Bug bounty program · HackerOne
Coalition, Inc.
Most upvoted reports2
- #315838ValidNon-Cloudflare IPs allowed to access origin serversCoalition, Inc. · Misconfiguration and Insecure Design · 2018–26votes
- #315512ValidNo authentication on email address for password reset functionality/ https://platform.thecoalition.com/forgot-passwordCoalition, Inc. · Authentication · 2018 · no account (title)–6votes
Subdomains10
2 covered by the program's own scope · 0 first seen this week
10 names
| Name | Scope | First seen |
|---|---|---|
| admin-tools.thecoalition.comadmin | Not in the scope | 2026-11-14 |
| ap.thecoalition.com | Not in the scope | 2026-11-14 |
| api.thecoalition.comapi | In scope | 2026-11-14 |
| bb.thecoalition.com | Not in the scope | 2026-11-14 |
| blog.thecoalition.com | Listed out of scope | 2026-11-14 |
| email.thecoalition.com | Not in the scope | 2026-11-14 |
| files.thecoalition.comdata | Not in the scope | 2026-11-14 |
| help.thecoalition.com | Listed out of scope | 2026-11-14 |
| platform.thecoalition.com | In scope | 2026-11-14 |
| www.thecoalition.com | Listed out of scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.