Skip to content
Sign in

Bug bounty program

UC

Urban Company

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
6
Disclosed reports
6
Subdomains
146

Most upvoted reports6

Most upvoted reports of Urban Company
ReportWeaknessDisclosedBountyVotes
Critical full compromise of jarvis-new.urbanclap.com via weak session signing#1380121Authentication2022-01-30$1,500123
Broken Link on Urban Company's Vulnerability Submission Form#1239334Misconfiguration and Insecure Design2021-06-21–79
Host header injection that bypassed protection and allowed accessing multiple subdomains#1783015Server-Side Request Forgery2022-12-21$50033
Private ip leaking through response#622937Information Disclosure2021-06-16–14
Insufficient Session Expiration#1241483Authentication2021-06-23–4
Exposed data of credit card details to hacker or attacker.#1245094Information Disclosure2021-06-28–4

Subdomains146

Root
Scope
Name suggests
First seen
Text file146 names
Subdomains of Urban Company
NameScopeFirst seen
airflow.urbanclap.comtoolsNot in the scope2026-11-14
ameyo.urbanclap.comNot in the scope2026-11-14
amp.urbanclap.comNot in the scope2026-11-14
api.urbanclap.comapiNot in the scope2026-11-14
app.urbanclap.comNot in the scope2026-11-14
bagic.urbanclap.comNot in the scope2026-11-14
banter.urbanclap.comNot in the scope2026-11-14
blog.urbanclap.comNot in the scope2026-11-14
business.urbanclap.comNot in the scope2026-11-14
careers.urbanclap.comNot in the scope2026-11-14
cereb.urbanclap.comNot in the scope2026-11-14
cerebro.urbanclap.comNot in the scope2026-11-14
configs.urbanclap.comNot in the scope2026-11-14
content.urbanclap.comNot in the scope2026-11-14
content-dev.urbanclap.comdevNot in the scope2026-11-14
crm.urbanclap.comNot in the scope2026-11-14
cs.urbanclap.comNot in the scope2026-11-14
daemon.urbanclap.comNot in the scope2026-11-14
dev.urbanclap.comdevNot in the scope2026-11-14
dev-cerebro.urbanclap.comdevNot in the scope2026-11-14
dev-sherlock.urbanclap.comdevNot in the scope2026-11-14
dev-web.urbanclap.comdevNot in the scope2026-11-14
efk-auth.urbanclap.comauthNot in the scope2026-11-14
efk-old.urbanclap.comlegacyNot in the scope2026-11-14
email.urbanclap.comNot in the scope2026-11-14
event-api.urbanclap.comapiNot in the scope2026-11-14
fddkim.urbanclap.comNot in the scope2026-11-14
flipkart.urbanclap.comNot in the scope2026-11-14
gitlab.urbanclap.comgitNot in the scope2026-11-14
gpay.urbanclap.comNot in the scope2026-11-14
images.urbanclap.comNot in the scope2026-11-14
integrations.urbanclap.comNot in the scope2026-11-14
invite.urbanclap.comNot in the scope2026-11-14
jarvis.urbanclap.comNot in the scope2026-11-14
media.urbanclap.comNot in the scope2026-11-14
modules.urbanclap.comNot in the scope2026-11-14
ops.urbanclap.comNot in the scope2026-11-14
partner.urbanclap.comNot in the scope2026-11-14
partnerapp.urbanclap.comNot in the scope2026-11-14
partnerconnect.urbanclap.comNot in the scope2026-11-14
partners.urbanclap.comNot in the scope2026-11-14
poms.urbanclap.comNot in the scope2026-11-14
pro.urbanclap.comNot in the scope2026-11-14
prod-elk.urbanclap.commonitoringNot in the scope2026-11-14
provideralbums.urbanclap.comNot in the scope2026-11-14
qa-tool.urbanclap.comtestNot in the scope2026-11-14
react.urbanclap.comNot in the scope2026-11-14
reports.urbanclap.comNot in the scope2026-11-14
sblog.urbanclap.comNot in the scope2026-11-14
seo.urbanclap.comNot in the scope2026-11-14
sherlock.urbanclap.comNot in the scope2026-11-14
snapdeal.urbanclap.comNot in the scope2026-11-14
stage-ecs.urbanclap.comstagingNot in the scope2026-11-14
stage-flipkart.urbanclap.comstagingNot in the scope2026-11-14
stage-jarvis.urbanclap.comstagingNot in the scope2026-11-14
stage-partner.urbanclap.comstagingNot in the scope2026-11-14
stage-partners.urbanclap.comstagingNot in the scope2026-11-14
stage-piedpiper.urbanclap.comstagingNot in the scope2026-11-14
stage-sherlock.urbanclap.comstagingNot in the scope2026-11-14
stagealbums.urbanclap.comNot in the scope2026-11-14
static.urbanclap.comNot in the scope2026-11-14
stg.urbanclap.comstagingNot in the scope2026-11-14
stg-sd.urbanclap.comstagingNot in the scope2026-11-14
superset.urbanclap.comtoolsNot in the scope2026-11-14
testblog.urbanclap.comNot in the scope2026-11-14
www.urbanclap.comIn scope2026-11-14
alertmanager-stage.urbancompany.commonitoring, stagingNot in the scope2026-11-14
ameyoapp.urbancompany.comNot in the scope2026-11-14
analytics.urbancompany.comNot in the scope2026-11-14
blog.urbancompany.comNot in the scope2026-11-14
blog-test.urbancompany.comtestNot in the scope2026-11-14
careers.urbancompany.comNot in the scope2026-11-14
chat.urbancompany.comNot in the scope2026-11-14
chat-dev.urbancompany.comdevNot in the scope2026-11-14
claude-reports.urbancompany.comNot in the scope2026-11-14
configs.urbancompany.comNot in the scope2026-11-14
configs-dev.urbancompany.comdevNot in the scope2026-11-14
configs-stage.urbancompany.comstagingNot in the scope2026-11-14
content.urbancompany.comNot in the scope2026-11-14
content-dev.urbancompany.comdevNot in the scope2026-11-14
culture.urbancompany.comNot in the scope2026-11-14
design.urbancompany.comNot in the scope2026-11-14
dev-chat.urbancompany.comdevNot in the scope2026-11-14
dev-configs.urbancompany.comdevNot in the scope2026-11-14
dev-ejabberd.urbancompany.comdevNot in the scope2026-11-14
dev-mygate.urbancompany.comdevNot in the scope2026-11-14
dev-ops.urbancompany.comdevNot in the scope2026-11-14
dev-partner.urbancompany.comdevNot in the scope2026-11-14
dev-pigeon.urbancompany.comdevNot in the scope2026-11-14
console.paralus.dev.urbancompany.comadmin, devNot in the scope2026-11-14
eas-stage.urbancompany.comstagingNot in the scope2026-11-14
ejabberd.urbancompany.comNot in the scope2026-11-14
emissary-private-prod-lb.urbancompany.cominternalNot in the scope2026-11-14
emissary-public-dev-lb.urbancompany.comdevNot in the scope2026-11-14
emissary-public-prod-lb.urbancompany.comNot in the scope2026-11-14
emissary-public-prod-lb-new.urbancompany.comNot in the scope2026-11-14
emissary-public-stage-lb.urbancompany.comstagingNot in the scope2026-11-14
emissary-stage.urbancompany.comstagingNot in the scope2026-11-14
emissary-stage-lb.urbancompany.comstagingNot in the scope2026-11-14
gitlab-external.urbancompany.comgitNot in the scope2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in