QinetiQ Response
By QinetiQ Vulnerability disclosure program on HackerOne qinetiq.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 30
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 1 days
We aim to provide first response to your submission within one working day and triage of the report within five working days.
- Safe harbor
-
Partial
Research that complies with these guidelines will be considered as authorised by QinetiQ (a “Safe Harbour”).
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
30 assets you may test, 1 excluded.
Networks 14
- 128.98.0.0/16 Critical No bounty
- 148.252.225.26 Critical No bounty
- 185.76.92.0/24 Critical No bounty
- 185.76.95.0/24 Critical No bounty
- 192.102.214.0/24 Critical No bounty
- 192.150.204.0/24 Critical No bounty
- 194.61.176.0/20 Critical No bounty
- 209.91.67.138/31 Critical No bounty
- 209.91.67.140/31 Critical No bounty
- 209.91.67.142/32 Critical No bounty
- 85.159.168.0/22 Critical No bounty
- 85.159.172.0/24 Critical No bounty
- 85.159.173.0/24 Critical No bounty
- 85.159.174.0/23 Critical No bounty
Wildcard domains 8
- *.airaffairs.com.au Critical No bounty
- *.naimuri.com Critical No bounty
- *.qinetiq.ca Critical No bounty
- *.qinetiq.cloud Critical No bounty
- *.qinetiq.com Critical No bounty
- *.qinetiq.com.au Critical No bounty
- *.qinetiq.co.uk Critical No bounty
- *.us.qinetiq.com Critical No bounty
Web 7
- airaffairs.com.au Critical No bounty
- offline.qinetiq.co.uk Critical No bounty
- qinetiq.com.au Critical No bounty
- www.naimuri.com Critical No bounty
- www.ncsiss.org.uk Critical No bounty
- www.qinetiq.com Critical No bounty
- www.t3e.uk Critical No bounty
Products and areas 1
- Security vulnerabilities found in any digital assets owned, operated, or controlled by QinetiQ, or by its publicly listed subsidiaries, are considered in scope. Critical No bounty
Out of scope (1)
- accessibility.qinetiq.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from QinetiQ Response (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Avoid using any tools or techniques that could compromise or degrade QinetiQ systems (e.g. denial-of-service attacks, brute-force attempts, or intrusive scanning).
-
Traffic must be restricted to a maximum of 10 requests per second per endpoint.
-
Only access the minimum data required to demonstrate a vulnerability.
-
do not modify or share data that is not your own.
-
Keep details of the vulnerability confidential to QinetiQ until we have notified you that it has been resolved.
-
Social engineering (e.g., phishing, vishing, smishing) is prohibited.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
accessibility.qinetiq.com (out of scope)
-
Scope added
*.naimuri.com
-
Scope added
*.qinetiq.co.uk
-
Scope added
Security vulnerabilities found in any digital assets owned, operated, or controlled by QinetiQ, or by its publicly listed subsidiaries, are...
-
Scope added
*.airaffairs.com.au
-
Scope added
*.qinetiq.ca
-
Scope added
*.qinetiq.cloud
-
Scope added
*.qinetiq.com
-
Scope added
*.qinetiq.com.au
-
Scope added
*.us.qinetiq.com
-
Scope added
128.98.0.0/16
-
Scope added
148.252.225.26
-
Scope added
185.76.92.0/24
-
Scope added
185.76.95.0/24
-
Scope added
192.102.214.0/24
-
Scope added
192.150.204.0/24
-
Scope added
194.61.176.0/20
-
Scope added
209.91.67.138/31
-
Scope added
209.91.67.140/31
-
Scope added
209.91.67.142/32
-
Scope added
85.159.168.0/22
-
Scope added
85.159.172.0/24
-
Scope added
85.159.173.0/24
-
Scope added
85.159.174.0/23
-
Scope added
airaffairs.com.au
-
Scope added
offline.qinetiq.co.uk
-
Scope added
qinetiq.com.au
-
Scope added
www.naimuri.com
-
Scope added
www.ncsiss.org.uk
-
Scope added
www.qinetiq.com
-
Scope added
www.t3e.uk
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Vulnerability Disclosure Policy
Protecting Our Digital Landscape
The security of our systems, assets, and infrastructure is fundamental to everything QinetiQ does. We understand the importance of creating resilient solutions that can withstand ever-evolving threats to our systems, services and data. To that end, we value the contributions of the security research community in identifying vulnerabilities and helping us safeguard our operations.
We encourage responsible vulnerability disclosure as a means of strengthening the digital environment which we all live in today. If you believe you have found a vulnerability in any of QinetiQ’s systems, we invite you to report it to us through the secure channels detailed below.
#Reporting a Vulnerability In the submission, please ensure you include details of:
- System Details: Identify the system, service, or platform where the vulnerability exists (e.g., specific webpage, IP address).
- Description of the Vulnerability: Provide a clear explanation of the vulnerability type (e.g., XSS, authentication bypass).
- Proof of Concept: Steps to reproduce the issue, including any necessary diagrams, screenshots, scripts or videos, to assist in our validation. We aim to provide first response to your submission within one working day and triage of the report within five working days. We will work with you throughout the process to ensure that the issue is resolved in a timely and transparent manner.
#Guidelines for Responsible Disclosure QinetiQ appreciates the responsible disclosure of security vulnerabilities. To facilitate a productive and legal collaboration, we request that researchers:
- Maintain Integrity: Avoid using any tools or techniques that could compromise or degrade QinetiQ systems (e.g. denial-of-service attacks, brute-force attempts, or intrusive scanning).
- Respect Rate Limits: Traffic must be restricted to a maximum of 10 requests per second per endpoint. Automated tools or scanners should be configured accordingly.
Where possible, use a custom
User-Agentstring such as: qinetiqvdp_<h1_username>, and consider adding a header such as: X-HackerOne-Researcher: <h1_username> As part of responsible security research, we recommend reviewing and adhering to RFC 9511, which outlines guidelines for conducting coordinated vulnerability disclosure activities. - Limit Access: Only access the minimum data required to demonstrate a vulnerability.
- Stay Within the Law: Ensure that your research complies with all relevant legal frameworks, both locally and internationally. This includes complying with applicable privacy and data protection laws.
- Data security: Where technically feasible, refrain from accessing data which is not your own. In all circumstances, do not modify or share data that is not your own. In particular, you must not, share, redistribute or fail to properly secure data retrieved from QinetiQ’s systems or services.
- Confidentiality: Keep details of the vulnerability confidential to QinetiQ until we have notified you that it has been resolved. Even when the vulnerability has been resolved, any disclosure that you wish to make regarding the vulnerability requires our express consent must not be linked in any way to QinetiQ. You must securely delete all data retrieved during the research as soon as it is no longer required or within one calendar month of the date when we notify you that the vulnerability has been resolved (whichever occurs first). QinetiQ requires a minimum of 120 days to validate and address the issue.
- Follow HackerOne's disclosure guidelines.
By adhering to these guidelines, you are helping us to ensure that our systems remain secure without compromising operational capabilities or the privacy of our users.
#What You Can Expect from Us Upon submitting a vulnerability report, you can expect:
- Prompt Acknowledgement: We will confirm receipt of your report within one working days.
- Clear Communication: Our team will engage with you to fully understand the nature and scope of the vulnerability.
- Triage and Resolution: We will prioritise and remediate vulnerabilities based on their impact, severity, and complexity. Progress updates will be provided throughout.
- Final Confirmation: Once the issue is resolved, we will notify you and may invite you to verify the fix.
#Safe Harbour QinetiQ recognises and appreciates the efforts of security researchers acting in good faith under this program. Research that complies with these guidelines will be considered as authorised by QinetiQ (a “Safe Harbour”). Public disclosure of vulnerabilities before they have been addressed, without our explicit consent, will be considered non-compliant with the terms of this policy and may result in the loss of Safe Harbour protection and QinetiQ taking legal action against you. Please note that this policy does not extend to third party systems or services that QinetiQ does not control, and those entities may choose to take legal action independently.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
- Social engineering (e.g., phishing, vishing, smishing) is prohibited.
- Only interact with accounts you own or with explicit permission of the account holder.
Core Ineligible Findings
When reporting potential vulnerabilities, please consider (1) realistic attack scenarios, and (2) the security impact of the behaviour. Below, you will find the most common false positives we encounter. The following issues will be closed as invalid except in rare circumstances demonstrating clear security impact:
Check here for HackerOne’s Core Ineligible Findings
#Legalities and Responsibilities QinetiQ's vulnerability disclosure policy is aligned with established industry best practices. However, it does not grant permission to act outside the bounds of applicable law. Researchers are expected to abide by all applicable legal requirements, and this policy does not indemnify individuals against any legal actions taken by other organisations as a result of unauthorised activities.