**Critical Site**
Firefox Push Service.
Additional domains in scope:
- updates.push.services.mozilla.com
Testing to be done on below staging instances:
- wss://autopush.stage.mozaws.net
- https://updates-autopush.stage.mozaws.net
Pocket iOS Application.
**Only versions greater than version 8 are included in the scope.**
Pocket authentication system is being migrated to Firefox Accounts, therefore, it is currently out of scope of the program until further notice.
**Critical Site**
Additional domains in scope for Firefox Accounts:
* api.accounts.firefox.com
* oauth.accounts.firefox.com
* profile.accounts.firefox.com
* verifier.accounts.firefox.com
* subscriptions.firefox.com
**Critical Site**
Firefox Suggest
Testing to be performed on staging instance only: https://stage.merino.nonprod.cloudops.mozgcp.net/api/v1/suggest
**Critical Site**
Backend update system for Mozilla products.
No disruptive testing or scanning tools to be run on production.
Pocket Android Application.
**Pocket authentication system is being migrated to Firefox Accounts, therefore, it is currently out of scope of the program until further notice.**
**Critical Site**
Tool used to land Firefox code into Mercurial.
Additional Domains:
- api.lando.services.mozilla.com
** Testing to be done on staging or development instances only:**
ui.dev.lando.nonprod.cloudops.mozgcp.net
ui.stage.lando.nonprod.cloudops.mozgcp.net
api.dev.lando.nonprod.cloudops.mozgcp.net
api.stage.lando.nonprod.cloudops.mozgcp.net
**Critical Site**
Source code and version control for Firefox.
The scope includes vulnerabilities that affect the source code itself.
**Critical Site**
Endpoint for sending Firefox crash reports.
Testing to be done on staging instance: https://crash-reports.allizom.org/
**Critical Site**
Mozilla owned Bugzilla instance.
Please do not use automated scanners, create, or modify bugs when testing Bugzilla. Instead, testing should be only done on the development instance, bugzilla-dev.allizom.org.
Analytics site for Firefox crash reports data.
Testing to be done on staging: https://crash-stats.allizom.org/
Endpoint for sending Firefox crash reports.
Testing to be done on staging instance: https://crash-reports.allizom.org/
Mozilla's Localization Platform.
** Testing to be done on staging instance only: https://mozilla-pontoon-staging.herokuapp.com/ **
Testing to be done on the development instance (phabricator-dev.allizom.org) and the staging instance (phabricator.allizom.org)
**Critical Site**
** Do not run automated scans on those domains**
Firefox product delivery domains:
- archive.mozilla.org
- download.mozilla.org
- download-installer.cdn.mozilla.net
- treeherder.mozilla.org
**Critical Site**
Firefox Tile service.
Testing to be performed on staging instance: https://contile-stage.topsites.nonprod.cloudops.mozgcp.net/
**Critical Site**
Firefox Sync Domains:
- *.sync.services.mozilla.com
- token.services.mozilla.com
**Critical Site**
Staging instance for Mozilla Localization Service.
Testing is to be done on this instance only, testing on production is not acceptable.
**Critical Site**
Anti-tracking protection service in Firefox.
Additional domain: shavar.prod.mozaws.net
Please do not run automated scans or denial of service testing on this service.
**Critical Site**
This is the staging server for Firefox Addons. Testing should be restricted to this instance without any testing on production.
Additional domains for Addons:
- services.addons.allizom.org
- versioncheck-bg.addons.allizom.org
- versioncheck.addons.allizom.org
**Critical Site**
Mozilla VPN iOS, Android, Desktop Clients.
Note that Mozilla VPN subscriptions are only open in [these countries](https://support.mozilla.org/en-US/kb/mozilla-vpn-countries-available-subscribe).
**Critical Site**
Analytics site for Firefox crash reports data.
Testing to be done on staging instance only: https://crash-stats.allizom.org/
**Critical Site**
TaskCluster CI/CD tool instance used for Firefox builds.
**Critical Site**
Additional domains for Remote Settings:
webextensions.settings.services.mozilla.com
firefox-settings-attachments.cdn.mozilla.net
Testing to be performed on staging instance only: https://firefox.settings.services.allizom.org/v1/
**Critical Site**
Testing to be done **only** on the development instance (phabricator-dev.allizom.org) or the staging instance (phabricator.allizom.org)
Firefox Location Service.
Testing to be done on staging instance: location.stage.mozaws.net