I originally sent this via the Contact page, but I realized this could be useful to others, so here it goes on Meta. If I get a response to my contact message before a staff member answers here, I can self-answer. If a staff member answers here, that is great too.
Stack Exchange runs a bug bounty program on HackerOne. There are also the Hashcode sites, which are controlled by a staff member (Nic). Hashcode has a physics site and a tourism site. Unfortunately, they are abandoned and are filled with spam.
A staff member commented the following (when asked about those sites):
To clarify here: Stack Exchange has absolutely nothing to do with the maintenance of the Hashcode sites. Outside of Nic working here and keeping the servers up, no other SE employee ever touches those sites, has access to do anything with them, or has any say in what happens to them. This is entirely up to Nic and whatever he wants to do with them.
So it appears that Nic can do whatever he wants with those sites.
Those are not on the list of approved domains for HackerOne.
I'd like to see if I can find any significant vulnerabilities (i.e., like remote server access, not a tiny XSS oops) in those sites (and of course report them to SE). They are controlled by someone at SE, but they aren't listed on the HackerOne page, so I wanted to know if it was all right if I see if I can attempt to break into them.
Bonus: is stackoverflow.co fair game as well?