Target Policy

https://hackerone.com/mpesa?type=team

---

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• sso.m-pesa.vm.co.mz

  URL

  none
• business.m-pesa.com

  URL

  none
• m-pesa.africa

  URL

  critical
• com.vodafone.mpesa.drc

  GOOGLE_PLAY_APP_ID

  critical
• *.m-pesa.com

  ---

  There are subdomains that are out of scope
  Any subdomain containing uat, oat , mat , dev , jenkins , sandpit , nonprodss

  WILDCARD

  critical
• openapiportal.m-pesa.com

  URL

  critical
• mpa.ekyc.backoffice.m-pesa.com

  URL

  critical
• mpa.ekyc.selfregister.m-pesa.com

  URL

  critical
• sso.pr.m-pesa.vm.co.mz

  URL

  none
• openapi.m-pesa.com

  URL

  critical
• com.vodafone.mpesa.ls

  GOOGLE_PLAY_APP_ID

  critical
• com.vodacom.mpesa.ls.business

  GOOGLE_PLAY_APP_ID

  none
• com.vodafone.mpesa.mozambique

  GOOGLE_PLAY_APP_ID

  critical
• 1442121355

  ---

  https://apps.apple.com/ke/app/my-m-pesa-mozambique/id1442121355

  APPLE_STORE_APP_ID

  critical
• 1502222766

  APPLE_STORE_APP_ID

  critical
• mpa.qr.web.m-pesa.com

  OTHER

  critical

Target Scope Domains

• m-pesa.africa
• m-pesa.com
• mpa.ekyc.backoffice.m-pesa.com
• mpa.ekyc.selfregister.m-pesa.com
• openapi.m-pesa.com
• openapiportal.m-pesa.com

• 228 Subdomains
• 102 Endpoints
• Download wordlist

---

Last Finished Scan:

---