August 26, 2019

Scope Release Event 2, Phase 2

Note: Verizon Media is now known as Yahoo.

New Release Event 2

Dedicated Hackers,

We are now a few days into Phase 2 of this scope release event. Please read the previous message for the event schedule.

Phase 1: Scope Release Announcement & Dupe Period (Ended)

We are still reviewing all Phase 1 reports that will receive a bounty and will note in the report if they will receive a split bounty. If you have a report from Phase 1 marked as Resolved or Triaged that does not receive a comment by the end of this week, please contact us immediately.

Phase 2: Dupe Period Closes

  • All reports are now treated as first-come-first-served, no more split bounties.
  • Keep hacking and submitting reports and claim the full bounty for your vulnerabilities.
  • Only unique reports during this phase will receive full credit when ranked at the end of this cycle.


  1. Register accounts (self-service) using your <username> addresses.
  2. Make sure to add the X-Bug-Bounty: hackerone-<username> header to your traffic.


This section is too long to be worth re-posting, so please refer to the Policy page or the previous update for a refresher on what is in and out of scope for The Huffington Post.

This phase will end on August 30, 2019 (5:00PM EST).

Happy Hacking,

The Paranoids