Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MOD Supply Chain VDP

By UK Ministry of Defence Vulnerability disclosure program on HackerOne

Accepting reports
Go to program
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
174
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Scope

174 assets you may test, 16 excluded.

Web 144

  • accessto.l3harris.com Critical No bounty
  • ardeinc.com Critical No bounty
  • autodiscover.thorntontomasetti.com Critical No bounty
  • ballastcalc.thorntontomasetti.com Critical No bounty
  • careers.thorntontomasetti.com Critical No bounty
  • corporateresponsibility.thorntontomasetti.com Critical No bounty
  • crm.thorntontomasetti.com Critical No bounty
  • data.intelliearthmaritime.l3harris.com Critical No bounty
  • draken.aero Critical No bounty
  • drumgrange.com Critical No bounty
  • eagle.wsots.net Critical No bounty
  • em5260.careeralerts.thorntontomasetti.com Critical No bounty
  • em793.jobalerts.thorntontomasetti.com Critical No bounty
  • ember.thorntontomasetti.com Critical No bounty
  • emea-vpn-1.l3harris.com Critical No bounty
  • explore.l3harris.com Critical No bounty
  • fileshare.thorntontomasetti.com Critical No bounty
  • filex.thorntontomasetti.com Critical No bounty
  • ftp.drumgrange.com Critical No bounty
  • http://api-drop.thorntontomasetti.com Critical No bounty
  • http://coredev.thorntontomasetti.com Critical No bounty
  • http://corelearn-staging.thorntontomasetti.com Critical No bounty
  • http://corelearn.thorntontomasetti.com Critical No bounty
  • http://core.thorntontomasetti.com Critical No bounty
  • http://dev-api-drop.thorntontomasetti.com Critical No bounty
  • http://dev-drop.thorntontomasetti.com Critical No bounty
  • http://drop.thorntontomasetti.com Critical No bounty
  • http://encounter.thorntontomasetti.com Critical No bounty
  • http://enterpriseregistration.thorntontomasetti.com Critical No bounty
  • http://fimportal.thorntontomasetti.com Critical No bounty
  • http://localhost.drumgrange.com Critical No bounty
  • http://pip-azu2-sec-paf-001-mgmt.ukwest.cloudapp.azure.com Critical No bounty
  • http://recruitment.roke.co.uk Critical No bounty
  • https://cloud157-pri.ms-010.versanow.net Critical No bounty
  • http://skipper.thorntontomasetti.com Critical No bounty
  • https://mdmproject.thorntontomasetti.com Critical No bounty
  • http://spectacles.thorntontomasetti.com Critical No bounty
  • https://pip-azu1-sec-paf-001-mgmt.uksouth.cloudapp.azure.com Critical No bounty
  • https://pip-azu1-sec-paf-002-mgmt.uksouth.cloudapp.azure.com Critical No bounty
  • https://pip-azu1-sec-pan-001.uksouth.cloudapp.azure.com Critical No bounty
  • http://spotlight.thorntontomasetti.com Critical No bounty
  • https://prizmapi.inzpire.com Critical No bounty
  • https://prizm.inzpire.com Critical No bounty
  • https://prizmstagingapi.inzpire.com Critical No bounty
  • https://prizmsupport.inzpire.com Critical No bounty
  • https://snowdev.thorntontomasetti.com Critical No bounty
  • https://spark.thorntontomasetti.com/home Critical No bounty
  • https://support.thorntontomasetti.com Critical No bounty
  • http://stories.thorntontomasetti.com Critical No bounty
  • http://sts.thorntontomasetti.us Critical No bounty
  • http://support.drumgrange.com Critical No bounty
  • http://support.drumgrange.co.uk Critical No bounty
  • http://swap.thorntontomasetti.com Critical No bounty
  • https://www.ttwiin.com Critical No bounty
  • http://taste-test.thorntontomasetti.com Critical No bounty
  • http://torrever.thorntontomasetti.com Critical No bounty
  • http://ttanywhere.thorntontomasetti.us Critical No bounty
  • http://vdp.kahootz.com Critical No bounty
  • http://vpn-ca3.thorntontomasetti.us Critical No bounty
  • http://vpn.drakeneurope.network Critical No bounty
  • http://vpn-il1.thorntontomasetti.us Critical No bounty
  • http://vpn.thorntontomasetti.us Critical No bounty
  • http://webmail.drumgrange.com Critical No bounty
  • http://wip.encounter.thorntontomasetti.com Critical No bounty
  • http://wip.skipper.thorntontomasetti.com Critical No bounty
  • http://wip-swap.thorntontomasetti.com Critical No bounty
  • http://www.inzpire.com Critical No bounty
  • http://www.mactaggart-scott.com Critical No bounty
  • icollab.l3harris.com Critical No bounty
  • images2.thorntontomasetti.com Critical No bounty
  • images.thorntontomasetti.com Critical No bounty
  • internal-check.thorntontomasetti.com Critical No bounty
  • investors.l3harris.com Critical No bounty
  • jdap2.thorntontomasetti.com Critical No bounty
  • keyweb.thorntontomasetti.com Critical No bounty
  • konstru.com Critical No bounty
  • license.pspc.harris.com Critical No bounty
  • lists.thorntontomasetti.com Critical No bounty
  • live.thorntontomasetti.com Critical No bounty
  • mail1.wspsecure.co.uk Critical No bounty
  • mc.thorntontomasetti.com Critical No bounty
  • mfa.thorntontomasetti.com Critical No bounty
  • mlb-vpn-1.l3harris.com Critical No bounty
  • mmireports.thorntontomasetti.com Critical No bounty
  • msoid.thorntontomasetti.com Critical No bounty
  • mx1.thorntontomasetti.com Critical No bounty
  • mx2.thorntontomasetti.com Critical No bounty
  • myip.thorntontomasetti.com Critical No bounty
  • nix1.thorntontomasetti.com Critical No bounty
  • ns1.thorntontomasetti.com Critical No bounty
  • ns2.thorntontomasetti.com Critical No bounty
  • ops.thorntontomasetti.com Critical No bounty
  • panoboston.thorntontomasetti.com Critical No bounty
  • panosample.thorntontomasetti.com Critical No bounty
  • panotour-ba2ghrf.thorntontomasetti.com Critical No bounty
  • panotour-e2s54d9.thorntontomasetti.com Critical No bounty
  • panotour-iml53sx.thorntontomasetti.com Critical No bounty
  • panotour-ro39c8b.thorntontomasetti.com Critical No bounty
  • panotours.thorntontomasetti.com Critical No bounty
  • panotour.thorntontomasetti.com Critical No bounty
  • panotour-w7wkx5l.thorntontomasetti.com Critical No bounty
  • portal.l3harris.com Critical No bounty
  • portal.partner.l3harris.com Critical No bounty
  • premier.pspc.l3harris.com Critical No bounty
  • rsaselfservice.l3t.com Critical No bounty
  • s32ukoazspqa.spark.thorntontomasetti.com Critical No bounty
  • secure.l3apportal.com Critical No bounty
  • sfx.l3harris.com Critical No bounty
  • skanska-secure-partner.co.uk Critical No bounty
  • slc-vpn-1.l3harris.com Critical No bounty
  • smtp.thorntontomasetti.com Critical No bounty
  • snow.thorntontomasetti.com Critical No bounty
  • solutionscenterdev.thorntontomasetti.com Critical No bounty
  • solutionscenter.thorntontomasetti.com Critical No bounty
  • staging-ember.thorntontomasetti.com Critical No bounty
  • supplierservices.acss.l3harris.com Critical No bounty
  • supplychain.l3harris.com Critical No bounty
  • support.l3t.com Critical No bounty
  • svm-cert.l3harris.com Critical No bounty
  • t2d2.thorntontomasetti.com Critical No bounty
  • t4.thorntontomasetti.com Critical No bounty
  • tcpremier.l3harris.com Critical No bounty
  • thorntontomasetti.com Critical No bounty
  • tracer.thorntontomasetti.com Critical No bounty
  • track-iver.net Critical No bounty
  • training.l3harris.com Critical No bounty
  • ttanywhere.thorntontomasetti.com Critical No bounty
  • ttsccmcmg.thorntontomasetti.com Critical No bounty
  • vcdn.thorntontomasetti.com Critical No bounty
  • vdi.l3harris.com Critical No bounty
  • versa.thorntontomasetti.com Critical No bounty
  • vpn-apac.thorntontomasetti.com Critical No bounty
  • vpn-ca3.thorntontomasetti.com Critical No bounty
  • vpn-emia.thorntontomasetti.com Critical No bounty
  • vpn-il1.thorntontomasetti.com Critical No bounty
  • vpn.thorntontomasetti.com Critical No bounty
  • vpn-uk-1.thorntontomasetti.com Critical No bounty
  • www.babcockinternational.com Critical No bounty
  • www.drumgrange.com Critical No bounty
  • www.ellipse.studio Critical No bounty
  • www.l3driver.com Critical No bounty
  • www.prolinx.co.uk Medium No bounty
  • www.pspcpartnerportal.com Critical No bounty
  • www.reach.l3harris.com Critical No bounty

Networks 22

  • 194.73.139.0/27 Critical No bounty
  • 194.73.181.160/29 Critical No bounty
  • 194.73.181.176/28 Critical No bounty
  • 194.73.181.248/29 Critical No bounty
  • 194.73.90.96/27 Critical No bounty
  • 195.99.217.224/28 Critical No bounty
  • 20.49.171.93 Critical No bounty
  • 212.20.255.225 Critical No bounty
  • 212.20.255.54 Critical No bounty
  • 212.20.255.58 Critical No bounty
  • 217.38.165.25/29 Critical No bounty
  • 35.214.122.252 Critical No bounty
  • 51.11.122.92 Critical No bounty
  • 62.64.198.48/28 Critical No bounty
  • 62.64.199.120/29 Critical No bounty
  • 78.32.246.234 Critical No bounty
  • 78.33.231.186 Critical No bounty
  • 81.128.141.138 Low No bounty
  • 81.128.180.192/26 Critical No bounty
  • 85.159.210.14 Critical No bounty
  • 86.188.129.9/29 Critical No bounty
  • 86.188.184.67 Critical No bounty

Wildcard domains 2

  • *.roke.co.uk Critical No bounty
  • www.mactag.com/* Critical No bounty

Products and areas 6

  • IP range 194.74.25.97 - 194.74.25.110 Critical No bounty
  • IP range 216.87.55.1 - 216.87.55.254 Critical No bounty
  • IP range 217.33.241.33 - 217.33.241.62 Critical No bounty
  • IP range 62.172.162.48 - 62.172.162.63 Critical No bounty
  • IP range 81.128.176.1 - 81.128.176.62 Critical No bounty
  • IP range 81.128.180.193 - 81.128.180.254 Critical No bounty
Out of scope (16)
  • 81.139.47.64/28
  • 212.84.174.56
  • asterisk.thorntontomasetti.com
  • careers.draken.aero
  • defenceshare.mod.uk
  • devops.cts.l3harris.com
  • http://coresso.thorntontomasetti.com
  • http://healthyreentry.thorntontomasetti.com
  • http://mirar.thorntontomasetti.com
  • http://thread.thorntontomasetti.com
  • recruitment.roke.co.uk
  • software.cts.l3harris.com
  • swarm.thorntontomasetti.com
  • tms.l3commercialaviation.com
  • *.cas.l3harris.com
  • *.cts.l3harris.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from MOD Supply Chain VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
  • Social engineering (e.g., phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.

Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 32 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope removed

    166.20.208.14

  2. Scope added

    51.11.122.92

  3. Scope added

    35.214.122.252

  4. Scope added

    85.159.210.14

  5. Scope added

    212.20.255.54

  6. Scope added

    78.32.246.234

  7. Scope added

    212.20.255.225

  8. Scope added

    212.20.255.58

  9. Scope added

    http://www.mactaggart-scott.com

  10. Scope added

    86.188.184.67

  11. Scope added

    212.84.174.56 (out of scope)

  12. Scope added

    78.33.231.186

  13. Scope added

    81.128.141.138

  14. Scope added

    20.49.171.93

  15. Scope added

    https://www.mactag.com/*

  16. Scope added

    https://mdmproject.thorntontomasetti.com/

  17. Scope added

    konstru.com

  18. Scope added

    swarm.thorntontomasetti.com (out of scope)

  19. Scope added

    software.cts.l3harris.com (out of scope)

  20. Scope added

    recruitment.roke.co.uk (out of scope)

  21. Scope added

    healthyreentry.thorntontomasetti.com (out of scope)

  22. Scope added

    coresso.thorntontomasetti.com (out of scope)

  23. Scope added

    devops.cts.l3harris.com (out of scope)

  24. Scope added

    defenceshare.mod.uk (out of scope)

  25. Scope added

    careers.draken.aero (out of scope)

  26. Scope added

    http://mirar.thorntontomasetti.com (out of scope)

  27. Scope added

    195.99.217.224/28

  28. Scope added

    asterisk.thorntontomasetti.com (out of scope)

  29. Scope added

    81.139.47.64/28 (out of scope)

  30. Scope added

    thread.thorntontomasetti.com (out of scope)

  31. Scope added

    194.73.181.248/29

  32. Scope added

    194.73.181.176/28

  33. Scope added

    194.73.181.160/29

  34. Scope added

    194.73.139.0/27

  35. Scope added

    *.roke.co.uk

  36. Scope added

    www.prolinx.co.uk

  37. Scope added

    tms.l3commercialaviation.com (out of scope)

  38. Scope added

    194.73.90.96/27

  39. Scope added

    *.cts.l3harris.com (out of scope)

  40. Scope added

    *.cas.l3harris.com (out of scope)

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

This program covers suppliers listed below who are part of UK Ministry of Defence's supply chain:

  • Mactaggart Scott
  • Inzpire
  • Thornton Tomasetti
  • Kahootz
  • L3Harris
  • Prolinx
  • Roke
  • Drumgrange
  • Draken Aero
  • Babcock International

We are only able to accept reports for the scope items listed in the scope section of the program.

Disclosure Policy

  • Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
  • Follow HackerOne's disclosure guidelines.

Program Rules

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
  • Social engineering (e.g., phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.

Session Layer: HTTP Headers

Researchers should add headers to requests such as:

  • “X-HackerOne-Research: [H1 username]”

Thank you for helping keep the Ministry of Defence Supply Chain and our users safe!