- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
15 assets you may test, 1 excluded.
Web 13
- clearsightadvisors.com Critical No bounty
- doingmoretoday.com Critical No bounty
- enerbank.com Critical No bounty
- firststerling.com Critical No bounty
- http://regions.com Critical No bounty
- http://sabal.com Critical No bounty
- regionsapps.com Critical No bounty
- regionsdev.com Critical No bounty
- regionsqa.com Critical No bounty
- regionsretirement.com Critical No bounty
- regionssource.com Critical No bounty
- regions.us Critical No bounty
- rgbk.com Critical No bounty
Android apps 1
- Regions Bank Critical No bounty
iOS apps 1
- Regions Bank Critical No bounty
Out of scope (1)
- http://regionstest.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Regions Financial (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Only interact with accounts you own or with the explicit permission of the account holder.
-
Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure are not allowed.
-
Do NOT test the physical security of Regions offices, employees, equipment, etc.
-
Do NOT perform any attack that could harm our services (E.g.: DDoS/Spam)
-
Do NOT use automated scanners and tools to find vulnerabilities are strictly not allowed.
-
Do NOT Perform automated/scripted testing of web forms, especially Contact Us forms that are designed for customers to contact our support team.
Not accepted
-
Pivoting, scanning, and vulnerability exploitation.
-
Exfiltration of data from Regions systems.
-
Email spoofing
-
Missing or incorrect SPF/DMARC/DKIM records of any kind
-
Descriptive error messages (e.g. Stack Traces, application or server errors).
-
Fingerprinting / banner disclosure on common/public services.
-
Clickjacking and issues only exploitable through clickjacking.
-
Login/Logout/Unauthenticated/low-impact/anonymous user CSRF.
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
-
Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
-
Lack of Security Speedbump when leaving the site.
-
Weak Captcha / Captcha Bypass
-
Forgot Password page brute force and account lockout not enforced.
-
Username / email enumeration via Login Page or Forgot Password error message
-
Any missing HTTP security headers
-
SSL Issues, e.g.
-
SSL Attacks such as BEAST, BREACH, Renegotiation attack
-
SSL Forward secrecy not enabled
-
SSL weak / insecure cipher suites
-
Vulnerabilities affecting users of outdated browsers
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 57 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
regionstest.com (out of scope)
-
Scope added
clearsightadvisors.com
-
Scope added
enerbank.com
-
Scope added
firststerling.com
-
Scope added
Regions Bank
-
Scope added
regions.com
-
Scope added
regions.us
-
Scope added
regionsapps.com
-
Scope added
regionsdev.com
-
Scope added
regionsqa.com
-
Scope added
regionsretirement.com
-
Scope added
regionssource.com
-
Scope added
rgbk.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Regions Financial looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
- If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Regions, please submit the report for review
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
- Only interact with accounts you own or with the explicit permission of the account holder.
Session Layer: HTTP Headers
Researchers should add headers to requests such as:
- “X-HackerOne-Research: [H1 username]”
#Focus Areas
- Cross Site Scripting (XSS)
- Cross Site Request Forgery (CSRF)
- Insecure direct object references
- Injection Vulnerabilities
- Authentication Vulnerabilities
- Server-side Code Execution
- Privilege Escalation
- Significant Security Misconfiguration (when not caused by user)
- Any out of the box issues which could lead to compromise or leakage of data and directly affect the confidentiality or integrity of user data of which affects user privacy. Out of Scope *All vulnerabilities discovered and reported on other targets (including subdomains) will be accepted. These submissions will be marked; Not Applicable; to prevent negative ratings.
#Prohibited Testing *Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure are not allowed. *Do NOT test the physical security of Regions offices, employees, equipment, etc. *Do NOT perform any attack that could harm our services (E.g.: DDoS/Spam) *Do NOT attack, in any way, our end users, or engage in trade of stolen user credentials. *Do NOT use automated scanners and tools to find vulnerabilities are strictly not allowed. *Do NOT Perform automated/scripted testing of web forms, especially Contact Us forms that are designed for customers to contact our support team. *You may investigate or target vulnerabilities against your own or test accounts, but testing must not disrupt or compromise any data or data access that is not yours.
Vulnerability Program Exclusions
*Pivoting, scanning, and vulnerability exploitation. *Exfiltration of data from Regions systems. *Email spoofing *Missing or incorrect SPF/DMARC/DKIM records of any kind *Descriptive error messages (e.g. Stack Traces, application or server errors). *Fingerprinting / banner disclosure on common/public services. *Clickjacking and issues only exploitable through clickjacking. *Login/Logout/Unauthenticated/low-impact/anonymous user CSRF. *Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. *Lack of Secure/HTTPOnly flags on non-sensitive Cookies. *Lack of Security Speedbump when leaving the site. *Weak Captcha / Captcha Bypass *Forgot Password page brute force and account lockout not enforced. *Username / email enumeration via Login Page or Forgot Password error message *Any missing HTTP security headers *SSL Issues, e.g. *SSL Attacks such as BEAST, BREACH, Renegotiation attack *SSL Forward secrecy not enabled *SSL weak / insecure cipher suites *Vulnerabilities affecting users of outdated browsers
Thank you for helping keep Regions Financial and our users safe!