Oportun · in scope
Web applications
44 assets in scope
Every dot is an asset the program lists in scope. The first 40 are named here; the program's own page has the full scope.
Open Oportun on HackerOneEvery one of the 44 is a mark on the map. Named now: 1 to 26, as listed first.
- api.digit.co
- aplica.oportun.com
- apollo.oportun.com
- apply.oportun.com
- awsqa12.progressfinservices.com
- awsqa13.progressfinservices.com
- awsqa7.progressfinservices.com
- build.jenkins.progressfinservices.com
- callback.oportun.com
- collections.oportun.com
- corp-fileshare.oportun.com
- db-prod-redshift-cluster.oportun.com
- digit-gateway-prod1.oportun.com
- digit.co
- docusign-qa12.progressfinservices.com
- docusign-qa13.progressfinservices.com
- exchange-admin.oportun.com
- help.oportun.com
- http://account.oportun.com/
- https://account.oportun.com/login
- https://account.oportun.com/services
- https://oportun.com
- investor.oportun.com
- kiosk.oportun.com
- loan.oportun.com
- loans.oportun.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.