generated: '2026-08-05'
method: searched
source: https://www.traveloka.com/en-id/vulnerability-disclosure-program
docs: https://www.traveloka.com/en-id/bugs
summary: >-
  Traveloka runs a published Vulnerability Disclosure Program covering any digital asset it owns,
  operates or maintains, including public-facing websites, and pays monetary rewards for valid findings
  through a Bugcrowd-managed program. There is no /.well-known/security.txt on any Traveloka host.
program:
  published: true
  name: Traveloka Vulnerability Disclosure Program
  policy_url: https://www.traveloka.com/en-id/vulnerability-disclosure-program
  bug_bounty_url: https://www.traveloka.com/en-id/bugs
  intake:
    method: web form
    form_location: https://www.traveloka.com/en-id/vulnerability-disclosure-program
    email: bug@traveloka.com
  scope: >-
    Any digital assets owned, operated, or maintained by Traveloka, including public facing websites.
    Testing is authorized only against targets listed as in-scope in the program's targets section.
  out_of_scope:
    - Any Traveloka domain or property not listed in the targets section.
    - DDoS / DoS attacks against Traveloka systems.
  researcher_expectations:
    - Avoid privacy violations.
    - Avoid degradation of user experience.
    - Avoid disruption to production systems.
    - Avoid destruction of data.
    - Include verifiable proof of concept (screenshots, video, or script).
  legal_posture: >-
    Traveloka states it will not take legal action against researchers who report a vulnerability while
    complying with the program rules. Note this is a no-legal-action commitment, not a formal safe-harbor
    clause with named statutes.
  response_commitment: >-
    Acknowledge receipt and investigate. No numeric response SLA is published.
bug_bounty:
  offered: true
  platform: Bugcrowd
  program_type: private
  invitation: >-
    Researchers request an invitation to the private Bugcrowd program by sending valid vulnerability
    details to bug@traveloka.com.
  reward_conditions:
    - Duplicate reports are not eligible.
    - Findings Traveloka cannot reproduce or verify are not eligible.
    - Reward eligibility begins once Traveloka decides to fix the reported bug.
  public_program_page: null
  note: >-
    No public Bugcrowd engagement page exists - https://bugcrowd.com/traveloka returned 404 on probe -
    which is consistent with the program being private / invite-only.
security_txt:
  present: false
  probed:
    - url: https://www.traveloka.com/.well-known/security.txt
      status: 404
    - url: https://developer.travelokapartnersnetwork.com/.well-known/security.txt
      status: 404
    - url: https://api.travelokapartnersnetwork.com/.well-known/security.txt
      status: 404
    - url: https://api.connect.traveloka.com/.well-known/security.txt
      status: 404
    - url: https://atlas.traveloka.com/.well-known/security.txt
      status: 404
  gap: >-
    An RFC 9116 /.well-known/security.txt pointing at the VDP page and bug@traveloka.com would make this
    program machine-discoverable. The program exists; only the discovery file is missing.
x-evidence:
  fetched: '2026-08-05'
  url: https://www.traveloka.com/en-id/vulnerability-disclosure-program
  http_status: 200
  content_type: text/html
cross_links:
  domain_security: security/traveloka-domain-security.yml
  well_known: well-known/traveloka-well-known.yml