Vodafone
External Program
Submit bugs directly to this organization
Vodafone
We value the expertise and support of the cybersecurity community in maintaining our high security standards. You can use this site to report suspected security vulnerabilities in Vodafone services or products.
If you are aware of a vulnerability that could affect Vodafone's services or products, please submit it through our HackerOne program. Our security specialists will review all submissions and, where required, work with you to resolve any potential issues as quickly as possible.
Gold Standard Safe Harbor — Adheres to Gold Standard Safe Harbor.
Top Response Efficiency — This program's response efficiency is above 90%.
Managed by HackerOne
The following are out of scope:
Vodafone is a telecommunications company who provide internet services for businesses and consumers in a number of regions. Due to the nature of our business, there are many Autonomous System (AS) Numbers and IP address ranges that are registered to us with the various Regional Internet Registries.
As an internet service provider, we assign these IP addresses to our customers, who use them for many different purposes and without any input or interaction from Vodafone. If you are scanning public IP address ranges and identify vulnerabilities on assets that, when searched on common IP look-up tools, state they are Vodafone, please take additional steps to validate that the services you have identified are actually owned and administered by Vodafone before reporting to us.
To summarise, not everything that has "vodafone" in its FQDN actually belongs to us or is within our scope. If you discover vulnerabilities in services hosted by Vodafone but owned by third parties, please report them to the application's owner. Please note that in this situation, no permission to test has been granted by Vodafone or any of its subsidiaries.
To help us distinguish legitimate security research from malicious traffic, please add the following custom HTTP header to all your requests: X-HackerOne-Research: [H1 Username]
Validate that the service you are reporting against is actually owned by Vodafone, and is not just running on an IP address within our customer-assigned IP address pools – for example, visit the service on an HTTP port and verify whether it is a Vodafone-owned website.
This program follows HackerOne's standard disclosure guidelines. All vulnerabilities are strictly confidential, therefore public disclosure of your findings via a blog post, social media, or any other type of medium is not allowed.
If you want to report any other issue not related to security, please refer to the support or contact pages of the relevant Vodafone Local Market, Vodafone Partner Market, or Vodafone Business website.