Expedia Vulnerability Disclosure

generated: '2026-09-07'
method: searched
probe: true
source: https://www.expedia.com/.well-known/security.txt
program:
  type: bug-bounty
  platform: HackerOne
  url: https://hackerone.com/expediagroup_bbp
  name: Expedia Group Bug Bounty
  public: false
  access: >-
    Invite-only. Expedia Group runs the program privately on HackerOne and asks researchers who want an
    invitation to first submit one high-severity issue with a working proof of concept that is in scope.
  rewards: monetary
  evidence:
    url: https://hackerone.com/expediagroup_bbp
    http_status: 200
    fetched: '2026-09-07'
policy:
- https://www.expediagroup.com/about/privacy-data-handling-requirements/
contact:
- RespDisc@expedia.com
hiring:
- https://lifeatexpedia.com/
security_txt:
  url: https://www.expedia.com/.well-known/security.txt
  http_status: 200
  content_type: text/plain
  fields_present: [Contact, Policy, Hiring]
  rfc9116_conformance: non-conformant
  defects:
  - id: dead-policy-link
    severity: high
    detail: >-
      The Policy: URL in Expedia's own security.txt is dead. Probed 2026-09-07,
      https://www.expediagroup.com/about/privacy-data-handling-requirements/ returns HTTP 301 to
      https://www.expediagroup.com/en-us/our-story, which returns HTTP 404 ("There's been a slight
      change in itinerary"). A researcher who follows the disclosure policy link Expedia publishes
      reaches a Page Not Found. This is the provider's to fix.
    evidence:
    - url: https://www.expediagroup.com/about/privacy-data-handling-requirements/
      http_status: 301
      redirects_to: https://www.expediagroup.com/en-us/our-story
    - url: https://www.expediagroup.com/en-us/our-story
      http_status: 404
  - id: no-expires
    severity: medium
    detail: >-
      No Expires: field. RFC 9116 §2.5.5 makes Expires REQUIRED. Without it an automated consumer
      cannot tell whether the file is current, and the document never ages out.
  - id: no-canonical-no-encryption-no-preferred-languages
    severity: low
    detail: Optional but conventional fields Canonical, Encryption and Preferred-Languages are absent.
evidence:
- source: https://www.expedia.com/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
- source: https://hackerone.com/expediagroup_bbp
  kind: bug bounty program page (live probe)
  http_status: 200