- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 2,053
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
Please note, John Deere does not operate a bug bounty program and makes no offer of reward or compensation in exchange for submitting potential vulnerabilities.
- Response
-
Within 5 days
We aim to respond to all new vulnerability reports within 5 business days and will strive to keep you informed on our progress during the process
- Safe harbor
-
Full
We agree to not pursue civil action against researchers who comply with John Deere’s and HackerOne’s policies regarding this vulnerability disclosure program.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2,053 assets you may test, 80 excluded.
Web 2036
- 101.37.125.224 High No bounty
- 23coop.deere.com Critical No bounty
- _31266a5c69850f5586e1ab425437109f.benninghoven.com Critical No bounty
- 8907balpi7.execute-api.us-east-1.amazonaws.com Critical No bounty
- about-cm-uat.deere.com Critical No bounty
- about.deere.com Critical No bounty
- abtools.deere.com Critical No bounty
- access.bluerivertech.com Critical No bounty
- access-control.deere.com Critical No bounty
- acc.kreiselelectric.com Critical No bounty
- account.deere.com Critical No bounty
- account.pdp-vertex-connect-devl-vpn.us.e20.c01.johndeerecloud.com Critical No bounty
- achieve2.deere.com High No bounty
- _acme-challenge.gm01.benninghoven-gm.com Critical No bounty
- act.deere.com Critical No bounty
- add-equipment.deere.com Critical No bounty
- admindev.sentera.com Critical No bounty
- admin.monosem.com Critical No bounty
- admin.monosemusa.com Critical No bounty
- admin.sentera.com Critical No bounty
- adminservice-dev.pla.com.ar Critical No bounty
- adminstaging2.sentera.com Critical No bounty
- adminstaging.sentera.com Critical No bounty
- admintickets-dev.pla.com.ar Critical No bounty
- admintickets.pla.com.ar Critical No bounty
- advance.deere.com High No bounty
- adzonetest.deere.com Medium No bounty
- agile.deere.com Critical No bounty
- agprograms.deere.com Medium No bounty
- agrisync.com Medium No bounty
- agvault.sentera.com Critical No bounty
- aia-dev.witos.wirtgen-group.com Critical No bounty
- aia.witos.wirtgen-group.com Critical No bounty
- aibelts.com Critical No bounty
- ai.deere.com Critical No bounty
- ai-gateway-moxie-mcp.ae-frontier-ai-gateway-devl-vpn.use1.e18.c01.johndeerecloud.com Critical No bounty
- ai-lab.ae-machine-learning-operations-prod-vpn.us.e18.c01.johndeerecloud.com Critical No bounty
- ai-lab-code-interpreter-api.ae-machine-learning-operations-devl-vpn.us.e18.c01.johndeerecloud.com Low No bounty
- aiops.deere.com Critical No bounty
- ai-platform.deere.com Critical No bounty
- ai-playbook-kit.mfg-material-management-devl-vpn.us.e11.c01.johndeerecloud.com Critical No bounty
- aiproducts.com Critical No bounty
- ai-quest.deere.com Critical No bounty
- all.arcgis-cert-new-276364979.us-east-1.elb.amazonaws.com High No bounty
- all.arcgis-prod-new-1191849026.us-east-1.elb.amazonaws.com Critical No bounty
- allpartsstore.com Critical No bounty
- ama-dev.witos.wirtgen-group.com Critical No bounty
- ama.witos.wirtgen-group.com Critical No bounty
- amd-ai.deere.com Critical No bounty
- analytics-db.sentera.com Critical No bounty
- analyze.deere.com Critical No bounty
- anubhutiadmqual.deere.com Critical No bounty
- anubhutiapicert.deere.com Critical No bounty
- anubhutiapi.deere.com High No bounty
- anubhutiapiqual.tal.deere.com Critical No bounty
- anubhutiapis.channel-dss-r1-anubhuti-devl-vpn.ap.e06.c01.johndeerecloud.com Critical No bounty
- anubhutiapis.channel-dss-r1-anubhuti-prod-vpn.ap.e06.c01.johndeerecloud.com Critical No bounty
- anubhutiapis.channel-dss-r1-anubhuti-qual-vpn.ap.e06.c01.johndeerecloud.com Critical No bounty
- anubhutiapis.deere.com Critical No bounty
- anubhutiapi.tal.deere.com Critical No bounty
- anubhuti-associates-nlb-323ffbc5be9c6943.elb.ap-south-1.amazonaws.com Critical No bounty
- anubhuticert.deere.com Critical No bounty
- anubhuti-common-nlb-b4c5b3b693b55734.elb.ap-south-1.amazonaws.com Critical No bounty
- anubhuti.deere.com Critical No bounty
- anubhuti-local-nlb-6b9d2fc5cd815f6e.elb.ap-south-1.amazonaws.com Critical No bounty
- anubhutiqual.tal.deere.com Critical No bounty
- anubhuti-registration-nlb-67d4351a2d0c539e.elb.ap-south-1.amazonaws.com Critical No bounty
- anubhuti.tal.deere.com Critical No bounty
- anubhutiuatapis.deere.com Low No bounty
- anubhutiuat.deere.com High No bounty
- anubhuti-userdata-nlb-3ba0df74c52b028b.elb.ap-south-1.amazonaws.com Critical No bounty
- anubhuti-userdata-nlb-79fafbcd9dab384c.elb.ap-south-1.amazonaws.com Critical No bounty
- aommetrics.deere.com Critical No bounty
- api.agrisync.com Medium No bounty
- api-casemanagement-financeconnect.deere.com Critical No bounty
- api.contest.deere.com Critical No bounty
- api.creditapplication-devl-floating.us.e10.c01.johndeerecloud.com Critical No bounty
- api.creditapplication-prod-floating.us.e10.c01.johndeerecloud.com Critical No bounty
- apidev.sentera.com Critical No bounty
- api.expertconnect.deere.com Critical No bounty
- api-fc-devl-casemanagement-financeconnect.deere.com Critical No bounty
- api-fc-qual-casemanagement-financeconnect.deere.com Critical No bounty
- api-financeconnect.vpn2-jdf-sharedservices.eu.e10.c01.johndeerecloud.com Critical No bounty
- api-galileo.deere.com Critical No bounty
- apigateway.channel-dss-r1-anubhuti-devl-vpn.ap.e06.c01.johndeerecloud.com Critical No bounty
- apigateway.fihre-autonomous-business-devl-floating.use1.e16.c01.johndeerecloud.com Critical No bounty
- api.jd-exam.com Critical No bounty
- api-jdfcalculator.deere.com Critical No bounty
- api-manufacturing-center.deere.com Critical No bounty
- api-met-kg-genai.tal.deere.com Critical No bounty
- api-meubanco.deere.com Critical No bounty
- api.mfg-manufacturing-center-prod-vpn.use1.e11.c01.johndeerecloud.com Critical No bounty
- apim-orders-service-devl.deere.com Critical No bounty
- api-pay-qual.deere.com Critical No bounty
- apiprod-smoke.deere.com Critical No bounty
- api-qual-casemanagement-financeconnect.deere.com Critical No bounty
- apisecurity.deere.com High No bounty
- api.sentera.com Critical No bounty
- apistaging2.sentera.com Critical No bounty
- apistaging.sentera.com Critical No bounty
- api-trade-mgmt.supplymgmt-tariffs-devl-vpn.use1.e15.c01.johndeerecloud.com Critical No bounty
- api-us-devl-e00.deere.com Critical No bounty
- ap-log.cl.wirtgen-group.com Critical No bounty
- app.agrisync.com Medium No bounty
- app.expertconnect.deere.com High No bounty
- app-pulse.deere.com Critical No bounty
- apps.deere.com Critical No bounty
- app.smartapply.com Critical No bounty
- app.spark.ai Critical No bounty
- apriori-alb-1722286097.us-east-1.elb.amazonaws.com Medium No bounty
- ap-scep.cl.wirtgen-group.com Critical No bounty
- ap-scep-doc.cl.wirtgen-group.com Critical No bounty
- ap-scep.wirtgen-group.com Critical No bounty
- arcgisawsportal.deere.com Critical No bounty
- arcgiscert-elb.vpn-prod.us.e19.c01.johndeerecloud.com High No bounty
- arcgiscertnew-elb.vpn-prod.us.e19.c01.johndeerecloud.com High No bounty
- arcgisdevl2-elb.vpn-devl.us.e19.c01.johndeerecloud.com High No bounty
- arcgisdevlnew-elb.vpn-devl.us.e19.c01.johndeerecloud.com High No bounty
- arcgis-elb.vpn-prod.us.e19.c01.johndeerecloud.com Critical No bounty
- arcgisportalcert.deere.com High No bounty
- arcgisportal.deere.com Critical No bounty
- arcgisportal.tal.deere.com High No bounty
- arcgisportaltest.tal.deere.com Medium No bounty
- arcgisprodnew-elb.vpn-prod.us.e19.c01.johndeerecloud.com Critical No bounty
- artifactory.bluerivertech.com Critical No bounty
- asicprofile.deere.com Critical No bounty
- asnpro.deere.com Critical No bounty
- asnpromcp-prod.deere.com Critical No bounty
- assets.harvestprofit.com Critical No bounty
- atlantis.spark.ai Critical No bounty
- atpqual.tal.deere.com Critical No bounty
- atrium.deere.com High No bounty
- atscalepoc.ae-databricks-prod-standalone.us.e18.c01.johndeerecloud.com Medium No bounty
- attachmentscert.deere.com Critical No bounty
- au-admin.smartapply.com Critical No bounty
- au-dealer.smartapply.com Critical No bounty
- au.smartapply.com Critical No bounty
- austausch.kleemann.info Critical No bounty
- australiaedb.deere.com Critical No bounty
- auth.dev.myvirtualsuper.com Critical No bounty
- auth.kreisel-cloud.com Critical No bounty
- auth.myvirtualsuper.com Critical No bounty
- auth.node.kreisel-cloud.com Critical No bounty
- auth.prod.myvirtualsuper.com Critical No bounty
- auth.spark.ai Critical No bounty
- auth.voegele.info Critical No bounty
- autobiz-metrics-influxdb-prod.deere.com High No bounty
- autoconfig.kingagro.com Critical No bounty
- autoconfig.kingagro.com.ar Critical No bounty
- autodiscover.ciber.com.br Critical No bounty
- autodiscover.die-wirtgen-group-auf-der-bauma.com Critical No bounty
- autodiscover.hamm.eu Critical No bounty
- autodiscover.hamm-external.eu Critical No bounty
- autodiscover.kingagro.com Critical No bounty
- autodiscover.kingagro.com.ar Critical No bounty
- autodiscover.kleemann.info Critical No bounty
- autodiscover.kreiselelectric.com Critical No bounty
- autodiscover.monosemusa.com Critical No bounty
- autodiscover.pla.com.br Critical No bounty
- autodiscover.sentera.com Critical No bounty
- autodiscover.smartapply.com Critical No bounty
- autodiscover.surepointag.com Critical No bounty
- autodiscover.surepointelectronics.com Critical No bounty
- autodiscover.unimil.com.br Critical No bounty
- autodiscover.voegele.info Critical No bounty
- autodiscover.wirtgen.de Critical No bounty
- autodiscover.wirtgen-external.com Critical No bounty
- autodiscover.wirtgen-group.com Critical No bounty
- autogen-api.ae-machine-learning-operations-prod-vpn.us.e18.c01.johndeerecloud.com Critical No bounty
- aws.dev.bearflagrobotics.com Critical No bounty
- aws-testcellauth.apps-prod.us.e11.c01.johndeerecloud.com Medium No bounty
- azbsgw.services.wirtgen-group.com Critical No bounty
- azcigw.services.wirtgen-group.com Critical No bounty
- azsggw.services.wirtgen-group.com Critical No bounty
- azure-dev.wirtgen-group.com Critical No bounty
- azure.wirtgen-group.com Critical No bounty
- bancojohndeere.com.br Critical No bounty
- bantotal-ar-cert.deere.com High No bounty
- bantotal-ar-prod.deere.com Critical No bounty
- barcode.johndeereandco.com Critical No bounty
- beaconx.deere.com Critical No bounty
- beneficios-feria.com High No bounty
- benninghoven.com Critical No bounty
- benninghoven.co.uk Critical No bounty
- benninghoven.de Critical No bounty
- benninghoven.ro Critical No bounty
- benninghoven.wirtgen-group.com Critical No bounty
- bhp.dev.myvirtualsuper.com Critical No bounty
- bhp-safesite.dev.myvirtualsuper.com Critical No bounty
- bim-dev.witos.wirtgen-group.com Critical No bounty
- bim.witos.wirtgen-group.com Critical No bounty
- biomcp.ghns-web-platform-prod-standalone4.us.e00.c01.johndeerecloud.com Critical No bounty
- blog.machinefinder.com Critical No bounty
- blueriver.ai Critical No bounty
- bluerivert.com Critical No bounty
- bluerivertech.com Critical No bounty
- bluerivertechnology.com Critical No bounty
- bom-chat.pdp-epdm-product-structure-devl-vpn.us.e20.c01.johndeerecloud.com Critical No bounty
- bomgar.bluerivertech.com Critical No bounty
- bonomedico.jdiberica.deere.com Critical No bounty
- And 1836 more on HackerOne.
iOS apps 5
- 1104383066 Critical No bounty
- 1498206477 Critical No bounty
- 6467124390 Critical No bounty
- 958749681 Critical No bounty
- PowerAssist Critical No bounty
Android apps 4
- com.deere.anubhuti Critical No bounty
- com.deere.equipmentplus Critical No bounty
- com.deere.myoperations Critical No bounty
- com.johndeere.jdo.android Critical No bounty
Wildcard domains 4
- *.chinacacd-prod-floating.us.e10.c01.johndeerecloud.com Critical No bounty
- *.deere.com Critical No bounty
- *.myvirtualsuper.com.au Critical No bounty
- *.thevirtualsuperintendent.com.au Critical No bounty
Products and areas 4
- bearflagrobotics.com Critical No bounty
- jdews.channel-extended-warranty-prod-vpn.us.e06.c01.johndeerecloud.com Critical No bounty
- johndeerecloud.com Critical No bounty
- other Critical No bounty
Out of scope (80)
- advertising.deere.com
- adzone.deere.com
- api.demo.nonprod.tenna.com
- api.dv2.nonprod.tenna.com
- api.dv3.nonprod.tenna.com
- api.qa1.nonprod.tenna.com
- api.stg.nonprod.tenna.com
- api.tenna.com
- app.tenna.com
- autodiscover.help.tenna.com
- autodiscover.tenna.com
- beta.tenna.com
- bid457c.4722325t.tenna.com
- blog.tenna.com
- cam.tenna.com
- constructionbuilt.tenna.com
- demo.nonprod.tenna.com
- demo-warehouse.nonprod.tenna.com
- dv2.nonprod.tenna.com
- dv2-warehouse.nonprod.tenna.com
- dv3.nonprod.tenna.com
- dv3-warehouse.nonprod.tenna.com
- eld.tenna.com
- expertconnect.support
- fleet.tenna.com
- go.tenna.com
- hank.tenna.com
- helm.cloud.tenna.com
- help.tenna.com
- ingestion-azu-prd.tmp-prd.tenna.com
- ingestion-gms-prd.tmp-prd.tenna.com
- ingestion-gms-stg.tmp-prd.tenna.com
- ingestion-tfa-demo.tmp-prd.tenna.com
- ingestion-tfa-dv3.tmp-nonprd.tenna.com
- ingestion-tfa-prd.tmp-prd.tenna.com
- ingestion-tfa-qa1.tmp-nonprd.tenna.com
- ingestion-tfa-stg.tmp-prd.tenna.com
- johndeereclassic.com
- learn.tenna.com
- login.tenna.com
- monitor.k8s.us-east-1.public.demo.cloud.tenna.com
- monitor.k8s.us-east-1.public.dv3.cloud.tenna.com
- monitor.k8s.us-east-1.public.prd.cloud.tenna.com
- monitor.k8s.us-east-1.public.stg.cloud.tenna.com
- monitor.k8s.us-east-2.public.dv2.cloud.tenna.com
- monitor.k8s.us-east-2.public.qa1.cloud.tenna.com
- next-app.expertconnect.deere.com
- oidc.demo.cloud.tenna.com
- oidc.dv2.cloud.tenna.com
- oidc.dv3.cloud.tenna.com
- oidc.prd.cloud.tenna.com
- oidc.qa1.cloud.tenna.com
- oidc.stg.cloud.tenna.com
- ots.technology.tenna.com
- pla.acronex.com
- qa1.nonprod.tenna.com
- qa1-warehouse.nonprod.tenna.com
- qr-generator.prod.tenna.com
- seasonalpartscatalog.deere.com
- services.api.demo.cloud.tenna.com
- services.api.dv2.cloud.tenna.com
- services.api.dv3.cloud.tenna.com
- services.api.prd.cloud.tenna.com
- services.api.qa1.cloud.tenna.com
- services.api.stg.cloud.tenna.com
- services.api.us-east-1.public.prd.cloud.tenna.com
- staging.johndeereclassic.com
- stg.nonprod.tenna.com
- stg-warehouse.nonprod.tenna.com
- store.tenna.com
- technology.tenna.com
- tenna.com
- tennau.tenna.com
- travel.tenna.com
- try.tenna.com
- us-central-1.r4.abc.expertconnect.support
- us-central-1.r4.xyz.expertconnect.support
- warehouse.tenna.com
- www.store.tenna.com
- www.tenna.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from John Deere (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Provide detailed reports with reproducible steps. Screenshots are welcome.
-
Do not cause harm to John Deere, our customers, or others.
-
Do not alter, save, store, transfer, or otherwise access such data, and immediately purge any local data upon reporting the vulnerability to us
-
Do not disclose any information about the vulnerability unless John Deere specifically approves the disclosure
-
Only conduct research and submit potential vulnerabilities on assets or systems specifically identified as In Scope and do not conduct research on Out of Scope Vulnerabilities.
-
To help us identify you as a HackerOne researcher, please include a custom User-Agent in your request headers: 'hackerone-{your username}'.
-
we kindly request that you use your official HackerOne email address ending with @wearehackerone.com.
Not accepted
-
Clickjacking on pages with no sensitive actions.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Rate Limiting Vulnerabilities
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Any vulnerability requiring Social Engineering or Phishing to exploit are out of scope.
-
Self\Client\Reflective XSS ( **Exception: Stored XSS vulnerabilities**)
-
Session Cookie Reuse
-
Open redirect vulnerabilities
-
Open ports which do not lead directly to a vulnerability
-
Reports from automated tools or scans without a working Proof of Concept
-
Physical Penetration Testing
-
Denial of Service Attacks
-
Presence of autocomplete attribute on web forms
-
Cache Poisoning Vulnerabilities relating to cloudfront (CDN).
-
GPS attack vectors
-
LTE attack vectors
-
Downgrade attack vectors on hardware components
-
Reports of unassigned, unallocated, or "dangling" IP addresses that do not result in a proven security risk
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
-
Scope +
Added to scope: mailhost.johndeere.com
-
Scope +
Added to scope: extraparts.deere.com
-
Scope +
Added to scope: es-develop-api.channel-expertservices-prod-vpn.us.e00.c01.johndeerecloud.com
-
Scope +
Added to scope: ai-playbook-kit.mfg-material-management-devl-vpn.us.e11.c01.johndeerecloud.com
-
Scope +
Added to scope: leasedataservice.deere.com
-
Scope +
Added to scope: jdsn-grr-api.deere.com
-
Scope +
Added to scope: cogi-ai-srv.ghns-web-platform-prod-standalone4.us.e00.c01.johndeerecloud.com
-
Scope +
Added to scope: warrantyelb.apps-qual-vpn.us.e06.c01.johndeerecloud.com
-
Scope +
Added to scope: dmc.johndeere.com
-
Scope +
Added to scope: johndeere.my.cority.com
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
mailhost.johndeere.com
-
Scope added
extraparts.deere.com
-
Scope added
es-develop-api.channel-expertservices-prod-vpn.us.e00.c01.johndeerecloud.com
-
Scope added
ai-playbook-kit.mfg-material-management-devl-vpn.us.e11.c01.johndeerecloud.com
-
Scope added
leasedataservice.deere.com
-
Scope added
jdsn-grr-api.deere.com
-
Scope added
cogi-ai-srv.ghns-web-platform-prod-standalone4.us.e00.c01.johndeerecloud.com
-
Scope added
warrantyelb.apps-qual-vpn.us.e06.c01.johndeerecloud.com
-
Scope added
dmc.johndeere.com
-
Scope added
johndeere.my.cority.com
-
Scope added
auth.node.kreisel-cloud.com
-
Scope added
ccshignition.mfg-mfgiot-prod-vpn.us.e11.c01.johndeerecloud.com
-
Scope added
r3b1ignition.mfg-mfgiotsa-prod-vpn.sa.e11.c01.johndeerecloud.com
-
Scope added
eetd-pdf.deere.com
-
Scope added
linksp.jdiberica.deere.com
-
Scope added
warehouseinsights.deere.com
-
Scope added
jdprismreporting.deere.com
-
Scope added
digitalcampus.deere.com
-
Scope added
warehouseinsights-qual.deere.com
-
Scope added
guidedonboarding.deere.com
-
Scope added
ecm-overview.deere.com
-
Scope added
monosem.com,pl
-
Scope added
keyforge.applications.prod.mesa.brtws.com
-
Scope added
bonomedico.jdiberica.deere.com
-
Scope added
procesoinventario.jdiberica.deere.com
-
Scope added
drxapi.deere.com
-
Scope added
bugharvest.ghns-dwe-transform-prod-vpn.use1.e00.c01.johndeerecloud.com
-
Scope added
nis-cockpit-dev.deere.com
-
Scope added
partscatalog.waratah.com
-
Scope added
partsdataproductapi-ext.deere.com
-
Scope added
edl-prod-databricks-internal-api.ae-databricks2-prod-vpn5.us.e18.c01.johndeerecloud.com
-
Scope added
blog.machinefinder.com
-
Scope added
machinefinderpro.deere.com
-
Scope added
status.deere.com
-
Scope added
ai-gateway-moxie-mcp.ae-frontier-ai-gateway-devl-vpn.use1.e18.c01.johndeerecloud.com
-
Scope added
isg-digital-context-extraction-mcp.isg-et-tag-qual-floating.us.e01.c01.johndeerecloud.com
-
Scope added
resiliency-api.supplymgmt-compliance-risk-devl-vpn2.us.e15.c01.johndeerecloud.com
-
Scope added
patchflow.deere.com
-
Scope added
india-sam-spm-api-prod.channel-dss-r1-india-spm-prod-vpn.ap.e06.c01.johndeerecloud.com
-
Scope added
jdldb.deere.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Responsible Disclosure Policy
John Deere employs secure design and testing practices to protect the integrity, availability, and confidentiality of our applications, systems and the data within them, but we're always willing to accept additional help.
We encourage the security research community or anyone to report any potential vulnerabilities in accordance with the guidelines below. Please note, John Deere does not operate a bug bounty program and makes no offer of reward or compensation in exchange for submitting potential vulnerabilities.
Disclosure Policy Guidelines
- Provide detailed reports with reproducible steps. Screenshots are welcome.
- Do not cause harm to John Deere, our customers, or others.
- Do not compromise the privacy or safety of John Deere, our customers, or others and the operation of our services. Specifically;
- Avoid access to data related to individuals and contact us immediately if you inadvertently encounter such data:
- Do not alter, save, store, transfer, or otherwise access such data, and immediately purge any local data upon reporting the vulnerability to us
- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services
- Do not violate any laws, including all privacy and data security laws.
- Do not disclose any information about the vulnerability unless John Deere specifically approves the disclosure
- Only conduct research and submit potential vulnerabilities on assets or systems specifically identified as In Scope and do not conduct research on Out of Scope Vulnerabilities.
- Do not participate in this program if you are:
- A member of a foreign terrorist organization as designated by the U.S. Department of State;
- A resident of or located in a country against which the United States has trade restrictions or export sanctions as determined by the U.S. Office of Foreign Assets Control (“OFAC”)
- Included on any list as a party of concern by the U.S. Bureau of Industry and Security of the Department of Commerce
- We aim to respond to all new vulnerability reports within 5 business days and will strive to keep you informed on our progress during the process
Using Credentials found in Breached Data
- The submission of breached credentials is currently out of scope as we develop and implement internal processes to mitigate exposure.
Safe Harbor
We agree to not pursue civil action against researchers who comply with John Deere’s and HackerOne’s policies regarding this vulnerability disclosure program. In the event of a conflict between this policy and any HackerOne policy, this policy applies.
Program Scope
Any John Deere digital application, product or service, including John Deere machines, equipment or hardware (collectively “Equipment”), as well as any software, firmware or other component of John Deere equipment
Machines and Equipment
John Deere machines, equipment, and hardware (including any software, firmware, or other embedded components) are in scope for this program. Researchers may report vulnerabilities found on John Deere machines and equipment they encounter or own. If submitting a hardware report, please include the machine model, software/firmware version (if known), and detailed reproduction steps.
Tracking
To help us identify you as a HackerOne researcher, please include a custom User-Agent in your request headers: 'hackerone-{your username}'.
For the purposes of Program Scope, “John Deere” includes Deere & Company and each of its wholly owned subsidiaries. Examples of digital applications, products and services that are in scope can be found the "Scope" tab of the policy page.
Out of Scope Vulnerabilities
When reporting vulnerabilities, please consider:
- attack scenario/exploitability
- security impact of the bug.
The following issues are considered out of scope:
- Clickjacking on pages with no sensitive actions.
- Unauthenticated/logout/login CSRF.
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Rate Limiting Vulnerabilities
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Any vulnerability requiring Social Engineering or Phishing to exploit are out of scope. Including, but not
limited to:
- Self\Client\Reflective XSS ( Exception: Stored XSS vulnerabilities)
- Session Cookie Reuse
- Open redirect vulnerabilities
- Open ports which do not lead directly to a vulnerability
- Reports from automated tools or scans without a working Proof of Concept
- Physical Penetration Testing
- Denial of Service Attacks
- Presence of autocomplete attribute on web forms
- Cache Poisoning Vulnerabilities relating to cloudfront (CDN).
- GPS attack vectors
- LTE attack vectors
- Downgrade attack vectors on hardware components
Dangling IP Vulnerabilities
- Accepted: Dangling IP vulnerabilities are in scope only if you can demonstrate a clear and reproducible security impact, such as a subdomain takeover or the ability for an attacker to claim the IP address and serve malicious content to users or systems. Reports must include evidence of a practical exploit, not just the existence of an unassigned or unallocated IP. Simply showing that an IP address is no longer listed as owned by John Deere is not sufficient evidence of impact.
- Not Accepted: Reports of unassigned, unallocated, or "dangling" IP addresses that do not result in a proven security risk (e.g., no subdomain takeover, no ability to intercept or serve traffic) are out of scope. Merely identifying a released or unassociated IP address is not sufficient for a valid report.
Account Registration
When registering for John Deere accounts on assets that allow self-registration, we kindly request that you use your official HackerOne email address ending with @wearehackerone.com. This ensures we can accurately identify and verify the legitimacy of researchers engaging with HackerOne.
Any role-based or authorization vulnerability, in which a user can execute actions not intended by their assigned role, will be classified as a low severity issue if the following conditions are met:
- The user or hacker must be invited or added to an account, organization, or similar entity by an administrator of that entity.
- The unintended actions can be executed within the context of that specific entity only.
Any John Deere digital application, product or service, but excluding: (1)Any John Deere machine, equipment or other hardware (collectively “Equipment”) And (2) Any software, firmware or other component of John Deere Equipment.