Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

DIB-VDP

Vulnerability disclosure program on HackerOne northropgrumman.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
1,085
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Replies within 1 day
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 1 days Within one business day, DIB-VDP will acknowledge receipt of your report.
Safe harbor
Partial This policy does not grant authorization, permission, or otherwise allow express or implied access to DoD or participating DoD contractor information systems to any individual, group of individuals, consortium, partnership, or any other business or legal entity.
Hall of fame
Yes DIB-VDP wants researchers to be recognized publicly for their contributions, if that is the researcher’s desire.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

1,085 assets you may test, 55 excluded.

Web 689

  • 192.45.83.137.svecfiber.com Critical No bounty
  • 1erps4qa5-ext.myngc.com Critical No bounty
  • 38.77.128.194 Critical No bounty
  • 38.77.128.195 Critical No bounty
  • 47.206.114.79 Critical No bounty
  • 74.85.94.211 Critical No bounty
  • 74.85.94.212 Critical No bounty
  • 74.85.94.213 Critical No bounty
  • 74.85.94.215 Critical No bounty
  • 74.85.94.220 Critical No bounty
  • 76.191.116.183 Critical No bounty
  • 76.191.116.185 Critical No bounty
  • 76.191.116.187 Critical No bounty
  • 76.191.116.189 Critical No bounty
  • access19.ngplte.com Critical No bounty
  • aces.northropgrumman.com Critical No bounty
  • acesprogram.northropgrumman.com Critical No bounty
  • admin-edge01.orl01.cymycloud.io Critical No bounty
  • admin-sdpcon01.orl01.cymycloud.io Critical No bounty
  • adsc3061.northgrum.com Critical No bounty
  • alertus-east.northropgrumman.com Critical No bounty
  • alertus-west.northropgrumman.com Critical No bounty
  • angelfrost.ca.essd.northgrum.com Critical No bounty
  • ash.ca.essd.northgrum.com Critical No bounty
  • ato.ca.essd.northgrum.com Critical No bounty
  • atule.ca.essd.northgrum.com Critical No bounty
  • autodiscover.ngplte.com Critical No bounty
  • awtrdev.ngc.com Critical No bounty
  • awtr.ngc.com Critical No bounty
  • awtrplte.ngc.com Critical No bounty
  • azurerelay1.ngc.com Critical No bounty
  • azurerelay2.ngc.com Critical No bounty
  • b2team.wr.is.northgrum.com Critical No bounty
  • badger.ca.essd.northgrum.com Critical No bounty
  • bark.ca.essd.northgrum.com Critical No bounty
  • barracuda1.amewas.com Critical No bounty
  • barracuda.amewas.com Critical No bounty
  • benfold.ca.essd.northgrum.com Critical No bounty
  • benson.ca.essd.northgrum.com Critical No bounty
  • bot.soran.pics Critical No bounty
  • boxer.ca.essd.northgrum.com Critical No bounty
  • boyd.ca.essd.northgrum.com Critical No bounty
  • bridge.ca.essd.northgrum.com Critical No bounty
  • buck.ca.essd.northgrum.com Critical No bounty
  • burns.ca.essd.northgrum.com Critical No bounty
  • c2fsefp.ms.northropgrumman.com Critical No bounty
  • c30avedge19.ngc.com Critical No bounty
  • c30webedge19.ngc.com Critical No bounty
  • c4ionline.northgrum.com Critical No bounty
  • camin-2.ms.northropgrumman.com Critical No bounty
  • camin.ms.northropgrumman.com Critical No bounty
  • captureexec.amewas.com Critical No bounty
  • caron.ca.essd.northgrum.com Critical No bounty
  • ca-sharecenter.myngc.com Critical No bounty
  • casunhen72b-s01-vlan1-7.ca.essd.northgrum.com Critical No bounty
  • casunhen911-s01.ca.essd.northgrum.com Critical No bounty
  • cc2-ests.cc2.myngc.com Critical No bounty
  • cedar.ca.essd.northgrum.com Critical No bounty
  • certdata.northropgrumman.com Critical No bounty
  • cfgsvr05.ca.essd.northgrum.com Critical No bounty
  • cfgsvr09.ca.essd.northgrum.com Critical No bounty
  • cfgsvr15.ca.essd.northgrum.com Critical No bounty
  • challenge.cymy.io Critical No bounty
  • chandler.ca.essd.northgrum.com Critical No bounty
  • chinook.ca.essd.northgrum.com Critical No bounty
  • choctaw.ca.essd.northgrum.com Critical No bounty
  • chrtpssys.northgrum.com Critical No bounty
  • cloudconxdev.myngc.com Critical No bounty
  • cm-gw01.cybermyte.io Critical No bounty
  • coalfirefederal.com Critical No bounty
  • cole.ca.essd.northgrum.com Critical No bounty
  • cook.ca.essd.northgrum.com Critical No bounty
  • cowpens.ca.essd.northgrum.com Critical No bounty
  • cttriems.ts.northropgrumman.com Critical No bounty
  • curts.ca.essd.northgrum.com Critical No bounty
  • daisy.ca.essd.northgrum.com Critical No bounty
  • damato.ca.essd.northgrum.com Critical No bounty
  • dcgsa-pubs.northropgrumman.com Critical No bounty
  • dev.bushmasterchainguns.com Critical No bounty
  • dev-edge01.cymy.io Critical No bounty
  • dev-gw01.cymy.io Critical No bounty
  • dev-sdp01.cymy.io Critical No bounty
  • docker-ee-dev.ms.northgrum.com Critical No bounty
  • doehrs-ih.ms.northropgrumman.com Critical No bounty
  • dorado.ca.essd.northgrum.com Critical No bounty
  • dsdev.northgrum.com Critical No bounty
  • dsplte.ngc.com Critical No bounty
  • dvcenrl.ngc.com Critical No bounty
  • ebis.benefits.northgrum.com Critical No bounty
  • edgeeast.ngc.com Critical No bounty
  • edge.in.myngc.com Critical No bounty
  • eide-pip.myngc.com Critical No bounty
  • electroimpact.com Critical No bounty
  • ens.ngc.com Critical No bounty
  • enterpriseenrollment.ngc.com Critical No bounty
  • eportal.northropgrumman.com Critical No bounty
  • extlyncc30.ngc.com Critical No bounty
  • f270se75.ms.northropgrumman.com Critical No bounty
  • fa18-dmzwww.northgrum.com Critical No bounty
  • fac1.amewas.com Critical No bounty
  • fisher.ca.essd.northgrum.com Critical No bounty
  • flightpakdev.northropgrumman.com Critical No bounty
  • flightpak.northropgrumman.com Critical No bounty
  • fssfmctest.myngc.com Critical No bounty
  • ginkgo.ca.essd.northgrum.com Critical No bounty
  • globalconnect.in.myngc.com Critical No bounty
  • greenfish.ca.essd.northgrum.com Critical No bounty
  • guam.ca.essd.northgrum.com Critical No bounty
  • gw01.cymycloud.com Critical No bounty
  • gw02.cymycloud.com Critical No bounty
  • gw-alex.esailcloud.com Critical No bounty
  • gw-cpep.esailcloud.com Critical No bounty
  • gw.esailcloud.com Critical No bounty
  • gw-sea.esailcloud.com Critical No bounty
  • halsey.ca.essd.northgrum.com Critical No bounty
  • heather.ca.essd.northgrum.com Critical No bounty
  • helenium.ca.essd.northgrum.com Critical No bounty
  • hit-pro-b.myngc.com Critical No bounty
  • hit-pro-d.myngc.com Critical No bounty
  • holly.ca.essd.northgrum.com Critical No bounty
  • hr.ca.essd.northgrum.com Critical No bounty
  • hrweb.northgrum.com Critical No bounty
  • http://144.91.183.242 Critical No bounty
  • http://174.79.172.21 Critical No bounty
  • http://access1.us.baesystems.com Critical No bounty
  • http://access.baesystems.com Critical No bounty
  • http://accessgate.lna.us.baesystems.com Critical No bounty
  • http://accessgate.us.baesystems.com Critical No bounty
  • http://activesync.pitch.se Critical No bounty
  • http://anyconnect.safelnk.net Critical No bounty
  • http://apogeeworx.com Critical No bounty
  • http://attachments.apogeeworx.com Critical No bounty
  • http://autodiscover.apogeeworx.com Critical No bounty
  • http://av1.us.baesystems.com Critical No bounty
  • http://azool3.pitch.se Critical No bounty
  • http://ballaerospace.com Critical No bounty
  • http://bamboo-dev.lab42.us.baesystems.com Critical No bounty
  • http://bamboo.lab42.us.baesystems.com Critical No bounty
  • http://bitbucket-dev.lab42.us.baesystems.com Critical No bounty
  • http://bitbucket.lab42.us.baesystems.com Critical No bounty
  • http://bravo-mx1.apogeeworx.com Critical No bounty
  • http://bscfext.us.baesystems.com Critical No bounty
  • http://cesoepaperless.usgcns.net Critical No bounty
  • http://cloud.pitch.se Critical No bounty
  • http://confluence.lab42.us.baesystems.com Critical No bounty
  • http://cortex.drs.com Critical No bounty
  • http://cps.us.baesystems.com Critical No bounty
  • http://cybermyte.io Critical No bounty
  • http://ddaas.pitch.se Critical No bounty
  • http://dmzsmtprelay.us.baesystems.com Critical No bounty
  • http://east-vpn3.safelnk.net Critical No bounty
  • http://east-www.safelnk.net Critical No bounty
  • http://egateway.us.baesystems.com Critical No bounty
  • http://entdesktop.safelnk.net Critical No bounty
  • http://enterprise.safelnk.net Critical No bounty
  • http://epdm.lna.us.baesystems.com Critical No bounty
  • http://ermportal.us.baesystems.com Critical No bounty
  • http://ermtest.us.baesystems.com Critical No bounty
  • http://exostarsvc-stage.us.baesystems.com Critical No bounty
  • http://exostarsvc.us.baesystems.com Critical No bounty
  • http://extversion.pitch.se Critical No bounty
  • http://falcon.gitlab.drs.com Critical No bounty
  • http://fisac.us.baesystems.com Critical No bounty
  • http://ftp1.fcimg.com Critical No bounty
  • http://ftp.hrtec.net Critical No bounty
  • http://gbr-rgw-crw-nhwbvqmjjt.dynamic-m.com Critical No bounty
  • http://ghe.drs.com Critical No bounty
  • http://gitlab.balldayton.com Critical No bounty
  • http://gp.validatek.com Critical No bounty
  • http://gpvpn.ballaerospace.com Critical No bounty
  • http://gw1.apogeeworx.com Critical No bounty
  • http://hdscasxfer.us.baesystems.com Critical No bounty
  • http://hh-nh11-fsw009.us.baesystems.com Critical No bounty
  • http://hive.drs.com Critical No bounty
  • http://honeycomb.fedhive.com Critical No bounty
  • http://hxfive.com Critical No bounty
  • http://hxfiveservice.com Critical No bounty
  • http://hxfive.sharepoint.com Critical No bounty
  • http://ideworkspace.com Critical No bounty
  • http://idslims.usgcns.net Critical No bounty
  • http://irad-mr35-zero-thrust-blockchain.us.baesystems.com Critical No bounty
  • http://irad-mr35-zero-thrust-broker.us.baesystems.com Critical No bounty
  • http://irsp.com Critical No bounty
  • http://isc-jira-tst.us.baesystems.com Critical No bounty
  • http://isc-jira-uat.us.baesystems.com Critical No bounty
  • http://issctimetest.us.baesystems.com Critical No bounty
  • http://issctimeupg.us.baesystems.com Critical No bounty
  • http://issctime.us.baesystems.com Critical No bounty
  • http://isupplierdr.us.baesystems.com Critical No bounty
  • http://isupplier.us.baesystems.com Critical No bounty
  • http://iwsdeliveryserver.net Critical No bounty
  • http://jabba.pitch.se Critical No bounty
  • http://jira-dev.lab42.us.baesystems.com Critical No bounty
  • http://jira.lab42.us.baesystems.com Critical No bounty
  • http://lc1-srdap-stage.ext.us.baesystems.com Critical No bounty
  • http://lc1-stage.ext.us.baesystems.com Critical No bounty
  • http://license.pitch.se Critical No bounty
  • http://lifecycleone.ext.us.baesystems.com Critical No bounty
  • http://loki.pitch.se Critical No bounty
  • http://mail.apogeeworx.com Critical No bounty
  • And 489 more on HackerOne.

Networks 325

  • 100.36.51.5 Critical No bounty
  • 104.249.144.8 Critical No bounty
  • 104.249.145.8 Critical No bounty
  • 12.125.144.150 Critical No bounty
  • 12.152.33.194 Critical No bounty
  • 12.152.33.198 Critical No bounty
  • 12.152.33.203 Critical No bounty
  • 12.152.33.204 Critical No bounty
  • 12.215.182.100 Critical No bounty
  • 129.222.249.89 Critical No bounty
  • 129.222.81.69 Critical No bounty
  • 12.96.87.210 Critical No bounty
  • 12.96.87.214 Critical No bounty
  • 12.96.87.216 Critical No bounty
  • 12.96.87.219 Critical No bounty
  • 132.228.146.2/32 Critical No bounty
  • 132.228.191.97/32 Critical No bounty
  • 132.228.24.17/32 Critical No bounty
  • 132.228.45.35/32 Critical No bounty
  • 134.223.117.169/32 Critical No bounty
  • 134.223.117.170/32 Critical No bounty
  • 134.223.117.197/32 Critical No bounty
  • 134.223.117.198/32 Critical No bounty
  • 134.223.120.148/32 Critical No bounty
  • 134.223.120.152/32 Critical No bounty
  • 134.223.120.154/32 Critical No bounty
  • 134.223.120.166/32 Critical No bounty
  • 134.223.120.167/32 Critical No bounty
  • 134.223.120.169/32 Critical No bounty
  • 134.223.120.180/32 Critical No bounty
  • 134.223.120.183/32 Critical No bounty
  • 134.223.120.184/32 Critical No bounty
  • 134.223.120.186/32 Critical No bounty
  • 134.223.120.33/32 Critical No bounty
  • 134.223.120.37/32 Critical No bounty
  • 134.223.158.75/32 Critical No bounty
  • 134.223.231.80/32 Critical No bounty
  • 134.223.231.81/32 Critical No bounty
  • 134.223.232.12/32 Critical No bounty
  • 13.64.181.40 Critical No bounty
  • 136.43.35.170 Critical No bounty
  • 136.44.32.242 Critical No bounty
  • 137.51.154.3/32 Critical No bounty
  • 13.91.223.119 Critical No bounty
  • 142.44.104.70 Critical No bounty
  • 144.121.137.158 Critical No bounty
  • 144.129.144.234 Critical No bounty
  • 144.253.36.26 Critical No bounty
  • 144.91.186.142 Critical No bounty
  • 144.91.186.214 Critical No bounty
  • 144.91.186.222 Critical No bounty
  • 144.91.240.118 Critical No bounty
  • 144.91.240.122 Critical No bounty
  • 146.168.157.13 Critical No bounty
  • 146.168.175.18 Critical No bounty
  • 149.32.187.1 Critical No bounty
  • 149.32.187.2 Critical No bounty
  • 149.32.187.3 Critical No bounty
  • 149.32.195.190 Critical No bounty
  • 149.32.200.65 Critical No bounty
  • 149.32.200.66 Critical No bounty
  • 149.32.227.190 Critical No bounty
  • 149.32.232.65 Critical No bounty
  • 149.32.232.66 Critical No bounty
  • 155.104.140.226/32 Critical No bounty
  • 155.104.253.42/32 Critical No bounty
  • 157.127.124.204/32 Critical No bounty
  • 157.127.124.209/32 Critical No bounty
  • 157.127.124.210/32 Critical No bounty
  • 157.127.124.221/32 Critical No bounty
  • 157.127.124.234/32 Critical No bounty
  • 157.127.124.240/32 Critical No bounty
  • 157.127.124.241/32 Critical No bounty
  • 157.127.124.245/32 Critical No bounty
  • 157.127.141.108/32 Critical No bounty
  • 157.127.141.109/32 Critical No bounty
  • 157.127.141.162/32 Critical No bounty
  • 157.127.141.167/32 Critical No bounty
  • 157.127.141.169/32 Critical No bounty
  • 157.127.149.67/32 Critical No bounty
  • 157.127.227.217/32 Critical No bounty
  • 157.127.227.218/32 Critical No bounty
  • 157.127.227.219/32 Critical No bounty
  • 157.127.239.188/32 Critical No bounty
  • 157.127.239.189/32 Critical No bounty
  • 157.127.239.190/32 Critical No bounty
  • 158.114.100.7/32 Critical No bounty
  • 162.17.76.25 Critical No bounty
  • 162.17.76.26 Critical No bounty
  • 162.18.65.162 Critical No bounty
  • 162.18.65.163 Critical No bounty
  • 162.18.65.164 Critical No bounty
  • 162.18.65.167 Critical No bounty
  • 162.18.65.179 Critical No bounty
  • 162.18.71.33 Critical No bounty
  • 162.18.71.37 Critical No bounty
  • 162.18.73.34 Critical No bounty
  • 162.18.73.37 Critical No bounty
  • 162.18.73.39 Critical No bounty
  • 162.18.73.40 Critical No bounty
  • 162.18.73.41 Critical No bounty
  • 162.18.73.45 Critical No bounty
  • 162.18.94.147 Critical No bounty
  • 162.18.94.148 Critical No bounty
  • 173.12.29.41 Critical No bounty
  • 173.61.66.2 Critical No bounty
  • 174.70.213.228 Critical No bounty
  • 174.76.4.202 Critical No bounty
  • 174.77.88.1 Critical No bounty
  • 174.77.88.11 Critical No bounty
  • 174.77.88.6 Critical No bounty
  • 174.77.93.137 Critical No bounty
  • 174.77.93.138 Critical No bounty
  • 174.77.93.139 Critical No bounty
  • 174.77.93.140 Critical No bounty
  • 174.77.93.141 Critical No bounty
  • 174.77.93.142 Critical No bounty
  • 174.78.148.215 Critical No bounty
  • 184.179.112.195 Critical No bounty
  • 184.183.74.131 Critical No bounty
  • 184.183.74.46 Critical No bounty
  • 184.188.143.98 Critical No bounty
  • 184.2.219.133 Critical No bounty
  • 192.86.72.70/32 Critical No bounty
  • 192.86.72.71/32 Critical No bounty
  • 192.86.75.161/32 Critical No bounty
  • 192.86.75.166/32 Critical No bounty
  • 192.86.75.167/32 Critical No bounty
  • 192.86.75.176/32 Critical No bounty
  • 192.86.75.177/32 Critical No bounty
  • 192.86.75.70/32 Critical No bounty
  • 192.86.75.71/32 Critical No bounty
  • 199.165.146.42/32 Critical No bounty
  • 20.115.124.105 Critical No bounty
  • 20.159.208.40 Critical No bounty
  • 20.159.208.98 Critical No bounty
  • 20.172.180.242 Critical No bounty
  • 20.232.23.221 Critical No bounty
  • 20.81.2.124 Critical No bounty
  • 209.190.238.2 Critical No bounty
  • 216.185.30.66 Critical No bounty
  • 216.185.30.81 Critical No bounty
  • 216.196.176.19 Critical No bounty
  • 216.196.176.20 Critical No bounty
  • 216.196.176.21 Critical No bounty
  • 216.196.176.22 Critical No bounty
  • 216.196.176.23 Critical No bounty
  • 216.196.176.24 Critical No bounty
  • 216.196.176.25 Critical No bounty
  • 216.196.176.26 Critical No bounty
  • 216.196.176.27 Critical No bounty
  • 216.196.176.28 Critical No bounty
  • 216.196.176.29 Critical No bounty
  • 216.196.176.30 Critical No bounty
  • 216.200.164.19 Critical No bounty
  • 216.200.164.39 Critical No bounty
  • 216.231.25.46 Critical No bounty
  • 216.54.101.6 Critical No bounty
  • 216.54.31.49 Critical No bounty
  • 216.54.31.50 Critical No bounty
  • 216.54.31.51 Critical No bounty
  • 216.54.31.52 Critical No bounty
  • 216.54.31.53 Critical No bounty
  • 216.54.31.54 Critical No bounty
  • 216.54.31.55 Critical No bounty
  • 216.54.31.56 Critical No bounty
  • 216.54.31.57 Critical No bounty
  • 23.31.104.113 Critical No bounty
  • 23.31.202.25 Critical No bounty
  • 24.113.36.23 Critical No bounty
  • 24.119.114.98 Critical No bounty
  • 24.214.204.54 Critical No bounty
  • 24.245.101.101 Critical No bounty
  • 24.249.200.254 Critical No bounty
  • 24.249.202.226 Critical No bounty
  • 24.249.202.235 Critical No bounty
  • 38.100.17.35 Critical No bounty
  • 38.100.17.45 Critical No bounty
  • 38.114.234.105 Critical No bounty
  • 38.140.202.34 Critical No bounty
  • 38.142.101.155 Critical No bounty
  • 38.142.101.156 Critical No bounty
  • 38.142.101.157 Critical No bounty
  • 38.142.23.82 Critical No bounty
  • 38.142.23.85 Critical No bounty
  • 38.142.23.86 Critical No bounty
  • 38.77.128.47 Critical No bounty
  • 40.129.202.162 Critical No bounty
  • 40.83.138.117 Critical No bounty
  • 40.86.184.158 Critical No bounty
  • 4.14.236.134 Critical No bounty
  • 4.16.65.114 Critical No bounty
  • 44.28.232.48 Critical No bounty
  • 44.28.232.49 Critical No bounty
  • 44.28.232.50 Critical No bounty
  • 44.28.232.51 Critical No bounty
  • 44.28.232.52 Critical No bounty
  • 44.28.232.53 Critical No bounty
  • 44.28.232.54 Critical No bounty
  • 44.28.232.55 Critical No bounty
  • And 125 more on HackerOne.

Wildcard domains 27

  • *.2asc.com Critical No bounty
  • *.alexamerican.com Critical No bounty
  • *.alex-as.com Critical No bounty
  • *.americansystems.com Critical No bounty
  • *.ascgov.com Critical No bounty
  • *.ascsites.com Critical No bounty
  • *.autodiscover.americansystems.com Critical No bounty
  • *.coalfirefederal.com Critical No bounty
  • *.ddlomni.com Critical No bounty
  • *.dese.com Critical No bounty
  • *.drs.ca Critical No bounty
  • *.drs.com Critical No bounty
  • *.drsrada.com Critical No bounty
  • *.emsolve.com Critical No bounty
  • *.epsilon-inc.com Critical No bounty
  • *.epsilon-inc.dev Critical No bounty
  • *.hxfivelaunch.com Critical No bounty
  • *.intrusion.com Critical No bounty
  • *.leonardodrs.com Critical No bounty
  • *.nhaero.com Critical No bounty
  • *.nucleussec.com Critical No bounty
  • *.optics1.com Critical No bounty
  • *.safran-dsi.com Critical No bounty
  • *.savecloud.biz Critical No bounty
  • *.savedev.biz Critical No bounty
  • *.silotechgroup.com Critical No bounty
  • *.theossteam.com Critical No bounty

Products and areas 44

  • 38.77.128.123 Critical No bounty
  • 38.77.128.190 Critical No bounty
  • 38.77.128.196 Critical No bounty
  • 38.77.128.254 Critical No bounty
  • 38.77.128.255 Critical No bounty
  • 50.76.152.193 Critical No bounty
  • access.saphotonics.com Critical No bounty
  • autodiscover.cybermyte.io Critical No bounty
  • connect.caci.com Critical No bounty
  • connect-dr.caci.com Critical No bounty
  • devvpn.centurum.com Critical No bounty
  • dns1.caci.com Critical No bounty
  • dns2.caci.com Critical No bounty
  • dns4.caci.com Critical No bounty
  • ems.centurum.com Critical No bounty
  • gateway.elevi.net Critical No bounty
  • https://ashvpn.telos.com Critical No bounty
  • https://certrenewvpn.telos.com Critical No bounty
  • https://mail19-ash.telos.com Critical No bounty
  • https://mail19-gce.telos.com Critical No bounty
  • https://mail19-gcw.telos.com Critical No bounty
  • https://mdvpn.telos.com Critical No bounty
  • https://mse.telos.com Critical No bounty
  • https://msw.telos.com Critical No bounty
  • https://password.telos.com Critical No bounty
  • https://sftp.telos.com Critical No bounty
  • https://sslvpn.centurum.com Critical No bounty
  • https://vpn1.globalinfotek.com Critical No bounty
  • imap.cybermyte.io Critical No bounty
  • keeper.centurum.com Critical No bounty
  • mail.caci.com Critical No bounty
  • mail.cybermyte.io Critical No bounty
  • mailserver1a.caci.com Critical No bounty
  • mailserver1b.caci.com Critical No bounty
  • mailserver2a.caci.com Critical No bounty
  • mailserver2b.caci.com Critical No bounty
  • mailserver3a.caci.com Critical No bounty
  • mailserver3b.caci.com Critical No bounty
  • syslog.centurum.com Critical No bounty
  • tenant-svc-fw-02.orl01.cymycloud.com Critical No bounty
  • tip.centurum.com Critical No bounty
  • vpn09.drs.com Critical No bounty
  • vpn-east.lgsinnovations.com Critical No bounty
  • vpn-west.lgsinnovations.com Critical No bounty
Out of scope (55)
  • aspera-3.org
  • http://adpass.bisimulations.com
  • http://bluechannel.bisimulations.com
  • http://cdc.bisimulations.com
  • http://cdc.devops.bisimulations.com
  • http://cdcdevops.bisimulations.com
  • http://cdc.staging.bisimulations.com
  • http://cdc.staging.devops.bisimulations.com
  • http://content.bisimulations.com
  • http://distribution-origin.bisimulations.com
  • http://dmz-cdnorigin1.bisimulations.com
  • http://ftp-au.bisimulations.com
  • http://ftp-orl.bisimulations.com
  • http://ftp-stage.terrasim.com
  • http://ftp.terrasim.com
  • http://kb.bisimulations.com
  • http://licensing.bisimulations.com
  • http://lm.bisimulations.com
  • http://manuals.bisimulations.com
  • http://marketplace.bisimulations.com
  • http://news.bisimulations.com
  • http://nextcloud.bisimulations.com
  • http://products.bisimulations.com
  • http://products-origin.bisimulations.com
  • http://resources.bisimulations.com
  • https://bids.acqcenter.com
  • https://dp.acqcenter.com
  • https://eiamd-eis.com
  • https://frtcmodernization.com
  • https://nicmontereyea.com
  • https://nwtteis.com
  • https://oss.ultipro.com
  • https://pmsr-eis.com
  • http://sqf.bisimulations.com
  • https://sealbeachea.com
  • http://sslvpn.au.bisimulations.com
  • http://sslvpn.jp.bisimulations.com
  • http://sslvpn.kr.bisimulations.com
  • http://sslvpn.ks.bisimulations.com
  • http://sslvpn.orl.bisimulations.com
  • http://sslvpn.orlitar.bisimulations.com
  • http://sslvpn.prg.bisimulations.com
  • http://sslvpn.tsitar.terrasim.com
  • http://sslvpn.ts.terrasim.com
  • http://sslvpn.uk.bisimulations.com
  • https://theossteam.com
  • https://theossteam.unanet-gc.biz
  • https://uat1.acqcenter.com
  • https://uat2.acqcenter.com
  • http://terrains.stews.bisimulations.com
  • http://terrasim.com
  • http://www.downloads.terrasim.com
  • http://ztna.ems.bisimulations.com
  • tnorecon.net
  • www.swalesaerospace.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from DIB-VDP (via HackerOne)'s policy.

While testing

  • You will do no harm and will not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
  • You will not exfiltrate any data under any circumstances.
  • You will not conduct denial of service testing.
  • You will not conduct physical testing (e.g. office access, open doors, tailgating) or social engineering, including spear phishing, concerning DoD or participating DoD contractor personnel or others.
  • You will not submit a high-volume of low-quality reports.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope removed

    ceres.space.swri.edu (out of scope)

  2. Scope removed

    classlab.space.swri.edu (out of scope)

  3. Scope removed

    apio.swri.org (out of scope)

  4. Scope removed

    allegro.boulder.swri.edu (out of scope)

  5. Scope removed

    cex260-edge-1.swri.org (out of scope)

  6. Scope removed

    cassinimag.space.swri.edu (out of scope)

  7. Scope removed

    dash2025.space.swri.edu (out of scope)

  8. Scope removed

    jira-sm-public.d10.us.swri.org (out of scope)

  9. Scope removed

    d15jamf.space.swri.edu (out of scope)

  10. Scope removed

    jira.spaceops.swri.org (out of scope)

  11. Scope removed

    boulder.swri.edu (out of scope)

  12. Scope removed

    ccas.swri.org (out of scope)

  13. Scope removed

    div15labs.space.swri.edu (out of scope)

  14. Scope removed

    eclipse.boulder.swri.edu (out of scope)

  15. Scope removed

    juiceuvs.space.swri.edu (out of scope)

  16. Scope removed

    enpa.space.swri.edu (out of scope)

  17. Scope removed

    eon.space.swri.edu (out of scope)

  18. Scope removed

    epc03.swri.org (out of scope)

  19. Scope removed

    erock.space.swri.edu (out of scope)

  20. Scope removed

    et.swri.org (out of scope)

  21. Scope removed

    junoirtf.space.swri.edu (out of scope)

  22. Scope removed

    junoworkshop.space.swri.edu (out of scope)

  23. Scope removed

    ky-demo.d10.us.swri.org (out of scope)

  24. Scope removed

    europauvs.space.swri.edu (out of scope)

  25. Scope removed

    fdlrdportal.swri.org (out of scope)

  26. Scope removed

    filetransfer.swri.org (out of scope)

  27. Scope removed

    fs.us.swri.org (out of scope)

  28. Scope removed

    geoviz.space.swri.edu (out of scope)

  29. Scope removed

    grad.space.swri.edu (out of scope)

  30. Scope removed

    grain.d10.us.swri.org (out of scope)

  31. Scope removed

    h4ydev.d10.us.swri.org (out of scope)

  32. Scope removed

    lamp.space.swri.edu (out of scope)

  33. Scope removed

    mms.space.swri.edu (out of scope)

  34. Scope removed

    nc.space.swri.edu (out of scope)

  35. Scope removed

    lucy.swri.org (out of scope)

  36. Scope removed

    confluence.spaceops.swri.org (out of scope)

  37. Scope removed

    cusp.space.swri.edu (out of scope)

  38. Scope removed

    nfsp.swri.org (out of scope)

  39. Scope removed

    securemail.swri.org (out of scope)

  40. Scope removed

    clipperuvs.space.swri.edu (out of scope)

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP) Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Purpose

This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities directed at the Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP) involving participating DoD contractor partners’ information systems, web properties, other identified scoped assets, and submitting discovered vulnerabilities. This policy is separate and distinct from the DoD VDP policy. If questions arise, please take no action until that action is discussed with the DIB-VDP lead at the Department of Defense Cyber Crime Center (DC3).

No technology is perfect, but DC3 believes that working with skilled security researchers across the globe is crucial to identifying participating DoD contractor network weaknesses. We encourage you to notify us of any security issues for a product or service within the scope set by the DIB-VDP participant, and will work with you to resolve any issues promptly.

Overview

Maintaining the security of defense information within Defense Industrial Base (DIB) contractor networks is a high priority at DoD because this helps to defend the United States of America. Recognizing that the broader security research community regularly makes valuable contributions to the security of the Internet, the DoD believes that a close relationship with this community will also improve the security for participating DoD contractors. As a result, if you have information about a vulnerability in a network identified by a participating DoD contractor, we want to hear from you!

First, any information submitted to the DIB-VDP will be used for defensive purposes – to mitigate or remediate vulnerabilities in DoD contractor information systems, networks, or applications. This research is not contributing to offensive tools or capabilities.

Second, the DIB-VDP is part of DoD’s efforts to extend its relationship with outside security researchers. As of April 2024, security researchers have identified more than 50,000 potential exploits for DoD’s systems. The expansion of vulnerability research to participating DoD contractor networks replicates the DoD’s’ success by making participating DoD contractor networks available for vulnerability research.

Please review the DIB-VDP terms and conditions carefully. Before participating in the DIB-VDP and conducting any testing of participating DoD contractor networks prior to submitting a report, you must agree to abide by these new terms and conditions. Failure to abide by the terms and conditions will result in the loss of being considered a security researcher under this policy.

Scope

Identified DoD contractor network assets that are at published in the In Scope section below this policy. DoD contractor information system assets that are not published under the In Scope header are NOT available for research.

How to Submit a Report

Please provide a detailed summary of the vulnerability including: type of issue; product, version, and configuration of software containing the bug; step-by-step instructions to reproduce the issue; proof-of-concept; impact of the issue; and suggested mitigation or remediation actions, as appropriate.

By clicking “Submit Report,” you are indicating that you have read, understand, and agree to the terms and conditions of DIB-VDP for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to publicly accessible DoD information systems, and that you consent to having the contents of the communication and follow-up communications stored on a U.S. Government information system.

Guidelines

DIB-VDP will deal in good faith with security researchers who discover, test, and submit vulnerabilities or indicators of vulnerabilities in accordance with these terms and conditions:

  • Your activities are limited exclusively to –
  • (1) Testing, through remote means, to detect a vulnerability or identify an indicator related to a vulnerability that is limited to and within the scope of participating DoD contractor information systems that are identified and published at under the In Scope header; and
  • (2) Sharing information solely with DoD or receiving information from DoD about a vulnerability or an indicator related to a vulnerability.
  • You will do no harm and will not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
  • You will avoid intentionally accessing the content of any communications, data, or information transiting or stored on participating DoD contractor information system or systems – except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists. An information system is set of information resources for collecting, processing, maintaining, using, sharing, disseminating of information.
  • You will not exfiltrate any data under any circumstances.
  • You will not intentionally compromise the privacy or safety of DoD or participating DoD contractor personnel (e.g., civilian employees or military members), or any third parties.
  • You will not intentionally compromise the intellectual property or other commercial or financial interests of any DoD personnel or entities, participating DoD contractors, or any third parties.
  • You will not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving express written authorization from DIB-VDP.
  • If during your research you are inadvertently exposed to information that the public is not authorized to access, you will effectively and permanently erase all identified information in your possession as directed by DIB-VDP and report to DIB-VDP that you have done so.
  • You will not conduct denial of service testing.
  • You will not conduct physical testing (e.g. office access, open doors, tailgating) or social engineering, including spear phishing, concerning DoD or participating DoD contractor personnel or others.
  • You will not submit a high-volume of low-quality reports.
  • If at any point you are uncertain whether to continue testing, please engage with our team.

What You Can Expect From Us

We take every disclosure seriously. We will investigate every disclosure and strive to ensure that appropriate steps are taken to mitigate risk and remediate all reported vulnerabilities.

DIB-VDP is committed to coordinating with the security researcher transparently and promptly. This includes taking the following actions:

  • Within one business day, DIB-VDP will acknowledge receipt of your report. DIB-VDP’s security team will investigate the report and may contact you for further information.

  • When practicable and authorized, DIB-VDP will confirm the existence of the vulnerability to the researcher and keep the researcher informed, as appropriate, while remediation of the vulnerability is under way.

  • DIB-VDP wants researchers to be recognized publicly for their contributions, if that is the researcher’s desire. DIB-VDP will seek to allow researchers desiring to be publicly recognized, when practicable and authorized. However, public disclosure of vulnerabilities will only be authorized by the express written consent of DIB-VDP.

Legal

This policy does not grant authorization, permission, or otherwise allow express or implied access to DoD or participating DoD contractor information systems to any individual, group of individuals, consortium, partnership, or any other business or legal entity. However, if a security researcher working in accordance with the terms and conditions of DIB-VDP discloses a vulnerability, then: (1) DIB-VDP will, in the exercise of its authorities, take the following steps for DoD and the participating DoD contractor to: (1) not initiate or recommend any law enforcement action or civil lawsuits related to such activities against that researcher, and (2) Inform the pertinent law enforcement agencies or civil plaintiffs that the researchers activities were, to the best of our knowledge, conducted pursuant to, and in compliance, with the terms and conditions of DIB-VDP.

You must otherwise comply with all applicable Federal, State, and local laws in connection with your security research activities. You may not engage in any security research or vulnerability disclosure activity that is inconsistent with terms and conditions of DIB-VDP or the law. If you engage in any activities that are inconsistent with the terms and conditions of DIB-VDP or the law, you will not be considered a security researcher and may be subject to criminal penalties and civil liability.

To the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of a non-participating entity (e.g., other non-participating DoD other such third party), that non-DoD entity may independently determine whether to pursue legal action or remedies related to such activities.

DIB-VDP may modify the terms and conditions or terminate this policy at any time.