Target Policy

https://hackerone.com/xiaomi?type=team

---

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• Mi/Redmi Phone

  ---

  https://www.mi.com/hk/mi-note-10/,https://www.mi.com/hk/mi-a3/,https://www.mi.com/hk/max3/,https://www.mi.com/hk/mi-8-pro/,https://www.mi.com/hk/redmi-note-8-t/,https://www.mi.com/hk/redmi-note-8-pro/

  HARDWARE

  high
• com.xiaomi.mibrain.speech

  OTHER_APK

  critical
• com.xiaomi.market

  OTHER_APK

  critical
• com.android.browser

  OTHER_APK

  high
• com.miui.cloudbackup

  OTHER_APK

  critical
• http://*.mi.com

  WILDCARD

  critical
• http://*.xiaomi.com

  WILDCARD

  critical
• http://*.miui.com

  WILDCARD

  critical
• http://*.xiaomiyoupin.com

  WILDCARD

  critical
• http://*.miwifi.com

  WILDCARD

  critical
• com.xiaomi.payment

  OTHER_APK

  critical
• com.mi.global.shop

  OTHER_APK

  critical
• com.miui.cloudservice

  OTHER_APK

  critical
• Mi Robot Vacuum

  ---

  https://www.mi.com/hk/mi-robot-vacuum/

  HARDWARE

  high
• *.xiaomi.com

  WILDCARD

  critical
• Other Hardware Assets

  ---

  Accepted ranges of hardware in Xiaomi’s Program include Xiaomi and Mijia products ( these are for assets that are not specified in the Hardware/IoT scope list )

  OTHER

  critical
• *.mi.com

  WILDCARD

  critical
• Other APK Assets

  ---

  com.miui.screenrecorder
  com.android.providers.telephony
  com.android.dynsystem
  com.miui.powerkeeper
  com.xiaomi.miplay_client
  com.milink.service
  com.xiaomi.mi_connect_service
  com.android.updater
  com.miui.securityadd/com.miui.gallery/com.android.mms.service/com.miui.msa.global/com.android.browser/com.miui.videoplayer/com.android.soundrecorder/com.miui.backup/com.miui.notification/com.android.certinstaller/com.miui.huanji/com.miui.hybrid/com.miui.vsimcore/com.miui.securitycore/com.mi.health/com.xiaomi.simactivate.service/com.miui.phrase/com.miui.player/com.miui.miservice/com.android.provision/com.miui.system/com.miui.global.packageinstaller/com.miui.compass/com.miui.cit/com.miui.android.fashiongallery/com.miui.bugreport/com.android.fileexplorer/com.android.camera/com.xiaomi.glgm/com.xiaomi.xmsf/com.miui.mishare.connectivity/com.miui.freeform/com.xiaomi.finddevice/com.mi.global.bbs/com.xiaomi.joyose/com.mi.android.globalFileexplorer/com.miui.notes/com.miui.wmsvc/com.xiaomi.midrop/com.miui.touchassistant/com.miui.miwallpaper/com.xiaomi.bluetooth/com.miui.cleanmaster/com.miui.analytics/com.android.settings/com.xiaomi.scanner/com.android.phone/com.android.deskclock/com.android.systemui/com.xiaomi.discover/com.android.thememanager/com.android.bluetooth/com.miui.face/com.miui.home
  

  OTHER

  high
• Mi Band

  ---

  mi-band-3/4/5

  HARDWARE

  high
• com.xiaomi.account

  OTHER_APK

  critical
• Mi Home Webcam

  ---

  https://www.mi.com/us/mi-home-security-camera/ , https://www.mi.com/in/camera-360/

  HARDWARE

  high
• Mi TV Box

  ---

  https://www.mi.com/us/mi-box-s/

  HARDWARE

  high
• Mi Laser Projector

  ---

  https://www.mi.com/us/mi-laser-projector-150/

  HARDWARE

  high
• Mi TV

  ---

  https://store.mi.com/in/accessories/213

  HARDWARE

  high
• com.miui.micloudsync

  OTHER_APK

  critical
• Mi Electric Scooter

  ---

  https://www.mi.com/us/mi-electric-scooter/

  HARDWARE

  high
• com.xiaomi.micloud.sdk

  OTHER_APK

  critical
• *.xiaomiyoupin.com

  WILDCARD

  critical
• com.xiaomi.mipicks

  OTHER_APK

  critical
• MIUI OS for Xiaomi Phone

  ---

  MIUI is Xiaomi phone operation system (OS), custimized on stock android.
  the scope inculdes the pre-installed apps with Xiaomi certification signed.

  OTHER

  critical
• *.miwifi.com

  WILDCARD

  critical
• *.miui.com

  WILDCARD

  critical
• com.xiaomi.smarthome

  OTHER_APK

  critical

Target Scope Domains

• mi.com
• miui.com
• miwifi.com
• xiaomi.com
• xiaomiyoupin.com

• 2462 Subdomains
• 1163 Endpoints
• Download wordlist

---

Last Finished Scan:

---