HuntDash - mercadolibre

Target Policy

https://hackerone.com/mercadolibre?type=team

Structured Scope

Asset Identifier

Asset Type

Max Severity
www.mercadolibre.com.cl

URL

critical
www.mercadopago.com.cl

URL

critical
com.mercadoenvios.driver

Tier 1 - Mercado Envíos Flex: https://play.google.com/store/apps/details?id=com.mercadoenvios.driver

GOOGLE_PLAY_APP_ID

critical
tucarro.com.co

Tier 2

URL

critical
*.mercadolibre.com.mx

Tier 1

WILDCARD

critical
furycloud.io

Tier 2 - Exposed in ZT

URL

critical
*.mercadoshops.com

Tier 2

WILDCARD

critical
*.mercadoshops.com.mx

Tier 2

WILDCARD

critical
*.mercadoshops.com.uy

Tier 2

WILDCARD

critical
meliplay.com.ar

Tier 2

URL

critical
www.mercadolibre.com.hn

Tier 2

URL

critical
*.mercadopago.com.pe

Tier 1

WILDCARD

critical
*.gokangu.mx

Kangu

WILDCARD

none
www.mercadopago.com.*/developers

URL

none
biolibre.co

Tier 2

URL

critical
mercadoplay.uy

Tier 2

URL

critical
*.mercadopago.cl

Tier 1

WILDCARD

critical
Crypto

- www.mercadopago.com.mx/crypto/*
- www.mercadopago.cl/crypto/*
- www.mercadopago.com.br/crypto/*

OTHER

critical
furydocs.io

Tier 2 - Exposed in ZT

URL

critical
mercadolibreexperience.cl

Tier 2

URL

critical
*.mercadoshops.com.py

Tier 2

WILDCARD

critical
www.mercadolibre.com.do

Tier 2

URL

critical
mercadolivreexperience.com.br/

Tier 2

URL

critical
sustentabilidadmercadolibre.com/

Tier 2

URL

critical
*.mercadopago.com.uy

Tier 1

WILDCARD

critical
www.mercadopago.com.pe

URL

critical
mercadoplay.com.uy

Tier 2

URL

critical
*.mercadolibre.com

Tier 1

WILDCARD

critical
*.mercadolibre.com.co

Tier 1

WILDCARD

critical
www.mercadolibre.com.py

Tier 2

URL

critical
*.mercadopago.com

Tier 1

WILDCARD

critical
*.mercadolibre.com.uy

Tier 1

WILDCARD

critical
*.mercadolibre.com

.

URL

critical
*.mercadolibre.com.ar

.

URL

critical
*.mercadolibre.com.uy

.

URL

critical
*.mercadolibre.com.br

.

URL

critical
*.mercadopago.com.ar

.

URL

critical
*.mercadopago.com.br

.

URL

critical
*.mercadopago.com.uy

.

URL

critical
*.mercadoshops.com.ec

Tier 2

WILDCARD

critical
*.mercadoshops.com.pa

Tier 2

WILDCARD

critical
biolivre.com.br

Tier 2

URL

critical
mercadoplay.pe

Tier 2

URL

critical
tucarro.com

Tier 2

URL

critical
portalinmobiliario.com

Tier 2

URL

critical
*.mercadolibre.com.pe

Tier 1

WILDCARD

critical
*.mercadopago.com.mx

Tier 1

WILDCARD

critical
*.mercadopago.com.co

Tier 1

WILDCARD

critical
*.mercadopago.com.br

Tier 1

WILDCARD

critical
www.mercadolibre.com.ec

Tier 2

URL

critical
*.mercadoshops.cl

Tier 2

WILDCARD

critical
www.mercadolibre.co.cr

Tier 2

URL

critical
*.mlstatic.com

Tier 2

WILDCARD

critical
*.mercadoshops.com.do

Tier 2

WILDCARD

critical
Other

EKO{meli_bounty_program}

OTHER

none
*.kangu.tech

Kangu

WILDCARD

none
*.mercadopago.com.ar

Tier 1

WILDCARD

critical
www.mercadolibre.com.sv

Tier 2

URL

critical
*.mercadolibre.cl

Tier 1

WILDCARD

critical
mercadoplay.com.pe

Tier 2

URL

critical
tumoto.com

Tier 2

URL

critical
www.mercadopago.com.ec

Tier 2

URL

critical
meliplay.com.uy

Tier 2

URL

critical
*.gokangu.cl

Kangu

WILDCARD

none
com.mercadoenvios.crowdsourcing

Tier 1 - Mercado Envíos Extra: https://play.google.com/store/apps/details?id=com.mercadoenvios.crowdsourcing

GOOGLE_PLAY_APP_ID

critical
meliplay.com.pe

Tier 2

URL

critical
portalinmobiliario.cl

Tier 2

URL

critical
www.mercadolibre.com.gt

Tier 2

URL

critical
*.mercadolivre.com.br

Tier 1

WILDCARD

critical
biolibre.cl

Tier 2

URL

critical
www.mercadolibre.com.ni

Tier 2

URL

critical
*.kangu.com.br

Kangu

WILDCARD

none
*.mercadoshops.com.ar

Tier 2

WILDCARD

critical
www.mercadopago.com.uy

URL

critical
biolibre.ar

Tier 2

URL

critical
www.mercadopago.com.co

URL

critical
*.gokangu.uy

Kangu

WILDCARD

none
mercadoplay.co

Tier 2

URL

critical
*.mercadolibre.com.ar

Tier 1

WILDCARD

critical
*.mercadoshops.co.cr

Tier 2

WILDCARD

critical
Leaked Credentials

Select this asset for issues related to credentials from public sources

OTHER

high
www.mercadolibre.com.pa

Tier 2

URL

critical
*.mercadoshops.com.co

Tier 2

WILDCARD

critical
mercadolivreexperience.com.br

Tier 2

URL

critical
sustentabilidadmercadolibre.com

Tier 2

URL

critical
Mercado Pago Apps Endpoints

The **endpoints in scope** at this point in time are **just only those consumed by the Mercado Pago Mobile Apps** (Android & iOS). Domains and subdomains consumed through a webview/web browser inside app are out of scope. Third party sites also are out of scope.

OTHER

critical
www.mercadolivre.com

Tier 2

URL

critical
*.gokangu.co

Kangu

WILDCARD

none
com.mercadoenvios.logistics

Tier 1 - Mercado Envíos Logistics: https://play.google.com/store/apps/details?id=com.mercadoenvios.logistics

GOOGLE_PLAY_APP_ID

critical
*.mercadoshops.com.br

Tier 2

WILDCARD

critical
*.adminml.com

Tier 1

WILDCARD

critical
biolibre.mx

Tier 2

URL

critical
*.mercadoshops.com.pe

Tier 2

WILDCARD

critical
logistica.redelcom.cl

Tier 2

URL

critical
www.mercadolibre.com.bo

Tier 2

URL

critical
com.mercadolibre.android.mplay_tv

Tier 2

GOOGLE_PLAY_APP_ID

critical
Point Smart

Tier 1 - MLA - https://www.mercadopago.com.ar/point-smart
Tier 1 - MLB - https://www.mercadopago.com.br/point-smart

HARDWARE

critical
www.mercadolibre.com.pe

URL

critical
.*mercadolibre.*

URL

none
com.3mosquitos.MercadoLibre

Tier 1 - Mercado Libre iOS: https://apps.apple.com/ar/app/mercado-libre/id463624852

APPLE_STORE_APP_ID

critical
www.mercadolibre.com.mx

URL

critical
www.mercadopago.com.mx

URL

critical
www.mercadopago.com.br

URL

critical
www.mercadolibre.com.uy

URL

critical
com.mercadopago.MercadoPago

Tier 1 - Mercado Pago iOS:
https://itunes.apple.com/ar/app/mercado-pago-recargar-celular/id925436649

APPLE_STORE_APP_ID

critical
www.mercadolibre.com.co

URL

critical
api.mercadolibre.com

Tier 1 - See documentation: https://developers.mercadolibre.com.ar/en_us/api-docs

URL

critical
www.mercadopago.cl

URL

critical
com.mercadopago.wallet

Tier 1 - Mercado Pago Android:
https://play.google.com/store/apps/details?id=com.mercadopago.wallet

GOOGLE_PLAY_APP_ID

critical
api.mercadopago.com

Tier 1 - See documentation: https://www.mercadopago.com.ar/developers/en/reference

URL

critical
www.mercadopago.com.ar

URL

critical
com.mercadolibre

Tier 1 - Mercado Libre Android: https://play.google.com/store/apps/details?id=com.mercadolibre

GOOGLE_PLAY_APP_ID

critical
www.mercadolibre.cl

URL

critical
www.mercadolivre.com.br

URL

critical
www.mercadolibre.com.ar

URL

critical