Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
19 in-scope
www.vinci.comurlleonard.vinci.comurlcastor.vinci.comurlsurvey.vinci.comurlwww.fondation-vinci.comurlwww.lab-recherche-environnement.orgurlvœux.vinci.comurlwww.vinci-vie.frurlwww.trajeoh.comurlactionnaires.vinci.comurlUpdate 16/10/26: please note that … program until further noticeotherPlease note that www.lafabriquedel…e is going to be redeveloped.otherAnything that is not explicitely listed in scope sectionother!! Links pointing to other FQDNs are always out of scope !!otheronly exception: wishes.vinci.com (…com) is included in the scopeotherAll PDF documents published or ser…ssibility of these documents.otherOn www.vinci.com, Cross Site Scrip…ect for such code injections.other− removed 1 scope · vinci-groupe.profils.org
16d ago
first indexed
92d ago · 20 in-scope assets
No reports yet. Be the first to share your triage timing for VINCI SA - Public program.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": "vincisa-public-program",
"name": "VINCI SA - Public program",
"public": true,
"managed": null,
"targets": {
"in_scope": [
{
"type": "web-application",
"target": "www.vinci.com"
},
{
"type": "web-application",
"target": "leonard.vinci.com"
},
{
"type": "web-application",
"target": "castor.vinci.com"
},
{
"type": "web-application",
"target": "survey.vinci.com"
},
{
"type": "web-application",
"target": "www.fondation-vinci.com"
},
{
"type": "web-application",
"target": "www.lab-recherche-environnement.org"
},
{
"type": "web-application",
"target": "vœux.vinci.com"
},
{
"type": "web-application",
"target": "www.vinci-vie.fr"
},
{
"type": "web-application",
"target": "www.trajeoh.com"
},
{
"type": "web-application",
"target": "actionnaires.vinci.com"
},
{
"type": "web-application",
"target": "emag.vinci.com"
},
{
"type": "web-application",
"target": "boost.vinci.com"
},
{
"type": "web-application",
"target": "jobs.vinci.com"
},
{
"type": "web-application",
"target": "solutions-environnement.vinci.com"
},
{
"type": "web-application",
"target": "essentiel.vinci.com"
},
{
"type": "web-application",
"target": "essentials.vinci.com"
},
{
"type": "web-application",
"target": "www.chaire-arpenter.fr"
},
{
"type": "web-application",
"target": "www.habileoh.com"
},
{
"type": "web-application",
"target": "stats.vinci.com"
}
],
"out_of_scope": [
{
"type": "other",
"target": "Update 16/10/26: please note that vinci-groupe.profils.org is excluded from our program until further notice"
},
{
"type": "other",
"target": "Please note that www.lafabriquedelacite.com is out of scope from today 10/12/25 as the web site is going to be redeveloped."
},
{
"type": "other",
"target": "Anything that is not explicitely listed in scope section"
},
{
"type": "other",
"target": "!! Links pointing to other FQDNs are always out of scope !!"
},
{
"type": "other",
"target": "only exception: wishes.vinci.com (english version of voeux.vinci.com) is included in the scope"
},
{
"type": "other",
"target": "All PDF documents published or served on castor.vinci.com are public, thank you for not reporting any bug linked to the accessibility of these documents."
},
{
"type": "other",
"target": "On www.vinci.com, Cross Site Scripting (XSS) vulnerabilities are considered out of scope temporarily as part of an exhaustive remediation project for such code injections."
}
]
},
"disabled": false,
"max_bounty": 3000,
"min_bounty": 50
}