Current public program scopes¶
These pages are maintained from anonymous HackerOne public program data. Each snapshot includes its source, retrieval time, integrity digest, policy, and non-archived structured assets, including assets marked ineligible. A snapshot is not permission to test: check the current program policy and all applicable restrictions on HackerOne before starting any work.
| Program handle | Current public scope |
|---|---|
1password |
1Password |
airbnb |
Airbnb |
amazonvrp |
Amazon |
anduril_industries |
Anduril |
coinbase |
Coinbase |
eternal |
Eternal |
gitlab |
GitLab |
nba-public |
NBA |
okg |
OKG |
paypal |
PayPal |
tiktok |
TikTok |
uber |
Uber |
zooplus |
Zooplus |
What is and is not maintained¶
A separate wiki publishing worker requests updates for each verified public program. The trusted publisher independently rechecks the anonymous source before rendering a page. It does not publish private program material, vulnerability reports, findings, credentials, or agent conversations.
Research pages and historical program lists for remaining programs are not verified current scope. Programs that are independently confirmed no longer publicly visible are removed from this directory and their program pages are retired. A transient API failure only holds updates; it does not authorize deletion. A program's absence from this list does not authorize testing. Separate exclusions and announcements may not be represented by the public structured-scope interface; the canonical HackerOne policy remains authoritative.
The operator may also remove a public program when its rules are incompatible with the research workflow. Such programs remain excluded from automatic publication until the operator explicitly approves readmission.