Target Policy

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• payment.pixiv.net

  URL

  critical
• http://*.fanbox.cc

  ---

  * This site uses pixiv account (signup at https://accounts.pixiv.net).
  

  WILDCARD

  critical
• *.pixiv.co.jp

  WILDCARD

  none
• https://vroid.com/studio

  URL

  critical
• accounts.pixiv.net

  ---

  * Signin / signup site for many pixiv products (`*.pixiv.net`, `*.booth.pm`, etc).

  URL

  critical
• factory.pixiv.net

  ---

  * This site is in Japanese.
  * This site uses pixiv account (signup at https://accounts.pixiv.net).

  URL

  none
• https://github.com/pixiv/charcoal

  ---

  charcoal (https://github.com/pixiv/charcoal) is a set of libraries used as a design system and maintained by pixiv.

  In scope
  - Vulnerabilities caused by the libraries included in charcoal
  - Supply chain vulnerabilities related to the dependencies of charcoal libraries

  Out of scope
  - Vulnerabilities of sites using any of the charcoal libraries (including services by pixiv inc)

  SOURCE_CODE

  critical
• *.fanbox.cc

  ---

  * This site uses pixiv account (signup at https://accounts.pixiv.net).
  

  WILDCARD

  critical
• comic.pixiv.net

  ---

  This site is in Japanese.
  This site uses pixiv account (signup at https://accounts.pixiv.net).
  - Web: https://comic.pixiv.net
  - iOS : https://apps.apple.com/jp/app/pixiv%E3%82%B3%E3%83%9F%E3%83%83%E3%82%AF/id975414811
  - Android: https://play.google.com/store/apps/details?id=jp.pxv.android.manga

  URL

  critical
• comic-indies.pixiv.net

  ---

  /submission is the only part excluded from vulnerability testing

  URL

  critical
• pastela.app

  ---

  - This site uses pixiv account (signup at https://accounts.pixiv.net).
  - PC: https://pastela.app
  - iPadOS: https://apps.apple.com/app/pastela/id6478907270

  URL

  critical
• sketch.pixiv.net

  ---

  /lives/ is out of scope for scheduled to be discontinued.

  * This site is in Japanese.
  * This site uses pixiv account (signup at https://accounts.pixiv.net).
  * PC: https://sketch.pixiv.net/
  * iOS: https://itunes.apple.com/app/pixiv-sketch/id991334925
  * Android: https://play.google.com/store/apps/details?id=jp.pxv.android.sketch

  URL

  critical
• neoket.net

  URL

  critical
• sensei.pixiv.net

  URL

  critical
• booth.pm

  ---

  * This site uses pixiv account (signup at https://accounts.pixiv.net).
  * PC: https://booth.pm

  URL

  critical
• vroid.com

  URL

  critical
• hub.vroid.com

  ---

  * This site uses pixiv account (signup at https://accounts.pixiv.net).
  * This is a site where users share their 3D characters in [VRM file format](https://vrm.dev/en/).
  * When testing with VRM, please use characters provided by [our official account](https://hub.vroid.com/users/36144806).
  * Go to a character -> click "Use this model" -> click "Download".
  * Please avoid interactions / exposure to other users to the best of you ability.

  URL

  critical
• www.pixiv.net

  ---

  * The core pixiv.
  * Signup at https://accounts.pixiv.net
  * PC: https://www.pixiv.net/
  * iOS: https://itunes.apple.com/app/pixiv/id337248563
  * Android: https://play.google.com/store/apps/details?id=jp.pxv.android

  URL

  critical
• coban.pixiv.net

  URL

  critical
• dic.pixiv.net

  URL

  critical
• novel.pixiv.net

  ---

  This site is in Japanese.
  This site uses pixiv account (signup at https://accounts.pixiv.net).
  - Web: https://novel.pixiv.net

  URL

  critical

Target Scope Domains

• accounts.pixiv.net
• booth.pm
• coban.pixiv.net
• comic-indies.pixiv.net
• comic.pixiv.net
• dic.pixiv.net
• fanbox.cc
• hub.vroid.com
• neoket.net
• novel.pixiv.net
• pastela.app
• payment.pixiv.net
• sensei.pixiv.net
• sketch.pixiv.net
• vroid.com
• www.pixiv.net

• 4602 Subdomains
• 15978 Endpoints
• Download wordlist

Last Finished Scan: