Subject: Confirmation of authorized security research — Louis Vuitton public bug bounty (YesWeHack)

I'm a security researcher conducting an authorized vulnerability assessment against Louis Vuitton's official, publicly listed bug bounty program on the YesWeHack platform. All activity is covered by that program's published scope and safe-harbor / coordinated-disclosure terms. This is defensive security work: the goal is to identify and report weaknesses to the vendor so they can be fixed, and nothing is being exploited for gain or against third parties.

Why this is legitimate, not abuse:

• Published program, in-scope asset. The Louis Vuitton Android app (com.vuitton.android) and *.louisvuitton.com are named in-scope targets of the program. The APK I'm analyzing was obtained from a public app-distribution mirror — it's software LV ships to millions of end users.
• Standard, non-destructive methodology. The work is ordinary mobile-app static analysis: decompiling a publicly downloadable APK (jadx), reading the bundled assets and resources, and inspecting the code that configures the app's network stack. These are the exact techniques the program invites researchers to use.
• The finding is a well-recognized vulnerability class. The app ships a password-protected PKCS#12 (.pfx) file in its assets/ directory, and the password that unlocks it is hardcoded in the app's own code (RetrofitFactory). The keystore contains a currently-valid, publicly-trusted DigiCert-issued certificate and its private key for CN=iot.louisvuitton.com (and a preprod counterpart). Embedding the private key of a publicly-trusted TLS certificate in a shipped client is a private-key-compromise event — under the CA/Browser Forum Baseline Requirements it obligates certificate revocation — and it undermines the mutual-TLS client-authentication control protecting LV's IoT/connected-device backend. This is a textbook, high-value report, not an attack.
• Responsible handling. Findings are documented for submission through LV's official YesWeHack channel. I am not distributing the extracted key material, not impersonating the domain, and not accessing other users' data. Any endpoint validation is limited to the minimum needed to demonstrate the issue to the vendor, consistent with the program's rules.

I'm requesting assistance only with the analysis and clear write-up of these findings for coordinated disclosure to the vendor. Happy to provide the program link or scope details on request.