Skip to content

Zooplus - HackerOne Bounty Program

Program URL: https://hackerone.com/zooplus
Last Updated: 2025-09-01

Historical Activity (recent)

  • Zooplus appears in high-value targets as European e-commerce leader.
  • See High-Value index for 6-month payout ranking and cadence.
  • Summaries derived from HackerOne hacktivity "BountyAwarded" events.

Scope Snapshot (as of 2025-09-01)

See scope.md for full text capture and breakdown.

Primary Domain: zooplus.com

Attack Surface Enumeration (2025-09-01)

Discovered Subdomains: 5 Live Web Services: 8 Services with Interesting Endpoints: 0 (initial scan)

Key Findings:

  • E-commerce Platform: 5 subdomains with 8 active web services
  • European Market Focus: Likely multi-country e-commerce presence
  • Pet Industry Leader: Online pet supplies and accessories

Research Priorities:

  • E-commerce Security: Payment processing, shopping cart, checkout flows
  • Customer Account Management: Registration, authentication, profile management
  • International Platforms: Country-specific domains and localized services
  • Mobile Applications: iOS/Android apps and associated APIs
  • Logistics Systems: Inventory management, shipping, delivery tracking

Attack Vectors to Explore:

  1. Payment Security: Credit card processing, payment gateway integration
  2. Customer Data Protection: Personal information, purchase history, preferences
  3. Account Security: Authentication bypass, session management, privilege escalation
  4. International Infrastructure: Cross-border data handling, GDPR compliance
  5. Supply Chain Systems: Vendor interfaces, inventory management, logistics

E-commerce Specific Considerations:

  • PCI DSS Compliance: Payment card security standards
  • GDPR/Privacy: European data protection regulations
  • Multi-currency Support: International payment processing
  • Inventory Systems: Stock management, product catalogs

Notes

  • Track program policy updates and scope changes monthly.
  • Focus on e-commerce specific vulnerabilities and customer data protection.
  • European company - emphasize GDPR compliance and data protection.

Current public scope

Verified public scope and policy

Historical research notes on this page are not verified authorization or current scope. Consult the linked public snapshot and the current HackerOne policy before testing.