Public scope
Verified public HackerOne scope¶
This generated reference contains only an anonymously retrieved public policy and current non-archived scope. It is not authorization to test and does not disclose campaign findings, agent conversations or private reports.
Canonical rules: HackerOne program · Scope
Publicly verified: 2026-10-06T23:26:54.787Z.
Public source digest: 3526a84437e8eb7d755eabd5238326eda1fe0bbe72740a939e39dbe518cf9a62
Program¶
Anduril Industries
Handle: anduril_industries
Program state: public_mode
Submission state: open
Offers bounties: yes
Policy¶
# Disclosure Policy
* We currently don't disclose reports marked as Informative.
* Exceptional reports may be considered for disclosure on a case-by-case basis.
# Program Rules
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
* Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
* Ask the program team **before submitting vulnerabilities on unscoped subdomains**
* Only interact with accounts you own or with the explicit permission of the account holder.
* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
* When submitting a report, you acknowledge you are subject to HackerOne's Disclosure Guidelines (as modified by this Program Policy regarding disclosure timelines), the HackerOne Finder Terms and Conditions, HackerOne General Terms and Conditions and HackerOne Core Ineligible Findings.
* Do not exfiltrate any data under any circumstances.
* Do not compromise the privacy or safety of Anduril Industries personnel or any third parties.
* Do not intentionally compromise the intellectual property or commercial interests of any Anduril Industries personnel or entities, or any third parties.
* If at any point you are uncertain whether to continue testing, please engage with our team.
# Session Layer: HTTP Headers
Researchers should add headers to requests such as:
* “X-HackerOne-Research: [H1 username]”
# Legal
Anduril is unable to award a bounty to researchers who reside in a country that is subject to United States export sanctions or trade restrictions. Anduril Industries employees, contractors, service providers, vendors, and their family members are not eligible for bounties. Any testing involving physical approach to or proximal engagement with Anduril wireless networks, property, facilities, or personnel is strictly prohibited and may result in legal action. You must comply with all applicable laws in connection with your participation in this program. You are also responsible for any applicable taxes associated with any reward you receive. We may modify the terms of this program or terminate this program at any time. We won’t apply any changes we make to these program terms retroactively.
Thank you for helping keep Anduril and our users safe!
Current non-archived assets¶
Complete anonymous pagination: 8 assets across 1 pages, including ineligible assets. Archived assets are not represented.
Anduril Property and Facilities
Type: OTHER
Submission eligible: no
Bounty eligible: no
Maximum severity: none
Instructions: Physically engaging or proximal access of Anduril property & facilities is prohibited.
*.anduril.com
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
*.andurildev.com
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
*.anduril.dev
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
*.andurildev.au
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
*.anduril.au
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
*.anduril.com.au
Type: WILDCARD
Submission eligible: yes
Bounty eligible: yes
Maximum severity: critical
Instructions: Not specified in the public source.
andurilgear.com
Type: URL
Submission eligible: no
Bounty eligible: no
Maximum severity: none
Instructions: Not specified in the public source.
Exclusions and completeness¶
Separate scope-exclusion records are not exposed by the anonymous public Team API and are not copied from authenticated imports. Consult the canonical policy and scope for all exclusions, restrictions and updates. Public visibility does not authorize disclosure of vulnerability findings.