I do bug bounty hunting and I want to share how a simple responsible disclosure turned into a mess. Two different channels failed me here, and I think both are worth talking about.

In June I found a vulnerability on Agoda's main domain. Agoda has a public HackerOne program, but only one specific path is listed as in scope, and what I found was on a different part of the same domain. I wasn't sure if I was allowed to submit it there.

I didn't want to break any rules, so I opened a ticket with HackerOne Support and asked two simple questions. Can I submit a bug on the same domain if the path isn't listed in scope? And if not, should I report it directly to Agoda's security contact instead?

The reply didn't really answer either one. It told me to avoid reaching out to the program directly and to not work on out of scope assets, because reports marked as spam or not applicable can hurt my signal and reputation. That was it. No "yes, submit it", no "no, email them", nothing about what to do with a real bug that sits on the same domain but outside the listed path. The ticket was then closed.

So the platform's guidance boiled down to "don't touch it" with no word on where it should go.

The only other place to look was Agoda's own security.txt. When I checked in June, the Contact line was an email address, [[email protected]](mailto:[email protected]), with no mention of HackerOne. I didn't take a screenshot at the time, which was my mistake, so the best I can offer is this archived copy from February 2026 showing the same setup: https://web.archive.org/web/20260206144235/agoda.com/security.txt

On June 18 I sent a full, detailed report to that address. Clear steps, clear impact, everything a security team would need.

Nothing came back. No auto reply, no acknowledgement, nothing.

On June 21 I tagged Agoda on X and asked them to check their inbox. Their public reply was a generic line about following the account so they could DM me my "booking details", which had nothing to do with a security report. I DMed them anyway, and the rep told me to be patient while the relevant team reviews it and that response times vary. Fair enough, so I waited.

I waited 28 days. Still no acknowledgement from the security email, and the issue was still live. So on July 16 I submitted it through HackerOne, since it was the only way I could think of to get it in front of someone who would actually read it.

It was closed as a duplicate within a few hours. The original report was filed on June 29, which is 11 days after I emailed their official security contact. HackerOne's triage also told me the program has already acknowledged the issue and is working on it through that original report.

Here's the part that bothers me most. If you open Agoda's security.txt today, the Contact line no longer lists that email. It now points to their HackerOne report form, and there's a Policy line pointing to the program page. I don't know exactly when it changed or why. My guess, and it is only a guess, is that it was updated some time after the other researcher's report came in, but I can't prove that. What I do know is that in June the published instruction was to email an address that, as far as I can tell, nobody was answering, and I did exactly what the file told me to do.

So either my email was never read, or it was read and nothing happened with it. Either way, a valid issue was sitting on a major travel booking site, and the only reason anyone is working on it is that someone else happened to use a different route.

I'm not complaining about the duplicate. Dupes happen and I get it. My problem is the system around it. HackerOne gave me no usable guidance on same domain assets outside the listed scope, and Agoda's published security inbox went nowhere. I tried to follow the rules at every step and ended up with nothing.

I'm keeping all technical details out of this post on purpose, because I don't want to put users at risk. I have the original email, the HackerOne support ticket, the X conversation and the duplicate notice saved with timestamps if anyone needs proof.