Transunion Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://hackerone.com/transunion
note: >-
  probe-security-programs.py returned vdp=none because every transunion.com path answers
  403 behind Cloudflare bot management, so the on-domain probe could not read a security
  page. The program is nonetheless real and public, confirmed by querying HackerOne's own
  GraphQL API for the team handle rather than scraping the JS-rendered page.
program:
  platform: HackerOne
  handle: transunion
  name: TransUnion LLC
  url: https://hackerone.com/transunion
  type: vulnerability-disclosure-program
  state: public_mode
  submission_state: open
  offers_bounties: false
  response_targets:
    first_response: 2 business days
    time_to_triage: 2 business days
    time_to_resolution: depends on severity and complexity
  policy_excerpt: >-
    "TransUnion LLC looks forward to working with the security community to find
    vulnerabilities in order to keep our businesses and customers safe."
policy:
  - https://hackerone.com/transunion
contact:
  - https://hackerone.com/transunion (reports are submitted through HackerOne, not email)
security_txt:
  served: false
  detail: >-
    /.well-known/security.txt could not be read on any TransUnion host — 403 on
    www.transunion.com and api.transunion.com (Cloudflare), NXDOMAIN on
    developer.transunion.com. A published VDP with no security.txt pointing at it is a
    real discoverability gap: an automated scanner has no way to find this program.
other_listings:
  - url: https://hackerone.com/transunion_legacy
    name: TransUnion
    detail: >-
      A second, older HackerOne handle that still resolves (HTTP 200) but returns null for
      state/submission_state — it appears dormant. Recorded so the live handle is not
      confused with it.
evidence:
  - {source: 'https://hackerone.com/graphql (team handle "transunion")', kind: platform-api, http_status: 200, fetched: '2026-08-13'}
  - {source: https://hackerone.com/transunion, kind: program-page, http_status: 200, fetched: '2026-08-13'}
  - {source: https://www.transunion.com/.well-known/security.txt, kind: security.txt, http_status: 403, fetched: '2026-08-13'}