- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 29
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
Uniti will acknowledge receipt of all Submissions within two days of submission
- Safe harbor
-
Full
By responsibly submitting your findings to Uniti pursuant to this Program, Uniti agrees not to pursue legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
29 assets you may test, 7 excluded.
Web 23
- gokinetic.com Critical No bounty
- https://www.windstream.com/gokinetic Critical No bounty
- kineticbusiness.com Critical No bounty
- kineticfibernow.com Critical No bounty
- kineticinternetdeals.com Critical No bounty
- kineticwholesale.com Critical No bounty
- my.gokinetic.com Critical No bounty
- officesuite.live Critical No bounty
- officesuiteuc.com Critical No bounty
- paetec.net Critical No bounty
- slfiber.com Critical No bounty
- southernlightfiber.com Critical No bounty
- unitifiber.com Critical No bounty
- unitisolutions.com Critical No bounty
- unititest.com Critical No bounty
- unititowers.com Critical No bounty
- unitiwholesale.com Critical No bounty
- we.windstream.com Critical No bounty
- windstreamenterprise.com Critical No bounty
- windstreamenterprise.net Critical No bounty
- windstream.net Critical No bounty
- windstreamwholesale.com Critical No bounty
- www.windstream.com Critical No bounty
Wildcard domains 6
- *broadviewnet.com Critical No bounty
- *unitibenefits.com Critical No bounty
- *uniti.com Critical No bounty
- *unitisolutions.com Critical No bounty
- *.windstream.com Critical No bounty
- *.windstream.net Critical No bounty
Out of scope (7)
- Allworx
- *.getwindstream.com
- *.orderwindstream.com
- *.windstreambundledeals.com
- *.windstreamdeals.com
- *.windstreamoffers.com
- *.windstreamsmallbusiness.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Uniti (via HackerOne)'s policy.
While testing
-
Report any vulnerability promptly;
-
Avoid violating the privacy of others, disrupting Uniti systems, destroying Uniti data, and/or harming user experience;
-
Perform testing only on in-scope systems and respect systems and activities that are out-of-scope;
-
Refrain from social engineering (e.g., phishing, vishing), or any other non-technical vulnerability testing;
-
Do not store, share, compromise or destroy Uniti or user data.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact;
-
Only interact with test accounts you own or with explicit permission from the account holder; and
-
Do not engage in extortion;
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
unititowers.com
-
Scope added
windstreamenterprise.net
-
Scope added
kineticbusiness.com
-
Scope added
kineticfibernow.com
-
Scope added
kineticinternetdeals.com
-
Scope added
kineticwholesale.com
-
Scope added
officesuite.live
-
Scope added
officesuiteuc.com
-
Scope added
slfiber.com
-
Scope added
southernlightfiber.com
-
Scope added
unitifiber.com
-
Scope added
unitisolutions.com
-
Scope added
unititest.com
-
Rules updated
Added: “Uniti is proud to partner with the HackerOne community and to continue its vulnerability hunting program. At Uniti, we take the security of our systems and netw...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Uniti is proud to partner with the HackerOne community and to continue its vulnerability hunting program. At Uniti, we take the security of our systems and networks very seriously, and we value the input of ethical security researchers to assist us in maintaining high standards for the security of our systems and customers’ information. If you believe you have identified a potential security vulnerability, please share it with us by following the submission procedures below. Thank you for your ongoing contributions to our security program.
If you are new to our Program, please be sure to review prior to making a submission.
Program Scope
This Policy applies to the following systems and services: •uniti.com •unitiwholesale.com •solutions.uniti.com •my.gokinetic.com • gokinetic.com • windstream.com • .windstream.com • windstream.net • .windstream.net • we.windstream.com • windstreamenterprise.com • windstreamwholesale.com • kineticbusiness.com • kineticfibernow.com • kineticinternetdeals.com • kineticwholesale.com • officesuite.live • officesuiteuc.com • slfiber.com • southernlightfiber.com • unitifiber.com • unitisolutions.com • unititest.com • unititowers.com • Windstreamenterprise.net
Any services not expressly listed above are excluded from the scope of this Program and not authorized for testing or research. In the event you find vulnerabilities in systems from our customers or vendors, please report those directly to the customer or vendor according to their disclosure policies.
Submission Procedures:
Your submission report must contain a detailed description of the discovered vulnerability and steps to reproduce it (the “Submission”). At minimum, your Submission must include the following: • Application, service, product, or system where the vulnerability was discovered • Vulnerability class or type • Possible security impacts • Steps to reproduce the vulnerability • Suggested vulnerability mitigation or remediation
Uniti will acknowledge receipt of all Submissions within two days of submission and will inform the submitting party of the status of any validated vulnerability reported through this Program.
Program Guidelines
To encourage vulnerability research and to avoid any confusion between ethical security research and malicious attacks, ethical security researchers must follow this Program and all applicable state, federal, and local laws, regulations, ordinances, or orders. Additionally, you must comply with the following: • Report any vulnerability promptly; • Avoid violating the privacy of others, disrupting Uniti systems, destroying Uniti data, and/or harming user experience; • Perform testing only on in-scope systems and respect systems and activities that are out-of-scope; • Refrain from social engineering (e.g., phishing, vishing), or any other non-technical vulnerability testing; • Do not store, share, compromise or destroy Uniti or user data. If you gain unintended access to data, limit the amount of data you access to the absolute minimum required for effectively demonstrating a Proof of Concept; cease testing; purge user data and submit a report to Uniti immediately, noting the unintended data access; User data includes, but is not limited to, customer and employee data, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or other proprietary information; • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact; • When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced); • Multiple vulnerabilities caused by one underlying issue will be treated as one valid report; • Only interact with test accounts you own or with explicit permission from the account holder; and • Do not engage in extortion; • If you detect the same bug on a different (unique) host before the report reaches triage for our .net assets, we will notify the customer. It is important to note that some subnets of the .net environment may be managed by the customer, meaning remediation is solely their responsibility. Therefore, confirmation of remediation completion may not be provided by Uniti. These reports will be marked as resolved. Please allow ‘Company ABC’ ample time to patch other instances of the host. Any future submission involving the same bug on the same host later will be considered as duplicate. If you encounter multiple hosts with the same bug under the same domain, please consolidate them into one report per domain. Instances of the same bug on different hosts within the same domain are considered as one report.
By providing a Submission:
• You certify that you have complied with the provisions of this Program set forth here and all applicable laws, statutes, regulations or ordinances.
• You attest that you are not a resident of, or not make your submission from, a country or region under U.S. sanctions (see the OFAC List).
• You attest you are at least 18 years old.
• You agree to keep all details of any discovered vulnerabilities confidential unless written permission is granted by Uniti.
• You agree that any Uniti information that you may encounter, view, acquire, or access, is owned by Uniti or its customers, clients, or third-party providers. You have no rights, title, or ownership in any such information.
• You agree that your research will be conducted for testing and research purposes only, and that you will not attempt to gain access to customer or user accounts or confidential information and will only interact with accounts you own.
• You consent to your information being stored and transferred to the United States and acknowledge you have read and accepted the terms of this policy.
• You acknowledge that you have read and agreed to the Hacker1 Disclosure Philosophy https://www.hackerone.com/disclosure-guidelines.
By responsibly submitting your findings to Uniti pursuant to this Program, Uniti agrees not to pursue legal action against you. However, in the event of any noncompliance with this Program, we reserve all legal rights against you, including the right to pursue criminal and civil remedies for the noncompliance. Further, to the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products or services of any non-Uniti entity, or personal data of Uniti employees, customers, suppliers or any other third party, such non-Uniti entity or person may independently determine whether to pursue legal action or remedies related to such activities.
Uniti may amend the terms of this Program and maintains the right to terminate this Program at any time with or without notice.