BankUnited
Vulnerability disclosure program on HackerOne bankunited.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 20
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 1 days
| First Response | 1 day |
- Safe harbor
-
Full
Security research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
20 assets you may test.
Web 18
- buconnectfl.bankunited.com Critical No bounty
- buconnectny.bankunited.com Critical No bounty
- ccr.bankunited.com Critical No bounty
- customer.bankunited.com Critical No bounty
- exadprd.bankunited.com Critical No bounty
- exadqa.bankunited.com Critical No bounty
- iccweb.bankunited.com Critical No bounty
- lockboxir.bankunited.com Critical No bounty
- osao.bankunited.com Critical No bounty
- pronto.bankunited.com Critical No bounty
- roc.bankunited.com Critical No bounty
- snowapiprd.bankunited.com Critical No bounty
- snowapiqa.bankunited.com Critical No bounty
- wls.bankunited.com Critical No bounty
- wlsqa.bankunited.com Critical No bounty
- www.bankunited.com Critical No bounty
- www.bridgefundinggroupinc.com Critical No bounty
- www.pinnaclepublicfinance.com Critical No bounty
Android apps 1
- com.leap.bankunited Critical No bounty
iOS apps 1
- com.bankunited.leap Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from BankUnited (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not engage in any activity that can potentially or actually cause harm to BankUnited, our customers, or our employees.
-
Do not engage in any activity that can potentially or actually stop or degrade BankUnited services or assets.
-
Do not store, share, compromise or destroy BankUnited or customer data.
-
Do not complete fraudulent financial transactions.
-
When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
-
Provide BankUnited reasonable time to fix any reported issue.
Not accepted
-
Physical Testing
-
Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials
-
Phishing
-
Denial of service attacks
-
Resource Exhaustion Attacks
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
buconnectfl.bankunited.com
-
Scope added
buconnectny.bankunited.com
-
Scope added
ccr.bankunited.com
-
Scope added
com.bankunited.leap
-
Scope added
com.leap.bankunited
-
Scope added
customer.bankunited.com
-
Scope added
exadprd.bankunited.com
-
Scope added
exadqa.bankunited.com
-
Scope added
iccweb.bankunited.com
-
Scope added
lockboxir.bankunited.com
-
Scope added
osao.bankunited.com
-
Scope added
pronto.bankunited.com
-
Scope added
roc.bankunited.com
-
Scope added
snowapiprd.bankunited.com
-
Scope added
snowapiqa.bankunited.com
-
Scope added
wls.bankunited.com
-
Scope added
wlsqa.bankunited.com
-
Scope added
www.bankunited.com
-
Scope added
www.bridgefundinggroupinc.com
-
Scope added
www.pinnaclepublicfinance.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
BankUnited looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
This is a Vulnerability Disclosure Program Policy for security issues. For all customer service needs, please [contact us][1].
BankUnited is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers (also referred to in this document as ”you” and “your”) clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. If you discover a potential vulnerability in our systems, we encourage you to report it through HackerOne. [1]: https://www.bankunited.com/contact-us
Authorization and Safe Harbor
Security research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Guidelines
Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:
- Do not engage in any activity that can potentially or actually cause harm to BankUnited, our customers, or our employees.
- Do not engage in any activity that can potentially or actually stop or degrade BankUnited services or assets.
- Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets or systems reside, (ii) data traffic is routed or (iii) the researcher is conducting research activity.
- Do not store, share, compromise or destroy BankUnited or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact BankUnited. This step protects any potentially vulnerable data, and you.
- Do not complete fraudulent financial transactions.
- When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
- Provide BankUnited reasonable time to fix any reported issue.
By responsibly submitting your findings to BankUnited in accordance with these guidelines BankUnited agrees not to pursue legal action against you. BankUnited reserves all legal rights in the event of noncompliance with these guidelines.
Once a report is submitted, BankUnited commits to provide acknowledgement of receipt of all reports and may contact you if additional details are needed.
Out of Scope Vulnerabilities
Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out-of-scope vulnerabilities include:
- Physical Testing
- Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials
- Phishing
- Denial of service attacks
- Resource Exhaustion Attacks
BankUnited does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.
Disclosure Policy
Please do not discuss this program or any vulnerabilities (even resolved ones) identified, outside of the program without express consent from BankUnited.
Reporting a Vulnerability
Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely BankUnited, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.
BankUnited will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 1 day |
| Time to Triage | 2 days |
| Time to Resolution | Depends on severity & complexity |
To the best of our ability, we will keep you informed about our progress throughout the process.
By submitting a report to BankUnited, you grant to BankUnited, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.
What we would like to see from you
In order to help us triage and prioritize submissions, we recommend that your reports:
- Describe the location the vulnerability was discovered and the potential impact of exploitation.
- Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
- Be in English, if possible.
Session Layer: HTTP Headers
Researchers should add headers to requests such as:
- “X-HackerOne-Research: [H1 username]”
Submission Instructions
BankUnited uses HackerOne to triage and validate vulnerability reports made pursuant to our Vulnerability Disclosure Program. Submitting your report through HackerOne via the button below will help ensure timely validation. If you are unable to submit a report via HackerOne, you may send us an email at [email protected].