Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Equifax-vdp

By Equifax Inc. Vulnerability disclosure program on HackerOne equifax.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
298
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Replies within 5 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 5 days We will aim to respond to new reports within five business days.
Safe harbor
Partial Equifax does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsi

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

298 assets you may test, 5 excluded.

Web 199

  • abr.com.au Critical No bounty
  • abrglobal.com Critical No bounty
  • acrcredit.com.au Critical No bounty
  • allfinanceaustralia.com.au Critical No bounty
  • aussiecreditscore.com.au Critical No bounty
  • australianbusinessresearch.com.au Critical No bounty
  • autohistory.com.au Critical No bounty
  • autoscore.com.au Critical No bounty
  • b2bay.com.au Critical No bounty
  • b2baydirect.com.au Critical No bounty
  • baycorpadvantage.com.au Critical No bounty
  • baycorpadvantage.net.au Critical No bounty
  • bcadirect.net.au Critical No bounty
  • boqfquote.com.au Critical No bounty
  • buildrating.com Critical No bounty
  • buildrating.com.au Critical No bounty
  • businesscreditexpress.com.au Critical No bounty
  • businessloyalty.com.au Critical No bounty
  • campaignmanagement.com.au Critical No bounty
  • cardalert.com.au Critical No bounty
  • cardalert.co.nz Critical No bounty
  • carhistory.com.au Critical No bounty
  • chaodeudas.cl Critical No bounty
  • checkcars.com.au Critical No bounty
  • checkmyrego.com.au Critical No bounty
  • checkmyvin.com.au Critical No bounty
  • claimcheck.com.au Critical No bounty
  • claimhistory.com.au Critical No bounty
  • claimscheck.com.au Critical No bounty
  • claimshistory.com.au Critical No bounty
  • codeset.com.au Critical No bounty
  • collectorinsight.com.au Critical No bounty
  • corporatescorecard.com Critical No bounty
  • corporatescorecard.com.au Critical No bounty
  • corporatescorecard.co.nz Critical No bounty
  • creditadvantage.com.au Critical No bounty
  • creditalert.com.au Critical No bounty
  • creditapps.com.au Critical No bounty
  • creditcardsentinel.com.au Critical No bounty
  • creditevaluator.com.au Critical No bounty
  • creditexpert.com.au Critical No bounty
  • creditexpress.com.au Critical No bounty
  • creditfile.com.au Critical No bounty
  • creditfileconfirm.com.au Critical No bounty
  • credithistory.com.au Critical No bounty
  • creditreference.com.au Critical No bounty
  • creditreference.net.au Critical No bounty
  • creditshare.com.au Critical No bounty
  • creditworks.com.au Critical No bounty
  • dataenhancement.com.au Critical No bounty
  • data-specialist.com.au Critical No bounty
  • dataspecialist.com.au Critical No bounty
  • debtoriq.com.au Critical No bounty
  • decisionlink.com.au Critical No bounty
  • disposableincomeindicator.com.au Critical No bounty
  • donotcontact.com.au Critical No bounty
  • driverhistory.com.au Critical No bounty
  • eapps.com.au Critical No bounty
  • ecredential.com.au Critical No bounty
  • edxppsr.com.au Critical No bounty
  • efficeintforms.com Critical No bounty
  • efficienthire.com Critical No bounty
  • efficienthire.info Critical No bounty
  • efficienthire.net Critical No bounty
  • efficienthire.org Critical No bounty
  • efficientwotc.com Critical No bounty
  • efhire.com Critical No bounty
  • efwotc.com Critical No bounty
  • ehxhr.com Critical No bounty
  • ekkoguardian.com Critical No bounty
  • ekkoguardian.com.au Critical No bounty
  • enhanceyourdata.com.au Critical No bounty
  • eperformance.com.au Critical No bounty
  • equifax.jp Critical No bounty
  • erecruit.com.au Critical No bounty
  • esisweb.com.au Critical No bounty
  • ext-equifax.cl Critical No bounty
  • freecreditscore.com.au Critical No bounty
  • geodemographics.com.au Critical No bounty
  • georisk.com.au Critical No bounty
  • getbusinesscreditscore.com.au Critical No bounty
  • getcreditscore.com.au Critical No bounty
  • github.com Critical No bounty
  • help.equifax.com Critical No bounty
  • howismycredit.com.au Critical No bounty
  • https://vpoconfig.tools.prod.appriss.com Critical No bounty
  • icirt.com.au Critical No bounty
  • identitywatch.com.au Critical No bounty
  • idmatrix.com.au Critical No bounty
  • ingoodco.com.au Critical No bounty
  • inivio.com.au Critical No bounty
  • inivio.co.nz Critical No bounty
  • instantcheck.com.au Critical No bounty
  • instantchecks.com.au Critical No bounty
  • insurancehistory.com.au Critical No bounty
  • insurancereference.com.au Critical No bounty
  • insurancereference.net.au Critical No bounty
  • JOBALIGN.COM Critical No bounty
  • JOBALIGN.INFO Critical No bounty
  • JOBALIGN.NET Critical No bounty
  • JOBAL.IN Critical No bounty
  • knowmycredit.com.au Critical No bounty
  • knowmycredit.co.nz Critical No bounty
  • knowyourtradie.com.au Critical No bounty
  • mail.ext-equifax.cl Critical No bounty
  • mercury.com.au Critical No bounty
  • mintaustralia.com.au Critical No bounty
  • mirusonline.co.nz Critical No bounty
  • myclaimshistory.com.au Critical No bounty
  • myclinicalprofile.com.au Critical No bounty
  • mycreditalert.co.nz Critical No bounty
  • mycredit.com.au Critical No bounty
  • mycreditfile.com.au Critical No bounty
  • mycreditfile.co.nz Critical No bounty
  • mycredithistory.com.au Critical No bounty
  • mycreditmanager.com.au Critical No bounty
  • mycreditmonitor.com.au Critical No bounty
  • myinsurancehistory.com.au Critical No bounty
  • myinsurancepassport.com.au Critical No bounty
  • myomail.com.au Critical No bounty
  • myveda.co Critical No bounty
  • myveda.com.au Critical No bounty
  • nationaltaxcredit.com Critical No bounty
  • nswlandtitles.com.au Critical No bounty
  • ntcusa.com Critical No bounty
  • ntd.net.au Critical No bounty
  • onow.com.au Critical No bounty
  • parkingmadeeasy.net.au Critical No bounty
  • paymentsplace.com.au Critical No bounty
  • peoplemetro.com.au Critical No bounty
  • ppsrcheck.com.au Critical No bounty
  • ppsr.com.au Critical No bounty
  • ppsrsearch.com Critical No bounty
  • ppsrsearch.com.au Critical No bounty
  • prescreening.com.au Critical No bounty
  • propertyvaluepro.com Critical No bounty
  • propertyvaluepro.com.au Critical No bounty
  • propertyvaluesms.com Critical No bounty
  • propertyvaluesms.com.au Critical No bounty
  • prospectshop.com.au Critical No bounty
  • reachtel.com.au Critical No bounty
  • register.alertxpress.com Critical No bounty
  • revscheck.com.au Critical No bounty
  • revs.com.au Critical No bounty
  • revsearch.com.au Critical No bounty
  • revssearch.com.au Critical No bounty
  • secureidentity.com.au Critical No bounty
  • securesentinel.com.au Critical No bounty
  • securesentinel.co.nz Critical No bounty
  • swiftcheck.com.au Critical No bounty
  • tdxaustralia.com.au Critical No bounty
  • tdxgroup.com.au Critical No bounty
  • tenancycheck.com.au Critical No bounty
  • tenancydatabase.com.au Critical No bounty
  • thedataspecialist.com.au Critical No bounty
  • theverificationexchange.com.au Critical No bounty
  • vedaadvantage.asia Critical No bounty
  • vedaadvantage.com Critical No bounty
  • vedaadvantage.com.au Critical No bounty
  • vedaadvantage.co.nz Critical No bounty
  • vedaauto.com.au Critical No bounty
  • vedacheck.com Critical No bounty
  • vedacheck.com.au Critical No bounty
  • veda.com.au Critical No bounty
  • vedaconnect.com.au Critical No bounty
  • veda.co.nz Critical No bounty
  • vedacreditshare.com.au Critical No bounty
  • vedadiscoverer.com.au Critical No bounty
  • vedadvantage.com Critical No bounty
  • vedadvantage.com.au Critical No bounty
  • vedadvantage.co.nz Critical No bounty
  • vedaetrace.com.au Critical No bounty
  • vedareporter.com Critical No bounty
  • vedaresource.com.au Critical No bounty
  • vedascore.com.au Critical No bounty
  • vedasearch.com.au Critical No bounty
  • vedatraining.com Critical No bounty
  • vedatraining.com.au Critical No bounty
  • vedatraining.co.nz Critical No bounty
  • vedauto.com Critical No bounty
  • vedauto.com.au Critical No bounty
  • vedaxml.com Critical No bounty
  • vedaxml.com.au Critical No bounty
  • verification-exchange.com.au Critical No bounty
  • verificationexchange.com.au Critical No bounty
  • verificationexchange.co.uk Critical No bounty
  • verificationexchange.uk Critical No bounty
  • verifier.efxfed.com Critical No bounty
  • verifycv.com Critical No bounty
  • verifycv.com.au Critical No bounty
  • verifycv.co.nz Critical No bounty
  • verifycvonline.com.au Critical No bounty
  • vinchecks.com.au Critical No bounty
  • vsrcheck.com.au Critical No bounty
  • welcomeclient.com Critical No bounty
  • www.equifax.com Critical No bounty
  • www.recupera.asnefempresas.com Critical No bounty
  • yourcreditandidentity.com.au Critical No bounty
  • yourcreditidentity.com.au Critical No bounty

Wildcard domains 79

  • *.abr.com.au Critical No bounty
  • *.accountscore.com Critical No bounty
  • *.accountscore.co.uk Critical No bounty
  • *.accountscore.net Critical No bounty
  • *.alertxpress.com Critical No bounty
  • *.ansoniacreditdata.com Critical No bounty
  • *.apprissafety.com No bounty
  • *.appriss.com No bounty
  • *.appriss.com,*.appriss.net,*.apprissafety.com,*.apprissgomobile.com,*.apprissinsights.com,*.apprissinsights.net,*.apprissmobile.com Critical No bounty
  • *.apprissgomobile.com No bounty
  • *.apprissinsights.com No bounty
  • *.apprissinsights.net No bounty
  • *.apprissmobile.com No bounty
  • *.appriss.net No bounty
  • *.boavistascpc.com.br Critical No bounty
  • *.boavistaservicos.com.br Critical No bounty
  • *.bvsnet.com.br Critical No bounty
  • *.certificadoboavista.com.br Critical No bounty
  • *.datacredito1.com Critical No bounty
  • *.datacredito2.com Critical No bounty
  • *.datacredito3.com Critical No bounty
  • *.datacredito.com Critical No bounty
  • *.datacredito.com.do Critical No bounty
  • *.datacredito.info Critical No bounty
  • *.decisionpoint3.com Critical No bounty
  • *.dicom.cl Critical No bounty
  • *.efficientforms.com Critical No bounty
  • *.efficienthire.com Critical No bounty
  • *.employersedge.com Critical No bounty
  • *.employersedge.net Critical No bounty
  • *.equifax.cl Critical No bounty
  • *.equifax.com Critical No bounty
  • *equifax.com.br Critical No bounty
  • *equifax.com.pa Critical No bounty
  • *.equifax.com.pe Critical No bounty
  • *.equifax.cr Critical No bounty
  • *.fraudday.com Critical No bounty
  • *.healthefxforms.us Critical No bounty
  • *.healthefx.net Critical No bounty
  • *.healthefx.us Critical No bounty
  • *.hiretech.com Critical No bounty
  • *.i2verify.com Critical No bounty
  • *.i9advantage.com Critical No bounty
  • *.i9anywhere.com Critical No bounty
  • *.idwatchdog.com Critical No bounty
  • *.justicexchange.com Critical No bounty
  • *.konduto.blog Critical No bounty
  • *.konduto.com Critical No bounty
  • *.kount.com Critical No bounty
  • *.kount.net Critical No bounty
  • *.mapcity.com Critical No bounty
  • *.mercury.com.au Critical No bounty
  • *.midigator.com Critical No bounty
  • *.mytaxform.com Critical No bounty
  • *.ntcusa.com Critical No bounty
  • *.paynet.ca No bounty
  • *.paynet.com No bounty
  • *.paynet.credit No bounty
  • *.paynetonline.ca No bounty
  • *.paynetonline.com No bounty
  • *.paynetonline.mobi No bounty
  • *.paynetonline.site No bounty
  • *.paynetonline.us No bounty
  • *.paynetonline.us,*.paynetonline.ca,*.paynetonline.com,*.paynetonline.site,*.paynetonline.mobi Critical No bounty
  • *.paynet.us No bounty
  • *.paynet.us,*.paynet.ca,*.paynet.com,*.paynet.credit Critical No bounty
  • *.redeverdeamarela.com.br Critical No bounty
  • *.registervpo.com Critical No bounty
  • *.scpcnet.com.br Critical No bounty
  • *.talx.com Critical No bounty
  • *theworknumber.com Critical No bounty
  • *vaultverify.com Critical No bounty
  • *.vedaadvantage.com Critical No bounty
  • *.vedaadvantage.com.au Critical No bounty
  • *.vedaadvantage.com.nz Critical No bounty
  • *veraz.com.ar Critical No bounty
  • *.vineapps.com Critical No bounty
  • *.vineprotect.com Critical No bounty
  • *www.vaultverify.com Critical No bounty

Products and areas 20

  • *equifax.ca Critical No bounty
  • *equifax.cl Critical No bounty
  • *equifax.co.cr Critical No bounty
  • *equifax.co.in Critical No bounty
  • *equifax.com Critical No bounty
  • *equifax.com.ar Critical No bounty
  • *equifax.com.au Critical No bounty
  • *equifax.com.mx Critical No bounty
  • *equifax.com.pr Critical No bounty
  • *equifax.com.py Critical No bounty
  • *equifax.com.tw Critical No bounty
  • *equifax.co.nz Critical No bounty
  • *equifax.co.uk Critical No bounty
  • *equifax.ec Critical No bounty
  • *equifax.es Critical No bounty
  • *equifax.hn Critical No bounty
  • *equifax.pe Critical No bounty
  • *equifax.pt Critical No bounty
  • *equifax.ru Critical No bounty
  • *equifax.sv Critical No bounty
Out of scope (5)
  • app.disputeprocessing-test.equifax.com
  • http://promo.application.equifax.com
  • https://app.disputeprocessing.equifax.com
  • preview.midigator.com
  • *.acordocerto.com.br

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Equifax-vdp (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • You do no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
  • You do not exfiltrate, alter, or destroy any data under any circumstances.
  • You do not compromise the privacy or safety of Equifax personnel or any third parties.
  • You do not compromise the intellectual property or other commercial or financial interests of any Equifax personnel or entities, or any third parties.
  • You do not conduct denial of service testing or other testing that impacts the availability of Equifax services.
  • You do not conduct social engineering, including spear phishing, of Equifax personnel, contractors, customers.
  • You do not attempt to gain physical access to any of our offices or data centers.
  • You do not include any information that may identify an individual other than yourself (such as name, contact information, IP address, or other similar information) in your vulnerability report or any attachments thereto

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 56 minutes ago.

  1. Scope +

    Added to scope: http://promo.application.equifax.com

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    http://promo.application.equifax.com (out of scope)

  2. Scope removed

    https://equifax.ivdocs.net (out of scope)

  3. Scope removed

    https://equifaxpre.ivdocs.net (out of scope)

  4. Scope added

    app.disputeprocessing-test.equifax.com (out of scope)

  5. Scope added

    https://app.disputeprocessing.equifax.com (out of scope)

  6. Scope added

    *.vedaadvantage.com

  7. Scope added

    *.vedaadvantage.com.au

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Equifax Vulnerability Disclosure Program Policy

Purpose

This policy is intended to give security researchers and other participants in the security community clear guidelines under the Equifax Vulnerability Disclosure Program for conducting vulnerability discovery activities directed at web properties owned or operated by Equifax Inc., its affiliates, or subsidiaries (“Equifax”), and submitting discovered vulnerabilities to Equifax. Your participation in the program is voluntary and subject to the terms and conditions set forth on this page. By submitting a report, you acknowledge and agree to the terms and conditions contained in this Policy. You also acknowledge that, to the extent they are not inconsistent with this Policy; you are subject to:

Overview

Maintaining the security of our networks is a priority at Equifax. The security community regularly makes valuable contributions to the security of organizations and Equifax recognizes that fostering a close relationship with the community will help improve our own security. So if you have information about a vulnerability in an Equifax system or web application, we want to hear from you!

Information submitted to Equifax under this program will be used for defensive purposes – to mitigate or remediate vulnerabilities in our networks or applications, or the applications of our vendors.

As part of this program, you must review, understand, and agree to the following terms and conditions before conducting any testing of Equifax networks and before submitting a report. Thank you.

Scope

Any public-facing system owned, operated, or controlled by Equifax, including web applications hosted on those sites.

Guidelines

  • Your activities are limited exclusively to: 1. Testing to detect a vulnerability or identify an indicator related to a vulnerability; or 2. Sharing with, or receiving from, Equifax information about a vulnerability or an indicator related to a vulnerability.
  • You do no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
  • You avoid intentionally accessing the content of any communications, data, or information transiting or stored on Equifax information system(s) – except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists.
  • You do not exfiltrate, alter, or destroy any data under any circumstances.
  • You do not compromise the privacy or safety of Equifax personnel or any third parties.
  • You do not compromise the intellectual property or other commercial or financial interests of any Equifax personnel or entities, or any third parties.
  • You do not publicly disclose or share with any third-party any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving explicit written authorization from Equifax.
  • You do not conduct denial of service testing or other testing that impacts the availability of Equifax services.
  • You do not conduct social engineering, including spear phishing, of Equifax personnel, contractors, customers.
  • You do not attempt to gain physical access to any of our offices or data centers.
  • You do not include any information that may identify an individual other than yourself (such as name, contact information, IP address, or other similar information) in your vulnerability report or any attachments thereto
  • You do not submit a high-volume of low-quality reports.
  • If at any point you are uncertain whether to continue testing, please engage with the HackerOne team at [email protected].

How to Submit a report

Please provide a detailed summary of the vulnerability, including: *Type of issue *Product *Version *Configuration of software containing the bug *Step-by-step instructions to reproduce the issue, and if applicable, to remediate it *Proof-of-concept *Impact of the issue

By clicking “Submit report” you are indicating that you have read, understand, and agree to the terms and conditions described in this Policy for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to Equifax information systems, and consent to having the contents of the communication and follow-up communications stored on an Equifax information system in the United States.

What You Can Expect From Us

Equifax remains committed to coordinating with you as openly and quickly as possible under the circumstances. We will aim to respond to new reports within five business days. We will investigate reports based on information available and may contact you for further information. Please note, reports marked as triaged are subject to change pending our team’s final analysis. We’ll try to keep you informed about our progress throughout the process.

Legal

You must comply with Equifax’s Terms of Use, security industry best practices, and all applicable Federal, State, and local laws in connection with your security research activities or other participation in this vulnerability disclosure program. You agree that any and all information acquired or accessed as part of this exercise is confidential to Equifax and you shall hold all such information in strict confidence and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose such information to third parties or use such information for any purposes other than for the performance of your work or expressly authorized in writing by Equifax.

Equifax does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.

To the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of a non-Equifax entity (e.g., Federal departments or agencies; State, local, or tribal governments; other private sector companies or persons; employees or personnel of any such entities; or any other such third party), that non-Equifax third party may independently determine whether to pursue legal action or remedies related to such activities.

By submitting a report to Equifax, you grant to Equifax Inc., its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.

Equifax may modify the terms of this policy or terminate the policy at any time.