Bug bounty program
JE
JetBlue
Most upvoted reports7
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Sensitive information disclosure on grafanaAnalysed#1448218 | No weakness recorded | 2024-02-26 | – | 45 |
| Dom-Based XSS on parameter ?vsid=Analysed#1452149 | Cross-site Scripting | 2022-12-30 | – | 27 |
| Access to tomcat-manager with default credsAnalysed#1267174 | Authentication | 2023-02-05 | – | 24 |
| Open RedirectionAnalysed#1267176 | Open Redirect | 2023-02-05 | – | 21 |
| Open Redirect - https://████████.jetblue.com/███?url=Analysed#1851969 | Open Redirect | 2023-03-13 | – | 21 |
| Open Redirect#1457736 | Open Redirect | 2023-01-29 | – | 13 |
| XSS via Vuln Rendertron Instance At `██████████.jetblue.com/render/*`#1853061 | Cross-site Scripting | 2023-06-20 | – | 13 |
Subdomains938
| Name | Scope | First seen |
|---|---|---|
| test.jetblue.comtest | In scope | 2026-11-14 |
| api-qa.jetblue.comapi, test | In scope | 2026-11-14 |
| www-qa.jetblue.comtest | In scope | 2026-11-14 |
| b6-test.jetblue.comtest | In scope | 2026-11-14 |
| aqd-test.jetblue.comtest | In scope | 2026-11-14 |
| b6-api-qa.jetblue.comapi, test | In scope | 2026-11-14 |
| qa-orgeng.jetblue.comtest | In scope | 2026-11-14 |
| test.test.jetblue.comtest | In scope | 2026-11-14 |
| traxaua-qa.jetblue.comtest | In scope | 2026-11-14 |
| awr-ov-test.jetblue.comtest | In scope | 2026-11-14 |
| test-app.it.jetblue.comtest | In scope | 2026-11-14 |
| awr-int-test.jetblue.comtest | In scope | 2026-11-14 |
| blueinc-test.jetblue.comtest | In scope | 2026-11-14 |
| itpe-test-ev.jetblue.comtest | In scope | 2026-11-14 |
| jira-test.it.jetblue.comtest, tools | In scope | 2026-11-14 |
| qa.nkp-orgeng.jetblue.comtest | In scope | 2026-11-14 |
| uat-jbdesktop.jetblue.comtest | In scope | 2026-11-14 |
| api-dev-int-qa.jetblue.comapi, dev, test | In scope | 2026-11-14 |
| pay.qa.egw.ctr.jetblue.comtest | In scope | 2026-11-14 |
| qa-jenkins2.it.jetblue.comci, test | In scope | 2026-11-14 |
| agentdesktop-qa.jetblue.comtest | In scope | 2026-11-14 |
| book.qa.egw.ctr.jetblue.comtest | In scope | 2026-11-14 |
| prometheus-qa.it.jetblue.commonitoring, test | In scope | 2026-11-14 |
| kibana-sandbox.it.jetblue.commonitoring, test | In scope | 2026-11-14 |
| kioskcheckinaz-qa.jetblue.comtest | In scope | 2026-11-14 |
| ibmrest.qa.egw.ctr.jetblue.comtest | In scope | 2026-11-14 |
| smartsuitecloud-qa.jetblue.comtest | In scope | 2026-11-14 |
| tdprest.qa.egw.ctr.jetblue.comtest | In scope | 2026-11-14 |
| fe.qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| messaging-forms-demo.jetblue.comtest | In scope | 2026-11-14 |
| oe-qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| tdprestpay.qa.egw.ctr.jetblue.comtest | In scope | 2026-11-14 |
| m.sc.qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| r.oe.qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| agentdesktop-external-qa.jetblue.comtest | In scope | 2026-11-14 |
| barclays-qa-frictionless2.jetblue.comtest | In scope | 2026-11-14 |
| testing.jetblueuniversity.jetblue.comtest | In scope | 2026-11-14 |
| travelbank-test-cert-trial.jetblue.comtest | In scope | 2026-11-14 |
| derbysoft-qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| switchfly-qa.travelproducts.jetblue.comtest | In scope | 2026-11-14 |
| disney-qa.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
| agentdesktop-external-sandbox.jetblue.comtest | In scope | 2026-11-14 |
| elastic-admin.agentdesktop-qa.jetblue.comadmin, data, test | In scope | 2026-11-14 |
| www.disney-qa.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
| elastic-admin.agentdesktop-external-qa.jetblue.comadmin, data, test | In scope | 2026-11-14 |
| pushpnr-qa.switchfly.api.travelproducts.jetblue.comapi, test | In scope | 2026-11-14 |
| elastic-admin.agentdesktop-external-sandbox.jetblue.comadmin, data, test | In scope | 2026-11-14 |
933 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.