# Allegion: vulnerability disclosure program on HackerOne

> Allegion is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 26 reports in the 90 days to November 9, 2026, about 0.2 per in-scope asset.

- **Company:** Allegion
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/allegion
- **Pays bounties:** no
- **Submissions:** open
- **Launched:** October 4, 2022
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/allegion

## Payouts and volume

HackerOne's own published figures, captured November 9, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 17 |
| High | not published | 42 |
| Medium | not published | 106 |
| Low | not published | 37 |

- Reports received in the last 90 days: 26 (about 0.2 per in-scope asset)
- Researchers participating: 183
- Response efficiency: 81%
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 132 assets in scope (0 bounty-eligible), 6 out of scope. The policy page is the authority.

- `*.allegion.com` (WILDCARD): in scope, no bounty, max severity critical
- `*.allegionengage.com` (WILDCARD): in scope, no bounty, max severity critical
- `*.isonaspureaccesscloud.com` (WILDCARD): in scope, no bounty, max severity critical
- `*.my-mobilekey.com` (WILDCARD): in scope, no bounty, max severity critical
- `*.yonomi.co` (WILDCARD): in scope, no bounty, max severity critical
- `9500IQ / 2800IQ Senior Swing Series Operators` (OTHER): in scope, no bounty, max severity critical
- `Aero USB RFID Reader` (HARDWARE): in scope, no bounty, max severity critical
- `allegion.ca` (URL): in scope, no bounty, max severity critical
- `Axa Remote 2.0` (HARDWARE): in scope, no bounty, max severity critical
- `BLEGateway (IF-4041)` (HARDWARE): in scope, no bounty, max severity critical
- `brio.com.au` (URL): in scope, no bounty, max severity critical
- `brionz.com` (URL): in scope, no bounty, max severity critical
- `briouk.com` (URL): in scope, no bounty, max severity critical
- `briousa.com` (URL): in scope, no bounty, max severity critical
- `CISA Aero PMS Service (Windows)` (OTHER): in scope, no bounty, max severity critical
- `CISA Reader App (iMac)` (OTHER): in scope, no bounty, max severity critical
- `CISA Reader App (Windows)` (OTHER): in scope, no bounty, max severity critical
- `com.allegion.access.store` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.cisa.openx` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.cisa.openx_key` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.cisa.openxkey` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.cisa.smartaccess` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.freestyle` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.IFkey` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.leopard` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.schlagemobileaccess` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.sense.store` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.stingray` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.teachin` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.allegion.tigershark` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.interflex.key` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `com.my-mobilekey.key4friends` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.schlage.engage` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.schlage.overtur` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.simonsvoss.mobilekey.adminapp` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `com.simonsvoss.mobilekey.key4android` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `Domo Connexa Button` (HARDWARE): in scope, no bounty, max severity critical
- `Encoder 2` (HARDWARE): in scope, no bounty, max severity critical
- `eServer` (HARDWARE): in scope, no bounty, max severity critical
- `eSigno Lock 2` (HARDWARE): in scope, no bounty, max severity critical
- and 98 more on the BugRater page

---

Generated November 9, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.