disclosure on grafanaAnalysed#1448218 | No weakness recorded | 2024-02-26 | – | 45 |
| Dom-Based XSS on parameter ?vsid=Analysed#1452149 | Cross-site Scripting | 2022-12-30 | – | 27 |
| Access to tomcat-manager with default credsAnalysed#1267174 | Authentication | 2023-02-05 | – | 24 |
| Open RedirectionAnalysed#1267176 | Open Redirect | 2023-02-05 | – | 21 |
| Open Redirect - https://████████.jetblue.com/███?url=Analysed#1851969 | Open Redirect | 2023-03-13 | – | 21 |
| Open Redirect#1457736 | Open Redirect | 2023-01-29 | – | 13 |
| XSS via Vuln Rendertron Instance At `██████████.jetblue.com/render/*`#1853061 | Cross-site Scripting | 2023-06-20 | – | 13 |
Subdomains938
| Name | Scope | First seen |
|---|---|---|
| api-dev.jetblue.comapi, dev | In scope | 2026-11-14 |
| aws-dev.jetblue.comdev | In scope | 2026-11-14 |
| www-dev2.jetblue.comdev | In scope | 2026-11-14 |
| b6-api-dev.jetblue.comapi, dev | In scope | 2026-11-14 |
| dev-orgeng.jetblue.comdev | In scope | 2026-11-14 |
| dev.orgeng.jetblue.comdev | In scope | 2026-11-14 |
| blueinc-dev.jetblue.comdev | In scope | 2026-11-14 |
| www-dev2-cf.jetblue.comdev | In scope | 2026-11-14 |
| api-dev-int-qa.jetblue.comapi, dev, test | In scope | 2026-11-14 |
| dev.nkp-orgeng.jetblue.comdev | In scope | 2026-11-14 |
| agentdesktop-dev.jetblue.comdev | In scope | 2026-11-14 |
| nstest-dev-orgeng.jetblue.comdev | In scope | 2026-11-14 |
| prometheus-dev.it.jetblue.comdev, monitoring | In scope | 2026-11-14 |
| dev.travelproducts.jetblue.comdev | In scope | 2026-11-14 |
| kioskcheckinaz-dev.jetblue.comdev | In scope | 2026-11-14 |
| kioskcheckinaz-dev2.jetblue.comdev | In scope | 2026-11-14 |
| agentdesktop-external-dev.jetblue.comdev | In scope | 2026-11-14 |
| cmsdam-dev.travelproducts.jetblue.comdev | In scope | 2026-11-14 |
| dev-api-run.travelproducts.jetblue.comapi, dev | In scope | 2026-11-14 |
| elastic-admin.agentdesktop-dev.jetblue.comadmin, data, dev | In scope | 2026-11-14 |
| elastic-admin.agentdesktop-external-dev.jetblue.comadmin, data, dev | In scope | 2026-11-14 |
933 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.