Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Oportun

Vulnerability disclosure program on HackerOne oportun.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
43
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
No Oportun does not operate a public bug bounty program and we make no offer of reward or compensation in exchange for submitting potential issues through this disclosure program.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

43 assets you may test, 72 excluded.

Web 43

  • api.digit.co Critical No bounty
  • aplica.oportun.com Critical No bounty
  • apollo.oportun.com Critical No bounty
  • apply.oportun.com Critical No bounty
  • awsqa12.progressfinservices.com Critical No bounty
  • awsqa13.progressfinservices.com Critical No bounty
  • awsqa7.progressfinservices.com Critical No bounty
  • build.jenkins.progressfinservices.com Critical No bounty
  • callback.oportun.com Critical No bounty
  • collections.oportun.com Critical No bounty
  • corp-fileshare.oportun.com Critical No bounty
  • db-prod-redshift-cluster.oportun.com Critical No bounty
  • digit.co Critical No bounty
  • digit-gateway-prod1.oportun.com Critical No bounty
  • docusign-qa12.progressfinservices.com Critical No bounty
  • docusign-qa13.progressfinservices.com Critical No bounty
  • exchange-admin.oportun.com Critical No bounty
  • help.oportun.com Critical No bounty
  • http://account.oportun.com Critical No bounty
  • https://account.oportun.com/login Critical No bounty
  • https://account.oportun.com/services Critical No bounty
  • https://oportun.com High No bounty
  • investor.oportun.com Critical No bounty
  • kiosk.oportun.com Critical No bounty
  • loan.oportun.com Critical No bounty
  • loans.oportun.com Critical No bounty
  • locations.oportun.com Critical No bounty
  • mariadb-analytics-pa-db-1-a.oportun.com Critical No bounty
  • mariadb-data-db-1-a.oportun.com Critical No bounty
  • mariadb-data-db-2-a.oportun.com Critical No bounty
  • mysql-analytics-db-1-a.oportun.com Critical No bounty
  • offers.oportun.com Critical No bounty
  • office365.oportun.com Critical No bounty
  • online-origination.1.app.stage Critical No bounty
  • online-origination.1.app.stage.pfops.com Critical No bounty
  • online-origination-sec-2615.dev.pfops.com Critical No bounty
  • operations.oportun.com Critical No bounty
  • postgres-prod-analytics-db-1-a.oportun.com Critical No bounty
  • press.oportun.com Critical No bounty
  • redshift-dev-cluster.oportun.com Critical No bounty
  • redshift-prod-cluster.oportun.com Critical No bounty
  • rewardredeem.oportun.com Critical No bounty
  • services.oportun.com Critical No bounty
Out of scope (72)
  • admincloud.oportun.com
  • betaesxi.oportun.com
  • blogdev.oportun.com
  • blog.oportun.com
  • blue.oportun.com
  • careers.oportun.com
  • citrix.oportun.com
  • cms2.oportun.com
  • creditcard.oportun.com
  • creditcards.oportun.com
  • dev2.oportun.com
  • develop.oportun.com
  • dev.oportun.com
  • devops.oportun.com
  • devopsprod.oportun.com
  • devpress.oportun.com
  • dl.oportun.com
  • email.oportun.com
  • fileshare.oportun.com
  • firstlook.oportun.com
  • future.oportun.com
  • green.oportun.com
  • guest.oportun.com
  • hidsts.oportun.com
  • hr.oportun.com
  • http://account.oportun.com/creditcards
  • http://az-tools-p01.oportun.com
  • http://ccos-cc-5541.dev.pfops.com
  • http://progressfinservices.com
  • http://rewardredeem.oportun.com
  • https://artifact-repository.oportun.com/ui/login
  • information.oportun.com
  • jenkins.oportun.com
  • jira.oportun.com
  • juno-srs.oportun.com
  • links.email.oportun.com
  • links.oportun.com
  • new.oportun.com
  • o151.ptr347.email.oportun.com
  • o1.ptr7485.oportun.com
  • o2.ptr6468.marketing.oportun.com
  • o2.ptr8094.em67.oportun.com
  • o3.ptr159.servicing.oportun.com
  • o54.ptr2906.servicing.oportun.com
  • oe1.oportun.com
  • oe.oportun.com
  • offer.oportun.com
  • oportal.oportun.com
  • oportun.com.mx
  • osftp.oportun.com
  • osftpw.oportun.com
  • paloalto.oportun.com
  • pl-0-us.oportun.com
  • previewsso.oportun.com
  • quickapply.oportun.com
  • referrals.oportun.com
  • relay.oportun.com
  • rules.oportun.com
  • sap.oportun.com
  • sem-cdn.oportun.com
  • sem-cdn-qa.oportun.com
  • sem-cdn-stage.oportun.com
  • share.oportun.com
  • space.oportun.com
  • sso.oportun.com
  • staging.oportun.com
  • staging.progressfinservices.com
  • tags.oportun.com
  • testuat.oportun.com
  • test-us-east1.oportun.com
  • webmail2.oportun.com
  • webvpn.oportun.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Oportun (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Provide full details of the security vulnerability along with screenshots, target, steps followed, tools used, http requests and responses, and any other artifacts that would help us in validating the vulnerability.
  • Share the security issue with us before making it public on message boards, mailing lists, and other forums.
  • Allow us reasonable time to review, respond and address the issue before disclosing it publicly with Oportun’s prior written approval.
  • Do not engage in any activity that can potentially or actually cause harm to Oportun, our consumers or customers, or our employees.
  • Do not engage in any activity that can potentially or actually stop or degrade Oportun’s applications, services, systems or assets.
  • Do not store, share, compromise or destroy Oportun or customer data.
  • Do not request direct compensation for the reporting of security issues either to Oportun, or through any external marketplace for vulnerabilities, whether black-market or otherwise.
  • Do not initiate a fraudulent financial transaction.
  • Do not engage in any fraudulent activity that may affect our customers data or Oportun’s assets.

Not accepted

  • Physical Testing
  • Social Engineering
  • Phishing
  • Spamming
  • Denial of service attacks
  • Resource Exhaustion attacks
  • Brute-force attacks

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    http://rewardredeem.oportun.com (out of scope)

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Responsible Disclosure Policy:

If you believe you have discovered a potential security vulnerability in Oportun’s application, system, or asset, please report it through Oportun’s HackerOne Disclosure page or below embedded HackerOne’s Disclosure submission form. We will investigate your report and respond to you as soon as possible. Our team of dedicated security professionals work vigilantly to help keep customer information secure. We recognize and appreciate the important role that security researchers and our user community play in helping to keep Oportun and our consumers and customers secure.

Please note, Oportun does not operate a public bug bounty program and we make no offer of reward or compensation in exchange for submitting potential issues through this disclosure program.

Guidelines for Responsible Disclosure

Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:

  • Provide full details of the security vulnerability along with screenshots, target, steps followed, tools used, http requests and responses, and any other artifacts that would help us in validating the vulnerability.
  • Share the security issue with us before making it public on message boards, mailing lists, and other forums.
  • Allow us reasonable time to review, respond and address the issue before disclosing it publicly with Oportun’s prior written approval. By keeping your reports private until we resolve them, you are helping keep Oportun secure for our entire community.
  • Do not engage in any activity that can potentially or actually cause harm to Oportun, our consumers or customers, or our employees.
  • Do not engage in any activity that can potentially or actually stop or degrade Oportun’s applications, services, systems or assets.
  • Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where
    • (i) data, assets or systems reside
    • (ii) data traffic is routed or
    • (iii) the researcher is conducting research activity.
  • Do not store, share, compromise or destroy Oportun or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact Oportun. This step protects any potentially vulnerable data, and you. PII will include, but not be limited to, consumer’s name, address, social security number or other identifying number or code, telephone number, email address, information obtained through Internet collection devices (i.e., cookies), financial information, credit history, application, loan or claim information, names or lists of individuals derived from nonpublic personally identifiable information or otherwise derived from Oportun, and the identification of an individual as a customer or as an individual claimant under a financial product or service provided by Oportun.
  • Do not request direct compensation for the reporting of security issues either to Oportun, or through any external marketplace for vulnerabilities, whether black-market or otherwise.
  • Do not initiate a fraudulent financial transaction.
  • Do not engage in any fraudulent activity that may affect our customers data or Oportun’s assets.
  • Follow HackerOne's disclosure guidelines

Out of Scope Vulnerabilities:

Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out-of-scope vulnerabilities include:

  • Physical Testing
  • Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials, or steal employee or customer data to conduct any activity.
  • Phishing
  • Spamming
  • Denial of service attacks
  • Resource Exhaustion attacks
  • Brute-force attacks