Bug bounty program
JE
JetBlue
Most upvoted reports7
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Sensitive information disclosure on grafanaAnalysed#1448218 | No weakness recorded | 2024-02-26 | – | 45 |
| Dom-Based XSS on parameter ?vsid=Analysed#1452149 | Cross-site Scripting | 2022-12-30 | – | 27 |
| Access to tomcat-manager with default credsAnalysed#1267174 | Authentication | 2023-02-05 | – | 24 |
| Open RedirectionAnalysed#1267176 | Open Redirect | 2023-02-05 | – | 21 |
| Open Redirect - https://████████.jetblue.com/███?url=Analysed#1851969 | Open Redirect | 2023-03-13 | – | 21 |
| Open Redirect#1457736 | Open Redirect | 2023-01-29 | – | 13 |
| XSS via Vuln Rendertron Instance At `██████████.jetblue.com/render/*`#1853061 | Cross-site Scripting | 2023-06-20 | – | 13 |
Subdomains938
| Name | Scope | First seen |
|---|---|---|
| metrics.jetblue.commonitoring | In scope | 2026-11-14 |
| kibana.it.jetblue.commonitoring | In scope | 2026-11-14 |
| grafana.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus.it.jetblue.commonitoring | In scope | 2026-11-14 |
| kibana-devops.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-qa.it.jetblue.commonitoring, test | In scope | 2026-11-14 |
| grafana-devops.it.jetblue.commonitoring | In scope | 2026-11-14 |
| kibana-sandbox.it.jetblue.commonitoring, test | In scope | 2026-11-14 |
| prometheus-dev.it.jetblue.comdev, monitoring | In scope | 2026-11-14 |
| prometheus-int.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-prd.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-stg.it.jetblue.commonitoring, staging | In scope | 2026-11-14 |
| prometheus-blue.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-green.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-tools.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-devops.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-bluecms.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-prdeast.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-prdwest.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-stgwest.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-greencms.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-digbstgeast.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-digbstgwest.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-greencmsstg.it.jetblue.commonitoring | In scope | 2026-11-14 |
| prometheus-greendotcomstg.it.jetblue.commonitoring | In scope | 2026-11-14 |
933 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.