HCL Software Inc.
By HCLSoftware, Inc. Vulnerability disclosure program on HackerOne hcl-software.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 48
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
HCLSoftware does not participate in bug bounty awards programs at this time.
- Response
-
Within 2 days
| First Response | 2 days |
- Safe harbor
-
Partial
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
48 assets you may test, 1 excluded.
Desktop and binaries 48
- HCL AppScan Critical No bounty
- HCL Atlas Critical No bounty
- HCL BigFix Critical No bounty
- HCL Clara Critical No bounty
- HCL Commerce Critical No bounty
- HCL Connections Critical No bounty
- HCL Design Room Live! Critical No bounty
- HCL Digital Experience (Portal & Content Manager) Critical No bounty
- HCL Domino Critical No bounty
- HCL Forms Critical No bounty
- HCL HERO Critical No bounty
- HCL Informix Critical No bounty
- HCL Informix on Cloud Critical No bounty
- HCL Integration Platform (HIP) Critical No bounty
- HCL Leap Critical No bounty
- HCL Notes Critical No bounty
- HCL OneTest Critical No bounty
- HCL One Test Embedded Critical No bounty
- HCL RealTime Software Tooling (RTist) Critical No bounty
- HCL Sametime Critical No bounty
- HCL Tech - Billing Request System (BRQ) Critical No bounty
- HCL Tech - Compensation Console OnPrim Critical No bounty
- HCL Tech - Geo Joining Console (GJC) Critical No bounty
- HCL Tech - GEO - Leave Management System (LMS) Critical No bounty
- HCL Tech - Global Claim System - CVCS Azure Critical No bounty
- HCL Tech - Global Claim System - ECS Critical No bounty
- HCL Tech - HCLT-EIS-Project Initiation & Budgeting Critical No bounty
- HCL Tech - India - Leave Management System (LMS) Critical No bounty
- HCL Tech - iOffboardWebOnPrim Critical No bounty
- HCL Tech - iOnboard Application Critical No bounty
- HCL Tech - iRemunerate Critical No bounty
- HCL Tech - iTIME Critical No bounty
- HCL Tech - My Profile (ESS) Critical No bounty
- HCL Tech - My Travel TAS AZURE Critical No bounty
- HCL Tech - Netconsole Joining Critical No bounty
- HCL Tech - Resource Assignation System (RAS) Critical No bounty
- HCL Tech - Revenue Forecast System (iRFS) Critical No bounty
- HCL Tech - Smart Service Desk (SSD) Azure Critical No bounty
- HCL Tech - TP-SOW Critical No bounty
- HCL Terminal Enterprise Access (TEA) Critical No bounty
- HCL Unica Critical No bounty
- HCL UrbanCode Deploy Critical No bounty
- HCL UrbanCode Velocity Critical No bounty
- HCL Verse Critical No bounty
- HCL Workload Automation (HWA) Critical No bounty
- HCL Workload Automation on AWS Critical No bounty
- HCL Z Asset Optimizer Critical No bounty
- HCL Z Data Tools Critical No bounty
Out of scope (1)
- *.hcltechsw.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from HCL Software Inc. (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
-
Only report vulnerabilities for HCLSoftware products that are currently in support.
-
Only the current release and the previous release of any of these products are covered by this program.
-
Do not include any information that may identify an individual (such as a name, contact information, IP address or other similar information) in any attachments included in your vulnerability report.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Not accepted
-
Clickjacking on pages with no sensitive state changing actions.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Best practices that do not lead to an actionable vulnerability or do not have a CVE.
-
Any activity that could lead to the disruption of our service (DoS).
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
-
HCLSoftware product that has reached End Of Support (EOS) is not accepted and will receive a "Not Applicable" response.
-
Publicly known data meant to be accessed by anyone.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
HCLSoftware recognizes how important the security community is in keeping our products and our customers safe. We thank you in advance for your contributions to our vulnerability disclosure program.
The HCLSoftware Vulnerability Management Team manages the receipt, investigation and internal coordination of security vulnerability information related to HCLSoftware offerings. This team will coordinate with HCL product and solutions teams to investigate and, if needed, identify the appropriate response plan. Maintaining communication between all involved parties, both internal and external, is a key component of our vulnerability response process.
Please note, report status marked as triaged is subject to change pending the responding team's final analysis.
Customers and other entitled users of a product or solution should contact HCLSoftware Customer Support to report issues discovered in HCLSoftware offerings. If the HCLSoftware Customer Support Team determines that a reported issue is a security vulnerability, it will contact HCLSoftware Vulnerability Management Team, as needed.
Response Targets
HCLSoftware, Inc. will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 2 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
If your report is not specifically related to HCLSoftware products that are listed in our structured scope section, please know that we can neither guarantee remediation timelines nor commit to closed loop communications around the vulnerability. We will gratefully accept these reports and pass them to the appropriate team, but we only commit to remediation timelines and communications for reports on our assets that are specifically in scope.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
- Initially, this Program Policy is limited to exploitable security vulnerabilities and CVE found in the products that HCLSoftware has acquired from IBM. Please see the list of In Scope products below. As we expand our Vulnerability Management Program, we will add more HCLSoftware products to this list.
- To be eligible to participate in this program, you must not be under contract to perform security testing for HCLTech Corporation, or an HCLTech subsidiary, or HCLSoftware client within 6 months prior to submitting a report.
- Only report vulnerabilities for HCLSoftware products that are currently in support. Check the “In Scope” section below for the product list. Only the current release and the previous release of any of these products are covered by this program.
- To protect our customers, HCLSoftware does not publicly disclose or confirm security vulnerabilities until HCLSoftware has conducted an analysis of the product and issued fixes and/or mitigations. By submitting a vulnerability report to HCLSoftware, you agree to not publicly disclose or share the vulnerability with any third party until HCLSoftware confirms that the vulnerability has been remediated or you have received written permission from HCLSoftware to publish information about the vulnerability.
- HCLSoftware does not participate in bug bounty awards programs at this time. In order for HCLSoftware to evaluate your vulnerability report, you agree to provide the following information about your finding: details on the software product and version, a description of the issue, the hardware platform, steps to reproduce the issue, and potential impact. *Do not include any information that may identify an individual (such as a name, contact information, IP address or other similar information) in any attachments included in your vulnerability report.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. *When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Clickjacking on pages with no sensitive state changing actions.
- Unauthenticated/logout/login CSRF.
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Best practices that do not lead to an actionable vulnerability or do not have a CVE.
- Any activity that could lead to the disruption of our service (DoS).
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
- HCLSoftware product that has reached End Of Support (EOS) is not accepted and will receive a "Not Applicable" response.
*Publicly known data meant to be accessed by anyone.
- Please note: if you find a directory listing and explain how it can lead to a malicious exploit then we'll accept it.
Legal Notice
By submitting a vulnerability report to HCLSoftware, you agree that HCLSoftware may use any information provided by you in such report for any HCLSoftware business purpose (including but not limited to reproduction of the vulnerability, remediation of the vulnerability and general development purposes), without requiring consent from or payment to you.
Also, it is important that you notify us if any such information or associated intellectual property is not your own work or is covered by the intellectual property rights of others. Not notifying us means that you've represented that no third-party intellectual property rights are involved.
Thank you for helping keep HCLSoftware and our customers safe!