{ "agents": { "scope": { "model": "gpt-5.6-sol", "provider": "openai", "reasoning_effort": "high" }, "splitter": { "model": "gpt-5.6-sol", "provider": "openai", "reasoning_effort": "max" }, "threat_model": { "model": "gpt-5.6-sol", "provider": "openai", "reasoning_effort": "high" }, "validator": { "model": "gpt-5.6-sol", "provider": "openai", "reasoning_effort": "max" } }, "assessment_mode": "bounty", "bounty_header_enabled": true, "bug_bank_hidden": false, "codex_auth_mode": "chatgpt", "codex_early_hangup_enabled": true, "codex_experimental_context_enabled": false, "codex_fast_mode_enabled": true, "config_path": "/var/lib/toadex/fleet-worker/run-20261114-215136-worker-00002/config.toml", "default_assignee": "dwbzn", "engagement_name": "Baloise - Germany", "engagement_slug": "baloise-germany", "goal": "For 100 hours: Find critical severity issues. RCE would be ideal. Do not focus or bother testing anything that does not lead to a critical severity issue. You may need to chain bugs in some cases. Focus on live production application scope.", "hunting_threads": [], "kind": "scan", "local_scope": true, "model": "gpt-5.6-sol", "model_context_window": 572000, "model_provider": "openai", "oob_channels": [ { "endpoint": "https://3p8.9b.au/", "hosting_endpoint": "https://publish.9b.au/v1/sites", "hosting_token": "2iBVf0DoGAVHWQfubEOhGjHs4o-e-R-LJ_QHTeVUpK8", "kind": "http", "polling_endpoint": "https://poll.9b.au/v1/events", "polling_token": "ctD7Dh5DRE3c8lQFWfALY_7HMOmS4x_tbX02r6XitEQ" }, { "endpoint": "3p8@9b.au", "kind": "smtp", "polling_endpoint": "https://poll.9b.au/v1/events", "polling_token": "ctD7Dh5DRE3c8lQFWfALY_7HMOmS4x_tbX02r6XitEQ" }, { "endpoint": "3p8.9b.au", "kind": "dns", "polling_endpoint": "https://poll.9b.au/v1/events", "polling_token": "ctD7Dh5DRE3c8lQFWfALY_7HMOmS4x_tbX02r6XitEQ" } ], "prepare_only": false, "preseed_mode": "none", "program": "e97707dc-ae05-442b-95c2-330ca2d56060", "project_path": "/var/lib/toadex/fleet-worker/run-20261114-215136-worker-00002/slot-data/job-5/workspaces/bugbounty-ch/baloise-germany", "provider": "bugbounty-ch", "reasoning_effort": "max", "reasoning_summary": "detailed", "recon": false, "recon_agents": [ "recon" ], "refresh_scope": false, "refresh_threat_model": false, "rescope": false, "runtime_prompt_dir": "/var/lib/toadex/fleet-worker/run-20261114-215136-worker-00002/slot-data/job-5/workspaces/bugbounty-ch/baloise-germany/work/runtime-prompts", "runtime_release": "current", "save_logs": true, "scope_split": { "attempts": [ { "reply": "{\"segments\":[{\"swarm_index\":1,\"focus\":\"Mein Portal + Liferay portals + Airlock IAM\",\"unit_ids\":[\"u3\",\"u6\",\"u10\",\"u14\",\"u15\",\"u16\"]},{\"swarm_index\":2,\"focus\":\"Guidewire + SAS analytics + internal service gateways\",\"unit_ids\":[\"u7\",\"u8\",\"u9\",\"u21\",\"u22\",\"u23\",\"u24\",\"u25\",\"u26\"]},{\"swarm_index\":3,\"focus\":\"public web + campaigns + tracking\",\"unit_ids\":[\"u1\",\"u2\",\"u11\",\"u17\",\"u18\",\"u20\"]},{\"swarm_index\":4,\"focus\":\"inSign + BASE + Exchange and IIS\",\"unit_ids\":[\"u4\",\"u5\",\"u12\",\"u13\",\"u19\"]}]}" } ], "method": "llm", "objective": "For 100 hours: Find critical severity issues. RCE would be ideal. Do not focus or bother testing anything that does not lead to a critical severity issue. You may need to chain bugs in some cases. Focus on live production application scope.", "request": { "hunters": 4, "objective": "For 100 hours: Find critical severity issues. RCE would be ideal. Do not focus or bother testing anything that does not lead to a critical severity issue. You may need to chain bugs in some cases. Focus on live production application scope.", "segment_weight": { "max": 229.3, "min": 76.4 }, "total_weight": 611.5, "units": [ { "about": "CloudFront-origin-reachable alternate TLS listener for the Service Apache/Airlock Gateway virtual h\u2026", "examples": [ "service.baloise.de", "baloise.de" ], "findings": 2, "guarded": 29, "hosts": 16, "id": "u1", "kind": "app", "label": "baloise.de (root)", "live": 33, "paths": 2800, "requests": 7267, "scope": "DOMAIN \"int-www.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Apache HTTP Server", "Apache Tomcat" ], "title": "Status", "weight": 43.6 }, { "about": "CloudFront-origin-only alternate TLS listener for the canonical Vario virtual host on LiteSpeed Web\u2026", "examples": [ "vario.baloise.de" ], "hosts": 1, "id": "u2", "kind": "app", "label": "vario (baloise.de)", "live": 18, "paths": 58839, "requests": 61609, "scope": "DOMAIN \"vario.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "cPanel Webmail", "cPanel" ], "title": "WebAdmin Console Disabled", "weight": 38.2 }, { "about": "CloudFront-origin-only alternate TLS listener for the Mein Portal Apache/Airlock Gateway and Airloc\u2026", "examples": [ "mein-portal.baloise.de", "mein-portal-registrierung.baloise.de" ], "findings": 1, "hosts": 4, "id": "u3", "kind": "app", "label": "mein (baloise.de)", "live": 30, "paths": 3033, "requests": 6368, "scope": "DOMAIN \"acc-mein-portal.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Apache HTTP Server", "Airlock IAM" ], "title": "", "weight": 37.9 }, { "about": "CloudFront-origin-only alternate TLS listener for production inSign 3.81.11 build 1 on Java 17 and\u2026", "examples": [ "insign.baloise.de", "gw-insign.baloise.de" ], "findings": 6, "hosts": 8, "id": "u4", "kind": "app", "label": "insign (baloise.de)", "live": 17, "paths": 2252, "requests": 11754, "scope": "DOMAIN \"int-gw-insign.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Apache Tika", "Spring Authorization Server" ], "title": "Open Source Bibliotheken", "weight": 36.1 }, { "about": "CloudFront-origin-only alternate TLS listener for the production BASE 1.19.0 build 76 application:\u2026", "examples": [ "base.baloise.de", "acc-base.baloise.de" ], "findings": 2, "hosts": 3, "id": "u5", "kind": "app", "label": "base (baloise.de)", "live": 15, "paths": 1179, "requests": 7744, "scope": "DOMAIN \"int-base.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Java", "Spring Boot" ], "title": "Please sign in", "weight": 31.5 }, { "about": "CloudFront-origin-only alternate TLS listener for the Infoportal Apache/Airlock Gateway and Airlock\u2026", "examples": [ "infoportal.baloise.de", "acc-infoportal.baloise.de" ], "hosts": 3, "id": "u6", "kind": "app", "label": "infoportal (baloise.de)", "live": 15, "paths": 1234, "requests": 3326, "scope": "DOMAIN \"infoportal.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "Liferay Portal" ], "title": "", "weight": 30.2 }, { "about": "CloudFront-origin-only alternate TLS listener for the canonical OCS Apache/Airlock Gateway boundary.", "examples": [ "ocs-vertriebsservice.baloise.de", "acc-ocs-vertriebsservice.baloise.de" ], "hosts": 4, "id": "u7", "kind": "app", "label": "ocs-vertriebsservice (baloise.de)", "live": 18, "paths": 372, "requests": 709, "scope": "DOMAIN \"int-ocs-vertriebsservice.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Apache HTTP Server", "Airlock Gateway" ], "weight": 28.4 }, { "about": "CloudFront-origin-accessible alternate TLS listener for the VA Airlock IAM application and its Jers\u2026", "examples": [ "va.baloise.de", "test-va.baloise.de" ], "hosts": 2, "id": "u8", "kind": "app", "label": "va (baloise.de)", "live": 12, "paths": 688, "requests": 1971, "scope": "DOMAIN \"va.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "SAS Visual Analytics" ], "title": "", "weight": 27.8 }, { "about": "CloudFront-origin-only alternate TLS listener for the canonical GWDE Guidewire application.", "examples": [ "gwde.baloise.de", "acc-gwde.baloise.de" ], "hosts": 4, "id": "u9", "kind": "app", "label": "gwde (baloise.de)", "live": 12, "paths": 324, "requests": 911, "scope": "DOMAIN \"int-gwde.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Guidewire BillingCenter", "Airlock Gateway" ], "weight": 26.2 }, { "about": "CloudFront-origin-only alternate TLS listener for the Maklerportal Apache/Airlock Gateway and Airlo\u2026", "examples": [ "maklerportal.baloise.de", "acc-maklerportal.baloise.de" ], "hosts": 3, "id": "u10", "kind": "app", "label": "maklerportal (baloise.de)", "live": 11, "paths": 465, "requests": 1897, "scope": "DOMAIN \"maklerportal.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "Liferay Portal" ], "title": "", "weight": 26.1 }, { "about": "CloudFront-origin-only alternate TLS listener for the active BSI CX campaign application.", "examples": [ "cx.baloise.de", "willkommen-bei.baloise.de" ], "hosts": 4, "id": "u11", "kind": "app", "label": "cx (baloise.de)", "live": 15, "paths": 231, "requests": 667, "scope": "DOMAIN \"cx.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "nginx", "BSI CX" ], "title": "Basler Versicherungen Landingpage", "weight": 25.5 }, { "about": "CloudFront-origin-only alternate TLS listener for the Microsoft Exchange Server Subscription Editio\u2026", "examples": [ "autodiscover.baloise.de" ], "findings": 1, "hosts": 1, "id": "u12", "kind": "app", "label": "autodiscover (baloise.de)", "live": 7, "paths": 579, "requests": 1813, "scope": "DOMAIN \"autodiscover.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition" ], "title": "Outlook", "weight": 24.8 }, { "about": "Alternate HTTPS listener for the IIS 10 Baloise Mietkaution application.", "examples": [ "mietkaution.baloise.de" ], "hosts": 1, "id": "u13", "kind": "app", "label": "mietkaution (baloise.de)", "live": 8, "paths": 669, "requests": 1412, "scope": "DOMAIN \"mietkaution.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Glimpse MVC4", "Microsoft IIS" ], "title": "Kautionsverwaltung \u00e0 la Baloise", "weight": 24.1 }, { "about": "CloudFront-origin-only alternate TLS listener for the SI Portal Apache/Airlock Gateway and Airlock\u2026", "examples": [ "si-portal.baloise.de", "test-si-portal.baloise.de" ], "hosts": 3, "id": "u14", "kind": "app", "label": "si (baloise.de)", "live": 9, "paths": 197, "requests": 478, "scope": "DOMAIN \"acc-si-portal.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "Liferay Portal" ], "title": "", "weight": 23.0 }, { "about": "CloudFront-origin-only alternate TLS listener for the Vertriebsservice Apache/Airlock Gateway and A\u2026", "examples": [ "vertriebsservice.baloise.de", "acc-vertriebsservice.baloise.de" ], "hosts": 3, "id": "u15", "kind": "app", "label": "vertriebsservice (baloise.de)", "live": 9, "paths": 201, "requests": 445, "scope": "DOMAIN \"vertriebsservice.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "Liferay Portal" ], "title": "", "weight": 23.0 }, { "about": "CloudFront-origin-only alternate TLS listener for the residual Zeus Apache/Airlock Gateway and Airl\u2026", "examples": [ "zeus-portal.baloise.de", "acc-zeus-portal.baloise.de" ], "hosts": 3, "id": "u16", "kind": "app", "label": "zeus (baloise.de)", "live": 9, "paths": 192, "requests": 411, "scope": "DOMAIN \"acc-zeus-portal.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Airlock IAM", "Liferay Portal" ], "title": "", "weight": 22.8 }, { "about": "CloudFront-origin-only alternate TLS listener for the Flixcheck 4.239.0 application on nginx 1.25.4.", "examples": [ "ask.baloise.de" ], "hosts": 1, "id": "u17", "kind": "app", "label": "ask (baloise.de)", "live": 8, "paths": 369, "requests": 653, "scope": "DOMAIN \"ask.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "nginx", "Flixcheck" ], "title": "Flixcheck", "weight": 22.7 }, { "about": "CloudFront-origin-only alternate TLS listener for the Factsheetslive Fondschecker catalogue and ano\u2026", "examples": [ "fondschecker.baloise.de" ], "hosts": 1, "id": "u18", "kind": "app", "label": "fondschecker (baloise.de)", "live": 7, "paths": 323, "requests": 752, "scope": "DOMAIN \"fondschecker.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Symfony ErrorHandler", "PHP" ], "title": "Baloise Lebensversicherung AG factsheets data", "weight": 22.1 }, { "about": "CloudFront-origin-only alternate TLS listener for the QS Microsoft Exchange Server Subscription Edi\u2026", "examples": [ "autodiscover.qsbaloise.de" ], "hosts": 1, "id": "u19", "kind": "app", "label": "autodiscover (qsbaloise.de)", "live": 7, "paths": 99, "requests": 446, "scope": "DOMAIN \"autodiscover.qsbaloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition" ], "title": "Outlook", "weight": 20.2 }, { "about": "CloudFront-origin-only alternate TLS listener for the Google Tag Manager Server-Side ingestion appl\u2026", "examples": [ "tracking.baloise.de" ], "hosts": 1, "id": "u20", "kind": "app", "label": "tracking (baloise.de)", "live": 7, "paths": 76, "requests": 368, "scope": "DOMAIN \"tracking.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Google Tag Manager Server-Side" ], "weight": 19.5 }, { "about": "Unavailable alternate TLS listener for the historical TAA/BiPRO hostname.", "examples": [ "taa.baloise.de", "int-taa.baloise.de" ], "hosts": 4, "id": "u21", "kind": "app", "label": "taa (baloise.de)", "live": 1, "paths": 171, "requests": 382, "scope": "DOMAIN \"int-taa.baloise.de\" (max bounty 3000 max severity critical)", "tech": [ "Apache HTTP Server", "Airlock Gateway" ], "weight": 17.4 }, { "about": "Unresolved scoped HTTP origin.", "examples": [ "acc-mtls-api.baloise.de" ], "hosts": 1, "id": "u22", "kind": "app", "label": "mtls (baloise.de)", "paths": 16, "requests": 182, "scope": "DOMAIN \"acc-mtls-api.baloise.de\" (max bounty 3000 max severity critical)", "weight": 9.8 }, { "about": "Unresolved scoped origin.", "examples": [ "sas.baloise.de", "acc-sas.baloise.de" ], "hosts": 4, "id": "u23", "kind": "app", "label": "sas (baloise.de)", "paths": 13, "requests": 138, "scope": "DOMAIN \"acc-sas.baloise.de\" (max bounty 3000 max severity critical)", "weight": 9.0 }, { "about": "Unconfigured production C24 hostname.", "examples": [ "c24-www.baloise.de", "c24-acc-www.baloise.de" ], "hosts": 2, "id": "u24", "kind": "app", "label": "c (baloise.de)", "paths": 10, "requests": 135, "scope": "DOMAIN \"c24-acc-www.baloise.de\" (max bounty 3000 max severity critical)", "weight": 8.5 }, { "about": "Currently unreachable plain-HTTP WiFi origin.", "examples": [ "wifi.baloise.de" ], "hosts": 1, "id": "u25", "kind": "app", "label": "wifi (baloise.de)", "paths": 2, "requests": 166, "scope": "DOMAIN \"wifi.baloise.de\" (max bounty 3000 max severity critical)", "weight": 6.6 }, { "about": "Unreachable HTTPS Telog origin as of 2026-11-13.", "examples": [ "telog.baloise.de" ], "hosts": 1, "id": "u26", "kind": "app", "label": "telog (baloise.de)", "paths": 2, "requests": 145, "scope": "DOMAIN \"telog.baloise.de\" (max bounty 3000 max severity critical)", "weight": 6.5 } ] }, "segments": [ { "focus": "Mein Portal + Liferay portals + Airlock IAM", "swarm_index": 1, "unit_ids": [ "u3", "u6", "u10", "u14", "u15", "u16" ], "weight": 163.0 }, { "focus": "Guidewire + SAS analytics + internal service gateways", "swarm_index": 2, "unit_ids": [ "u7", "u8", "u9", "u21", "u22", "u23", "u24", "u25", "u26" ], "weight": 140.2 }, { "focus": "public web + campaigns + tracking", "swarm_index": 3, "unit_ids": [ "u1", "u2", "u11", "u17", "u18", "u20" ], "weight": 171.6 }, { "focus": "inSign + BASE + Exchange and IIS", "swarm_index": 4, "unit_ids": [ "u4", "u5", "u12", "u13", "u19" ], "weight": 136.7 } ], "swarm_size": 4, "units": [ { "hosts": [ "service.baloise.de", "baloise.de", "acc-www.baloise.de", "www.baloise.de", "int-www.baloise.de", "api.baloise.de", "api2.baloise.de", "acc-api.baloise.de", "int-api.baloise.de", "int-api2.baloise.de", "acc-api2.baloise.de", "acc-service.baloise.de", "test-api.baloise.de", "test-service.baloise.de", "int-service.baloise.de", "test-api2.baloise.de" ], "kind": "app", "label": "baloise.de (root)", "profile": { "findings": 2, "guarded": 29, "hostnames": 16, "live": 33, "paths": 2800, "requests": 7267, "services": 127, "summary": "CloudFront-origin-reachable alternate TLS listener for the Service Apache/Airlock Gateway virtual host.", "technologies": [ "Apache HTTP Server", "Apache Tomcat", "Layer7 API Gateway", "ASP.NET Web Forms", "WebBA Cleanup Service" ], "titles": [ "Status", "Baloise, Tarifrechner - Anmeldung", "Baloise, Tarifrechner" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-06de2640bae6320391f68307" }, { "asset_type": "DOMAIN", "identifier": "acc-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1e61763c67dc251bfc6e88f9" }, { "asset_type": "DOMAIN", "identifier": "int-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2bda423deb9152e4866c34a9" }, { "asset_type": "DOMAIN", "identifier": "acc-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-499edf963527eb9a6f9d1247" }, { "asset_type": "DOMAIN", "identifier": "www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-55526330fb7c08507f896b29" }, { "asset_type": "DOMAIN", "identifier": "service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5c7884205a2948813c30511c" }, { "asset_type": "DOMAIN", "identifier": "api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5e5548a6d9b75e43f9b2f6dc" }, { "asset_type": "DOMAIN", "identifier": "api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-6a9764ab121ab1445f102971" }, { "asset_type": "DOMAIN", "identifier": "baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-768ef5b016265a01ce68703b" }, { "asset_type": "DOMAIN", "identifier": "test-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-89e3cd7a0ecf2deb84e30d52" }, { "asset_type": "DOMAIN", "identifier": "acc-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9d8412ab288cec80481b3868" }, { "asset_type": "DOMAIN", "identifier": "test-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a959d4fca725d51d606d6a5a" }, { "asset_type": "DOMAIN", "identifier": "int-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a99c983b91450e58073f8547" }, { "asset_type": "DOMAIN", "identifier": "test-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c829e58c879f0e3ba872999c" }, { "asset_type": "DOMAIN", "identifier": "acc-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-cde0fec129d54477e950566d" }, { "asset_type": "DOMAIN", "identifier": "int-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e57cd9a758ea2a80c65d8291" } ], "unit_id": "u1", "weight": 43.6 }, { "hosts": [ "vario.baloise.de" ], "kind": "app", "label": "vario (baloise.de)", "profile": { "hostnames": 1, "live": 18, "paths": 58839, "requests": 61609, "services": 25, "summary": "CloudFront-origin-only alternate TLS listener for the canonical Vario virtual host on LiteSpeed Web Server 6.3 Rev.", "technologies": [ "cPanel Webmail", "cPanel", "WHM", "cpsrvd", "PHP" ], "titles": [ "WebAdmin Console Disabled", "- LiteSpeed WebAdmin Console", "cPanel Login" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "vario.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9993e1a759d58b711217ef14" } ], "unit_id": "u2", "weight": 38.2 }, { "hosts": [ "mein-portal.baloise.de", "mein-portal-registrierung.baloise.de", "acc-mein-portal.baloise.de", "test-mein-portal.baloise.de" ], "kind": "app", "label": "mein (baloise.de)", "profile": { "findings": 1, "hostnames": 4, "live": 30, "paths": 3033, "requests": 6368, "services": 70, "summary": "CloudFront-origin-only alternate TLS listener for the Mein Portal Apache/Airlock Gateway and Airlock IAM application, using the same Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Apache HTTP Server", "Airlock IAM", "Airlock Gateway", "Jersey" ], "titles": [ "", "radio-checkbox_v2_border", "7FB2CE1D-7E9C-461A-9281-565396635665" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-17612bde4a381fd90db3a8e4" }, { "asset_type": "DOMAIN", "identifier": "mein-portal-registrierung.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7378551bd3030cef35c48a5d" }, { "asset_type": "DOMAIN", "identifier": "test-mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-80fb4037f8ed0cc9ca65df45" }, { "asset_type": "DOMAIN", "identifier": "mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-980fd681bf83d9459cba6611" } ], "unit_id": "u3", "weight": 37.9 }, { "hosts": [ "insign.baloise.de", "gw-insign.baloise.de", "acc-insign.baloise.de", "acc-gw-insign.baloise.de", "test-insign.baloise.de", "int-insign.baloise.de", "test-gw-insign.baloise.de", "int-gw-insign.baloise.de" ], "kind": "app", "label": "insign (baloise.de)", "profile": { "findings": 6, "hostnames": 8, "live": 17, "paths": 2252, "requests": 11754, "services": 28, "summary": "CloudFront-origin-only alternate TLS listener for production inSign 3.81.11 build 1 on Java 17 and Apache Tomcat 10.1.55.", "technologies": [ "Apache Tika", "Spring Authorization Server", "Spring Framework", "Bouncy Castle", "Spring Security" ], "titles": [ "Open Source Bibliotheken", "inSign Login | Elektronische Unterschriftenl\u00f6sung made in Germany", "inSign elektronischer Unterschriftsprozess" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-06d3087e9d6d8521e8fc25eb" }, { "asset_type": "DOMAIN", "identifier": "gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-098241ee0b9cc05cf8e60144" }, { "asset_type": "DOMAIN", "identifier": "acc-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0993e7fc2aa19090cb4ba256" }, { "asset_type": "DOMAIN", "identifier": "test-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-18a2eb6f9f0bf24b333401c5" }, { "asset_type": "DOMAIN", "identifier": "insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-27a6e9d8fe3bc101faeb5198" }, { "asset_type": "DOMAIN", "identifier": "int-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-46e3b884857ade8d6f15a98f" }, { "asset_type": "DOMAIN", "identifier": "acc-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b6eb495bf6e7887c0725b59b" }, { "asset_type": "DOMAIN", "identifier": "test-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c85143106d4b86c148d1c1f4" } ], "unit_id": "u4", "weight": 36.1 }, { "hosts": [ "base.baloise.de", "acc-base.baloise.de", "int-base.baloise.de" ], "kind": "app", "label": "base (baloise.de)", "profile": { "findings": 2, "hostnames": 3, "live": 15, "paths": 1179, "requests": 7744, "services": 16, "summary": "CloudFront-origin-only alternate TLS listener for the production BASE 1.19.0 build 76 application: Java 21, Spring Boot, Spring Framework 6.2.0 or newer, Spring Security 6.4.0 or newer, and Angular behind Apache and Airlock Gateway.", "technologies": [ "Java", "Spring Boot", "Spring Framework", "Airlock Gateway", "Spring Security" ], "titles": [ "Please sign in", "Helvetia BASE Tarifrechner" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0f418a9bb45e48394de55442" }, { "asset_type": "DOMAIN", "identifier": "base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1b2dbde30916b89dc526579b" }, { "asset_type": "DOMAIN", "identifier": "acc-base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9236bc7479c2f8564eb091b4" } ], "unit_id": "u5", "weight": 31.5 }, { "hosts": [ "infoportal.baloise.de", "acc-infoportal.baloise.de", "test-infoportal.baloise.de" ], "kind": "app", "label": "infoportal (baloise.de)", "profile": { "hostnames": 3, "live": 15, "paths": 1234, "requests": 3326, "services": 49, "summary": "CloudFront-origin-only alternate TLS listener for the Infoportal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a2f51937871ee3fa41b3c159" }, { "asset_type": "DOMAIN", "identifier": "acc-infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-de15e076cfa962fabcb494db" }, { "asset_type": "DOMAIN", "identifier": "test-infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f6bc9d2168e464075ed3a51b" } ], "unit_id": "u6", "weight": 30.2 }, { "hosts": [ "ocs-vertriebsservice.baloise.de", "acc-ocs-vertriebsservice.baloise.de", "int-ocs-vertriebsservice.baloise.de", "test-ocs-vertriebsservice.baloise.de" ], "kind": "app", "label": "ocs-vertriebsservice (baloise.de)", "profile": { "hostnames": 4, "live": 18, "paths": 372, "requests": 709, "services": 47, "summary": "CloudFront-origin-only alternate TLS listener for the canonical OCS Apache/Airlock Gateway boundary.", "technologies": [ "Apache HTTP Server", "Airlock Gateway" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-08c25055e66bfedbcc7b9a4f" }, { "asset_type": "DOMAIN", "identifier": "acc-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-dc562506fbe8a41c92a62e5c" }, { "asset_type": "DOMAIN", "identifier": "ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e9f8b9cbd1d2e8de1f071185" }, { "asset_type": "DOMAIN", "identifier": "test-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f8d18b8386000c6f7d5edda3" } ], "unit_id": "u7", "weight": 28.4 }, { "hosts": [ "va.baloise.de", "test-va.baloise.de" ], "kind": "app", "label": "va (baloise.de)", "profile": { "hostnames": 2, "live": 12, "paths": 688, "requests": 1971, "services": 48, "summary": "CloudFront-origin-accessible alternate TLS listener for the VA Airlock IAM application and its Jersey 3.1.10 REST layer.", "technologies": [ "Airlock IAM", "SAS Visual Analytics", "Apache HTTP Server", "Airlock Gateway", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "va.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-808c39ceaf83203b77ae4027" }, { "asset_type": "DOMAIN", "identifier": "test-va.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c2fc28a0c53638a9d953b739" } ], "unit_id": "u8", "weight": 27.8 }, { "hosts": [ "gwde.baloise.de", "acc-gwde.baloise.de", "int-gwde.baloise.de", "test-gwde.baloise.de" ], "kind": "app", "label": "gwde (baloise.de)", "profile": { "hostnames": 4, "live": 12, "paths": 324, "requests": 911, "services": 48, "summary": "CloudFront-origin-only alternate TLS listener for the canonical GWDE Guidewire application.", "technologies": [ "Guidewire BillingCenter", "Airlock Gateway", "Apache HTTP Server", "Guidewire PolicyCenter", "Guidewire ClaimCenter" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-11437995cb747edd9d2360bc" }, { "asset_type": "DOMAIN", "identifier": "gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-41ca77626b0267051b1a4a8e" }, { "asset_type": "DOMAIN", "identifier": "test-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e2190f0aa1a4ef01db239e9d" }, { "asset_type": "DOMAIN", "identifier": "acc-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f2d50b0607208d1a9cf5451f" } ], "unit_id": "u9", "weight": 26.2 }, { "hosts": [ "maklerportal.baloise.de", "acc-maklerportal.baloise.de", "test-maklerportal.baloise.de" ], "kind": "app", "label": "maklerportal (baloise.de)", "profile": { "hostnames": 3, "live": 11, "paths": 465, "requests": 1897, "services": 23, "summary": "CloudFront-origin-only alternate TLS listener for the Maklerportal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2dfba5556ea43ea48d6b3393" }, { "asset_type": "DOMAIN", "identifier": "acc-maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-711f6b95f848e45efcb6bf79" }, { "asset_type": "DOMAIN", "identifier": "test-maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7f5f802724d2897fed89cbff" } ], "unit_id": "u10", "weight": 26.1 }, { "hosts": [ "cx.baloise.de", "willkommen-bei.baloise.de", "int-cx.baloise.de", "test-cx.baloise.de" ], "kind": "app", "label": "cx (baloise.de)", "profile": { "hostnames": 4, "live": 15, "paths": 231, "requests": 667, "services": 17, "summary": "CloudFront-origin-only alternate TLS listener for the active BSI CX campaign application.", "technologies": [ "nginx", "BSI CX" ], "titles": [ "Basler Versicherungen Landingpage" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0285b3011195b220cd078e48" }, { "asset_type": "DOMAIN", "identifier": "willkommen-bei.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-633459ae921aa48b6a028c3c" }, { "asset_type": "DOMAIN", "identifier": "test-cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-718bcba98f50b8cb87d9109d" }, { "asset_type": "DOMAIN", "identifier": "int-cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ae2cc3d69c34f85fcacad596" } ], "unit_id": "u11", "weight": 25.5 }, { "hosts": [ "autodiscover.baloise.de" ], "kind": "app", "label": "autodiscover (baloise.de)", "profile": { "findings": 1, "hostnames": 1, "live": 7, "paths": 579, "requests": 1813, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the Microsoft Exchange Server Subscription Edition 15.2.2562.56 frontend on IIS 10 and ASP.NET Framework 4.0.30319.", "technologies": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition", "Microsoft HTTP Server API", "ASP.NET Framework" ], "titles": [ "Outlook", "Outlook - Sign out" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "autodiscover.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-736f0d60b80c1bb2010e4fe2" } ], "unit_id": "u12", "weight": 24.8 }, { "hosts": [ "mietkaution.baloise.de" ], "kind": "app", "label": "mietkaution (baloise.de)", "profile": { "hostnames": 1, "live": 8, "paths": 669, "requests": 1412, "services": 8, "summary": "Alternate HTTPS listener for the IIS 10 Baloise Mietkaution application.", "technologies": [ "Glimpse MVC4", "Microsoft IIS", "ASP.NET Framework", "Glimpse ASP.NET", "ASP.NET Core" ], "titles": [ "Kautionsverwaltung \u00e0 la Baloise", "Baloise Mietkaution Testseite", "title" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "mietkaution.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-93ccc60bab04a6f5bcadf606" } ], "unit_id": "u13", "weight": 24.1 }, { "hosts": [ "si-portal.baloise.de", "test-si-portal.baloise.de", "acc-si-portal.baloise.de" ], "kind": "app", "label": "si (baloise.de)", "profile": { "hostnames": 3, "live": 9, "paths": 197, "requests": 478, "services": 22, "summary": "CloudFront-origin-only alternate TLS listener for the SI Portal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1a1ab2e6bd95b493f6d70eb4" }, { "asset_type": "DOMAIN", "identifier": "si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-37bbac024a06b669848066e6" }, { "asset_type": "DOMAIN", "identifier": "test-si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-4f7fc5233e92094ca3cb29f4" } ], "unit_id": "u14", "weight": 23.0 }, { "hosts": [ "vertriebsservice.baloise.de", "acc-vertriebsservice.baloise.de", "test-vertriebsservice.baloise.de" ], "kind": "app", "label": "vertriebsservice (baloise.de)", "profile": { "hostnames": 3, "live": 9, "paths": 201, "requests": 445, "services": 22, "summary": "CloudFront-origin-only alternate TLS listener for the Vertriebsservice Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-22b8bd914a7d8563f434555c" }, { "asset_type": "DOMAIN", "identifier": "acc-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5ed6ace82f50a1ac65739382" }, { "asset_type": "DOMAIN", "identifier": "test-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-731747452022fc1a27c9c14b" } ], "unit_id": "u15", "weight": 23.0 }, { "hosts": [ "zeus-portal.baloise.de", "acc-zeus-portal.baloise.de", "test-zeus-portal.baloise.de" ], "kind": "app", "label": "zeus (baloise.de)", "profile": { "hostnames": 3, "live": 9, "paths": 192, "requests": 411, "services": 21, "summary": "CloudFront-origin-only alternate TLS listener for the residual Zeus Apache/Airlock Gateway and Airlock IAM mapping, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2ab31fc5aa864f0db1e6f4c2" }, { "asset_type": "DOMAIN", "identifier": "test-zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-3b4554c9fdd3c3d82a068d66" }, { "asset_type": "DOMAIN", "identifier": "zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-710ab4e7af84871c7047290f" } ], "unit_id": "u16", "weight": 22.8 }, { "hosts": [ "ask.baloise.de" ], "kind": "app", "label": "ask (baloise.de)", "profile": { "hostnames": 1, "live": 8, "paths": 369, "requests": 653, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the Flixcheck 4.239.0 application on nginx 1.25.4.", "technologies": [ "nginx", "Flixcheck" ], "titles": [ "Flixcheck" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "ask.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-dcbbbb55eb80d37c82890a60" } ], "unit_id": "u17", "weight": 22.7 }, { "hosts": [ "fondschecker.baloise.de" ], "kind": "app", "label": "fondschecker (baloise.de)", "profile": { "hostnames": 1, "live": 7, "paths": 323, "requests": 752, "services": 7, "summary": "CloudFront-origin-only alternate TLS listener for the Factsheetslive Fondschecker catalogue and anonymous portfolio-comparison application.", "technologies": [ "Symfony ErrorHandler", "PHP", "Factsheetslive", "Symfony", "Symfony HttpFoundation" ], "titles": [ "Baloise Lebensversicherung AG factsheets data" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "fondschecker.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b547d3f742070befddd0e09d" } ], "unit_id": "u18", "weight": 22.1 }, { "hosts": [ "autodiscover.qsbaloise.de" ], "kind": "app", "label": "autodiscover (qsbaloise.de)", "profile": { "hostnames": 1, "live": 7, "paths": 99, "requests": 446, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the QS Microsoft Exchange Server Subscription Edition 15.2.2562.56 frontend on IIS 10 and ASP.NET Framework 4.0.30319.", "technologies": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition", "Microsoft HTTP Server API", "ASP.NET Framework" ], "titles": [ "Outlook", "Outlook - Sign out" ] }, "registrable": "qsbaloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "autodiscover.qsbaloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a6686c171daf65cc8172b699" } ], "unit_id": "u19", "weight": 20.2 }, { "hosts": [ "tracking.baloise.de" ], "kind": "app", "label": "tracking (baloise.de)", "profile": { "hostnames": 1, "live": 7, "paths": 76, "requests": 368, "services": 7, "summary": "CloudFront-origin-only alternate TLS listener for the Google Tag Manager Server-Side ingestion application.", "technologies": [ "Google Tag Manager Server-Side" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "tracking.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-84f9f21e682b8b06ebbd509a" } ], "unit_id": "u20", "weight": 19.5 }, { "hosts": [ "taa.baloise.de", "int-taa.baloise.de", "acc-taa.baloise.de", "test-taa.baloise.de" ], "kind": "app", "label": "taa (baloise.de)", "profile": { "hostnames": 4, "live": 1, "paths": 171, "requests": 382, "services": 46, "summary": "Unavailable alternate TLS listener for the historical TAA/BiPRO hostname.", "technologies": [ "Apache HTTP Server", "Airlock Gateway" ] }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "int-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-58bc3be30686a72a44c059c7" }, { "asset_type": "DOMAIN", "identifier": "taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b0ca48a448a4d1fe29d66d60" }, { "asset_type": "DOMAIN", "identifier": "acc-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e4705c77e01ca5ef450f431c" }, { "asset_type": "DOMAIN", "identifier": "test-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f5cbb671d4de7cdcca21597f" } ], "unit_id": "u21", "weight": 17.4 }, { "hosts": [ "acc-mtls-api.baloise.de" ], "kind": "app", "label": "mtls (baloise.de)", "profile": { "hostnames": 1, "paths": 16, "requests": 182, "services": 16, "summary": "Unresolved scoped HTTP origin." }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-mtls-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f2e7d49de241b0450eaac47f" } ], "unit_id": "u22", "weight": 9.8 }, { "hosts": [ "sas.baloise.de", "acc-sas.baloise.de", "int-sas.baloise.de", "test-sas.baloise.de" ], "kind": "app", "label": "sas (baloise.de)", "profile": { "hostnames": 4, "paths": 13, "requests": 138, "services": 7, "summary": "Unresolved scoped origin." }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7dd83dee63aff503de2168e9" }, { "asset_type": "DOMAIN", "identifier": "sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ae4c75ecd140e78b525a55ab" }, { "asset_type": "DOMAIN", "identifier": "int-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-d48bcc488bc72f7975e8b67b" }, { "asset_type": "DOMAIN", "identifier": "test-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ed46b5bbe42ca7b5734a24ad" } ], "unit_id": "u23", "weight": 9.0 }, { "hosts": [ "c24-www.baloise.de", "c24-acc-www.baloise.de" ], "kind": "app", "label": "c (baloise.de)", "profile": { "hostnames": 2, "paths": 10, "requests": 135, "services": 4, "summary": "Unconfigured production C24 hostname." }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "c24-acc-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-4ca00e13f7b0279522e25ab1" }, { "asset_type": "DOMAIN", "identifier": "c24-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-63e00ed9fb9bdfbfafe50809" } ], "unit_id": "u24", "weight": 8.5 }, { "hosts": [ "wifi.baloise.de" ], "kind": "app", "label": "wifi (baloise.de)", "profile": { "hostnames": 1, "paths": 2, "requests": 166, "services": 2, "summary": "Currently unreachable plain-HTTP WiFi origin." }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "wifi.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1b8b0e49b16fdbadbe81470f" } ], "unit_id": "u25", "weight": 6.6 }, { "hosts": [ "telog.baloise.de" ], "kind": "app", "label": "telog (baloise.de)", "profile": { "hostnames": 1, "paths": 2, "requests": 145, "services": 2, "summary": "Unreachable HTTPS Telog origin as of 2026-11-13." }, "registrable": "baloise.de", "scope": [ { "asset_type": "DOMAIN", "identifier": "telog.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a136ab4ba7b3205753edd731" } ], "unit_id": "u26", "weight": 6.5 } ] }, "skip_scope_split": false, "source_assisted": false, "subagents_enabled": false, "swarm_indexes": [ 1, 2 ], "swarm_size": 4, "traffic_log": true, "use_saved_scope_material": false, "validate_only": false, "validator_concurrency": 6, "x_bug_bounty_username": "dwbzn" }