The safe-harbor scoreboard for the world's biggest companies

“HackerOne GraphQL team(handle:"amazonvrp") returns submission_state:"open", state:"public_mode"; policy text is headed "Amazon Vulnerability Research Program (VRP) - Program Policy (8/13/2026)". Legal Points section: "Limited Safe Harbor. Amazon will not bring any legal action against anyone who makes a good faith effort to comply with this Policy, or for any accidental or good faith violation of this Policy. If you comply with this Policy: 1. Amazon considers your security research to be \"authorized\" and lawful under the U.S. Computer Fraud and Abuse Act (CFAA), U.S. Digital Millennium Copyright Act (DMCA), and similar laws in the United States and other jurisdictions.... 2. Amazon waives any restrictions in its applicable Terms of Service and Acceptable Use Policy that would prohibit your participation in VRP... 3. If legal action is initiated by a third party against you in connection with activities conducted under this Policy, Amazon will take steps to make it known that your actions were conducted in compliance with this Policy." No inbound CVD deadline; the Responsible Disclosure section restricts the researcher instead: "By participating in VRP, you agree not to share publicly or privately any details or descriptions of your findings with any third party." security.txt at both /.well-known/security.txt and /security.txt (text/plain) has "Contact: https://hackerone.com/amazonvrp/reports/new" and "Policy: https://hackerone.com/amazonvrp". Scope note: AWS and subsidiaries (e.g. Twitch, Whole Foods) are out of scope of this parent program; AWS has a separate reporting page at https://aws.amazon.com/security/vulnerability-reporting/ (fetched, 200). Not L5: no commitment that a reported bug will be disclosed after N days.”

“Walmart reserves all legal rights in the event of any non-compliance." Submission is via the form on the same page: "We encourage security researchers to share the details of any suspected vulnerabilities with the Walmart Information Security Team by submitting the form at the bottom of this page." No authorization language, no CFAA/DMCA/ToS carve-out. Disclosure is restricted, not promised: "Public disclosure of the submission details of any identified or alleged vulnerability without express written consent from Walmart will deem the submission as noncompliant with this Responsible Disclosure Policy." New since June (no grade impact): AI-report rules ("We will not accept reports that are generated entirely by automated or AI tools without meaningful human validation").”

“unitedhealthgroup.com/.well-known/security.txt (text/plain) points to the group-wide policy: "Contact: mailto:[email protected]", "Policy: https://www.optum.com/vulnerability.html" (redirects to /en/vulnerability.html). The policy is titled "Vulnerability Reporting Policy" and is explicitly the parent's: "If you have information related to potential security vulnerabilities of UnitedHealth Group, UnitedHealthcare or Optum products or services, we want to hear from you." It has scope (out-of-scope list), a submission channel ("please email [email protected]") and required report contents, so it is a real VDP. No legal commitment of any kind; the reverse: "This policy prohibits the performance of the following activities: Hacking, penetration testing, or other attempts to gain unauthorized access to UnitedHealth Group software or systems; Active vulnerability scanning or testing;..." and "Security researchers must not violate any law". No bounty ("UnitedHealth Group does not offer a bug bounty program"). Disclosure is restricted, no inbound deadline: "UnitedHealth Group requests that security researchers not post or share any information about a potential vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability". Root /security.txt redirects to a 403 HTML page.”

“apple.com/.well-known/security.txt (text/plain, Expires 2027-07-28) has "Contact: https://security.apple.com" and "Policy: https://security.apple.com/bounty/guidelines/". Apple runs its own bounty portal (submission via the web portal after signing in with an Apple Account: "You must be the first party to submit a complete and actionable report directly to Apple through our web portal"). Scope is stated in the Terms: "The Apple Security Bounty program extends to security research covering all Apple products and public-facing services, except research involving any of the following: Apple Pay, Any non-public-facing Apple system, Phishing, social engineering, or similar techniques". No promise not to take legal action and no CFAA/DMCA authorization anywhere in the guidelines or terms; the only legal relief is a license-term carve-out: "A participant in the Apple Security Bounty program will not be deemed to be in breach of applicable Apple license provisions which provide that a user of Apple software may not copy, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of such Apple software, for in-scope actions performed by that participant where... The actions were performed during good-faith security research" (tosCarveout true; not an anti-hacking or DMCA 1201 carve-out). Researchers are also told "You must comply with all applicable laws". Disclosure is restricted, not promised: "you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory". HackerOne handle "apple" is an unclaimed stub (submission_state:null) and does not count. Bugcrowd /engagements/apple 404. Root /security.txt 404.”

“Read 2026-09-17 in a real browser and via the Bug Hunters article endpoint: the Google and Alphabet Vulnerability Reward Program rules define scope ("any Google-owned or Alphabet (Bet) subsidiary web service that handles reasonably sensitive user data is intended to be in scope") and how to report, and the only legal section, "Legal points", ends: "Of course, your testing must not violate any law, or disrupt or compromise any data that is not your own." No statement on that page, the VRP Code of Conduct, the FAQ or the report page promises not to pursue researchers, authorizes testing under anti-hacking law, or waives the DMCA or Google's terms. A real program with scope and intake and no legal commitment is Level 2. security.txt (Policy: g.co/vrp) resolves to the same rules page.”

“Company page "Vulnerability Disclosure Program" (200): "If you see something, say something. In the course of your interactions with our websites, if you notice a security vulnerability, we encourage you to report it by using this page. Your report will be forwarded for timely acknowledgement and verification." The submission form on the page is a Bugcrowd embedded external form (page source references bugcrowd.com/52ad5ce4-cae2-4f8a-bcec-93bc99d0fdc5/external/report and /external/script; that URL returns a Bugcrowd "Submission form" that requires a Referrer from the approved domain), i.e. a Bugcrowd-managed intake with no public /engagements/ brief (cvs, cvshealth, cvs-health, cvs_health, aetna, caremark all 404). Rules of engagement are present ("you should not use the key to test the extent of access it grants or attempt to download or exfiltrate data"; "Cause no harm"). No security.txt: cvshealth.com and www.cvshealth.com return 404 (HTML) at both paths; cvs.com and www.cvs.com return the HTML homepage (200, text/html) at both paths, which is not a security.txt. No disclosure timeline.”

“HackerOne GraphQL team(handle:"berkshirehathaway") returns {"submission_state":null,"state":null,"policy":null} = unclaimed community stub (search-engine title 'Berkshire Hathaway | Response Policy' is the stub SEO title); handles berkshire_hathaway and berkshire do not exist. https://berkshirehathaway.com/.well-known/security.txt and /security.txt both 404 (text/html), same on www. Bugcrowd /engagements/berkshire-hathaway 404. berkshirehathaway.responsibledisclosure.com does not resolve. No security, PSIRT or vulnerability-disclosure page exists on berkshirehathaway.com (site is a static holding-company index; /security.html 404). Web search surfaces only the HackerOne stub and third-party rating pages.”

“Bugcrowd engagement mckesson-vdp-pro (read 2026-09-17) carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research"). McKesson also publishes a coordinated vulnerability disclosure page and a valid security.txt.”

“HackerOne GraphQL team(handle:"exxonmobil") and team(handle:"exxon") both return {"submission_state":null,"state":null,"policy":null} = unclaimed community stubs (web search surfaces 'ExxonMobil | Vulnerability Disclosure Policy' at hackerone.com/exxonmobil, which is that stub); exxon_mobil does not exist. security.txt: https://www.exxonmobil.com/.well-known/security.txt 404 (text/html), /security.txt 403 (text/html WAF); https://corporate.exxonmobil.com/.well-known/security.txt and /security.txt both 302 to the Sitecore 404 page. No vulnerability-disclosure or PSIRT page found on corporate.exxonmobil.com or www.exxonmobil.com (/security, /vulnerability-disclosure, /who-we-are/policy/vulnerability-disclosure all 404). Bugcrowd /engagements/exxonmobil 404; exxonmobil.responsibledisclosure.com does not resolve. The only third-party evidence (Open Bug Bounty report for energyfactor.exxonmobil.com) is a platform notification, not a company channel.”

“Cencora now publishes a 'Responsible security disclosure' page at https://www.cencora.com/responsible-disclosure (200, company-authored, linked from the site footer) with a report form and email: 'If you believe you have found a security vulnerability, report it using the form below. If the form is not available, email [email protected].' Scope: 'This program applies to internet-accessible systems, applications, websites, and services that Cencora owns and operates.' Safe harbor (promissory non-pursuit plus authorization): 'Good-faith safe harbor: Cencora supports security research conducted in good faith and in accordance with this program. When research is consistent with these guidelines, Cencora will consider it authorized for purposes of this program and will not initiate legal action based solely on that research. If a third party initiates legal action, Cencora may clarify that the activity was conducted in accordance with this program. This safe harbor does not authorize activity involving systems or data owned by third parties. It also does not waive any applicable legal rights.' No anti-hacking statute (CFAA), anti-circumvention law (DMCA) or Terms-of-Service exemption is named, so no carve-outs; L3 not L4. Disclosure clause is a restriction, not an inbound deadline: 'Do not publicly disclose a suspected vulnerability until Cencora has had a reasonable opportunity to investigate and address it. Coordinate any proposed disclosure with Cencora in advance.' security.txt: both /.well-known/security.txt and /security.txt on cencora.com and www.cencora.com return 404 text/html. HackerOne cencora, cencora_vdp, amerisourcebergen do not exist; Bugcrowd /engagements/cencora 404; Synack subdomain no DNS.”

“security.txt at https://www.microsoft.com/.well-known/security.txt is 200 text/plain: 'Contact: https://msrc.microsoft.com/report/vulnerability/new', 'Policy: https://www.microsoft.com/en-us/msrc/bounty/', 'Policy: https://www.microsoft.com/en-us/msrc/cvd', 'Policy: https://www.microsoft.com/en-us/msrc/bounty-safe-harbor', 'Expires: 2026-09-23T16:00:00.000Z' (expires six days after this audit; watch for a stale file). Root /security.txt is 404. The listed bounty-safe-harbor URL now 301s to /en-us/msrc/bounty; the safe-harbor text lives at https://www.microsoft.com/en-us/msrc/bounty-guidelines#safeharbor (Terms last updated September 3, 2026): 'Safe Harbor Terms: To encourage research and responsible disclosure of security vulnerabilities, we will not pursue civil or criminal action, or send notice to law enforcement for accidental or good faith violations of Microsoft Bug Bounty Terms and Conditions ("the policy"). We consider security research and vulnerability disclosure activities conducted consistent with this policy to be "authorized" conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as WA Criminal Code 9A.90. We waive any potential DMCA claim against you for circumventing the technological measures we have used to protect the applications in our bug bounty programs' scope.' ToS carve-out: 'If your security research as part of the bug bounty program violates certain restrictions in our site policies, the safe harbor terms permit a limited exemption.' No inbound disclosure deadline; the text restricts the researcher instead: 'we require that Bounty Submissions remain confidential and cannot be disclosed to third parties... We require that detailed proof-of-concept exploit code and details that would make attacks easier on customers be withheld for 30 days after the Vulnerability is fixed' and 'If you impose a fix timeline or Service Level Agreement ("SLA") anytime throughout the case process, you will forfeit your bounty eligibility.' The CVD page (https://www.microsoft.com/en-us/msrc/cvd) describes principles only. Microsoft runs its own MSRC portal, not HackerOne (microsoft, msrc handles do not exist), Bugcrowd /engagements/microsoft 404, no Synack subdomain.”

“JPMC's own page https://www.jpmorganchase.com/about/governance/disclosure-program (200) says: 'If you have found a cybersecurity issue or vulnerability in any of our applications, then we would like to hear from you through our responsible disclosure program. Our responsible disclosure program is managed by our third party vendor who will review and validate cybersecurity issues within the scope of this program.' with a 'See our responsible disclosure program' link to the Synack-hosted portal responsibledisclosure.jpmorganchase.com (the identical text is mirrored at https://www.chase.com/digital/resources/privacy-security/security/vulnerability-disclosure and personalinvesting.jpmorgan.com/legal/responsible-disclosure). The portal's HTML front end is behind a Cloudflare JS challenge (403 to curl and WebFetch) but its Zendesk help-center API served the three articles: 'Scope and ROE' (updated 2022-04-29: 'No Denial of Service testing / No Physical or Social Engineering / No testing of Third-party Services... If able to gain access to a system, accounts, users, or user data, stop at point of recognition and report.'), 'Terms of Service' (updated 2019-08-14) and 'Recognition for Responsible Disclosures' (updated 2026-06-22, live hall-of-fame, so the program is active). The only non-pursuit language is made by the vendor, not JPMC: 'Synack commits that, if we conclude, in our sole discretion, that a security vulnerability submitted through the Site complies with the Terms of Use and the applicable JPMorgan Chase Responsible Disclosure Guidelines, Synack will not bring a private action against you or refer the matter for public inquiry.' Per the platform-boilerplate rule this is not a company commitment, no authorization is granted, and no CFAA/DMCA/ToS carve-out appears anywhere, so graded L2 (real VDP with scope and submission path). HackerOne jpmorgan, jpmorganchase, jpmc, jpmorgan_chase, chase do not exist; Bugcrowd /engagements/jpmorganchase and /jpmc 404.”

“HackerOne GraphQL team(handle:"costco") returns submission_state:"open", state:"public_mode" (real program, not a stub). Company-authored policy text, section '# Safe Harbor': "We do not intend to assert claims under computer abuse laws for activities conducted in a manner consistent with this policy. We cannot bind third parties or authorize activities on third party products, but if legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy." Disclosure Policy restricts the researcher: "Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Costco." (not an inbound CVD deadline). security.txt: https://www.costco.com/security.txt is 200 text/plain with 'Contact: https://hackerone.com/costco/reports/new' and 'Policy: https://hackerone.com/costco'; /.well-known/security.txt is 404 HTML.”

“Contact: "Disclosures may be made to: [email protected]" with PGP fingerprint 1032 993A B76C 4C63 FAF0 8DAC 605B 84FA CBD8 0994. Promissory non-pursuit: "We will not pursue legal action against you if you act in good faith when conducting your research, comply with these Guidelines, do not engage in any illegal conduct, do not attempt to harm Cigna Healthcare, or our subsidiaries, affiliates, clients, members, partners, or others, or otherwise infringe or misuse Cigna Healthcare property." Inbound disclosure timeline: "Please provide us a minimum of 90 days from the date we acknowledge receipt of your disclosure to review and remediate reported issues. After this 90 day period, you may publicly disclose your research around the vulnerability, with the exception of any personally identifiable information or protected health information which must at all times remain confidential even after remediation." (Note the later sentence 'Only publicly disclose vulnerabilities after remediation in compliance with these Guidelines' partly qualifies the 90-day right.) No CFAA/DMCA/ToS carve-out language and no explicit authorization to test. Response target: acknowledge within seven (7) business days. No security.txt on cigna.com or thecignagroup.com (thecignagroup.com returns the HTML homepage for both paths). HackerOne 'cigna' is an unclaimed stub (submission_state:null).”

“Company page 'Coordinated Vulnerability Disclosure (CVD)' under /en/support/: "Cardinal Health collects vulnerability reports through a formal Coordinated Vulnerability Disclosure (CVD) process to improve cyber security and protect sensitive information throughout the product lifecycle." Submission: "Please report a potential cyber security vulnerability in Cardinal Health supported medical devices by sending an email to [email protected]. Please use suitable encryption tools, to protect any sensitive details." Scope is connected medical devices only: "Any reports submitted which are not related to potential medical device security vulnerabilities in supported products will be forwarded to the appropriate product team." Researcher guidelines include "Provide us a reasonable amount of time to resolve the issue before disclosing it publicly" (a restriction on the researcher, not an inbound deadline). No legal-action, safe-harbor, authorization, CFAA, DMCA, or ToS language anywhere on the page, so L2 (real VDP: scope + how to submit, no legal commitment). READ CAVEAT: www.cardinalhealth.com resets the HTTP/2 stream for curl and WebFetch timed out, so the page text was read from the Wayback raw capture of 2025-12-11 (https://web.archive.org/web/20251211042345id_/https://www.cardinalhealth.com/en/support/coordinated-vulnerability-disclosure.html); the live URL is corroborated by a current search-index title ('Coordinated Vulnerability Disclosure (CVD)') but was not fetched live from this host. HackerOne 'cardinal_health' is an unclaimed community stub (submission_state:null); 'cardinalhealth' not found. No security.txt reachable (Wayback has a 404 for /.well-known/security.txt; live host unreachable).”

“NVIDIA PSIRT report page (https://www.nvidia.com/en-us/security/report-vulnerability/, HTTP 200): "To report a potential security vulnerability in any NVIDIA product: Vulnerability Disclosure Program: Report a Security Vulnerability or NVIDIA Artificial Intelligence (AI) Concern, or Send email to: NVIDIA PSIRT" (mailto:[email protected], PGP key page linked); the VDP link is https://app.intigriti.com/company/programs/nvidia/nvidiavdp/detail and "Does NVIDIA have a bug bounty program? Yes" links https://app.intigriti.com/company/programs/nvidia/nvidiapublicbugbounty/detail. PSIRT Policies page (Updated: February 2022): "NVIDIA strives to follow Coordinated Vulnerability Disclosure (CVD)... After an update or mitigation information is publicly released by NVIDIA, the reporter is welcome to discuss the vulnerability publicly." (no inbound day-count deadline). Intigriti program JSON (https://app.intigriti.com/api/core/public/programs/nvidia/nvidiavdp, handle nvidiavdp, public detail page title 'NVIDIA Vulnerability Disclosure Program') carries NVIDIA-authored Rules of Engagement: "You did not and will not violate any applicable law or regulation, including laws prohibiting unauthorized access to information. NVIDIA does not consider testing that is done in compliance with the terms and conditions of this Bug Bounty Program as unauthorized." That is an explicit authorization of in-scope testing (testingAuthorized) but there is no promissory non-pursuit sentence and no CFAA/DMCA/ToS carve-out named; the Intigriti 'Safe harbour for researchers is applied' badge is platform chrome and is not counted. HackerOne 'nvidia' is an unclaimed stub (submission_state:null).”

“JS-rendered, read via two independent WebFetch renders that agreed verbatim). Authorization + CFAA: "We consider these terms to provide you authorization, including under the Computer Fraud and Abuse Act (CFAA) and similar applicable laws and/or regulations, to test the security of the products and systems identified as in-scope below." Non-pursuit: "If Meta determines in its sole discretion that you have complied in all respects with these Meta Bug Bounty terms in reporting a security issue to Meta, we will not initiate a complaint to law enforcement or pursue a civil action against you." and "Meta will also not pursue legal action against you for clear accidental or good faith violations of its policy or these terms." DMCA: will not pursue "DMCA claims against you for circumventing the technological measures we have used to protect the applications in scope." ToS: "To the extent activities authorized by these Meta Bug Bounty terms are inconsistent with other terms of service for in-scope Meta technologies and programs, we waive those restrictions for the limited purpose of permitting security research under this policy." Disclosure: "You give us reasonable time to investigate and mitigate an issue you report before publicly disclosing" (no N-day inbound deadline, so cvdTimeline false). security.txt: www.facebook.com/.well-known/security.txt and /security.txt are 200 text/plain with 'Contact: https://www.facebook.com/whitehat/report/', 'Policy: https://bugbounty.meta.com/' and Expires 2026-10-17; www.meta.com/.well-known/security.txt also returns text/plain with the same body but prefixed by an inline <script> block, so the facebook.com copy is cited as the clean file. Per trap (e) Meta is graded on bugbounty.meta.com, not HackerOne (no 'meta'/'facebook' H1 team exists).”

“No vulnerability-disclosure channel found on elevancehealth.com, anthem.com or carelon.com. security.txt: www.elevancehealth.com /.well-known/security.txt and /security.txt both redirect to /errors/404 (HTML); www.anthem.com both paths 404 HTML; www.carelon.com/.well-known/security.txt 404. www.anthem.com/security/ returns 200 but is a member-portal navigation shell with no vulnerability, researcher, or security-contact text; www.elevancehealth.com/security is 403; /responsible-disclosure, /vulnerability-disclosure, /security-vulnerability-reporting are 404; homepage, /legal and /contact-us contain no security-reporting text. HackerOne: elevancehealth, elevance, elevance_health, elevancehealth_vdp, anthem, anthem_inc, carelon all 'Team does not exist'. Bugcrowd /engagements/elevancehealth, elevance-health, anthem all 404. Web search for Elevance/Anthem responsible disclosure returns only breach coverage, no policy.”

“Centene's only channel is its HackerOne program, centene_vdp. On 2026-09-17 HackerOne reports the program as disabled (not accepting submissions). The published policy still says research under it is "authorized conduct" and that Centene "will not initiate legal action", but with intake closed the level is shown as unverified until the program reopens.”

“Bank of America's own Security Center page (web.bankofamerica.com/en/security/report-suspicious-activity, JS-rendered; text read via WebFetch, not visible in raw curl HTML) states: "If you think there's a potential security issue on any Bank of America product, email [email protected] and include: Your contact information. A general description of the issue. Don't include specific details until Bank of America has established a secure connection with you." This is a published vulnerability-reporting contact with no policy document, scope, safe harbor, or legal language, so L1 contact_only. No security.txt (/.well-known/security.txt 404 empty; /security.txt 404 HTML error page). HackerOne handle bofa is an unclaimed stub (submission_state:null); bankofamerica / bank_of_america do not exist. No Bugcrowd /engagements/bankofamerica (404). No Synack subdomain.”

“HackerOne handle chevron is an unclaimed community stub: GraphQL returns submission_state:null, state:null, policy:null (chevron_vdp does not exist). Chevron's own cybersecurity page (chevron.com/who-we-are/culture/operational-excellence/cybersecurity) describes internal practice only ("Managing vulnerabilities: we create automated threat intelligence feeds from security experts to increase vulnerability awareness") with no reporting channel. The contact page's only email, [email protected], is labelled "Contact: Supplier inquiry", not security. security.txt at both paths returns 404 HTML ("The resource you are looking for has been removed"). No Bugcrowd /engagements/chevron (404). No Synack subdomain.”

“HackerOne GraphQL for handle ford: submission_state:"open", state:"public_mode". Policy text, section "# Safe Harbor": "Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy." Rules section adds: "Although Ford will not retaliate against legitimate participants who comply with the Coordinated Disclosure Guidelines, we cannot represent the position of other entities, such as law enforcement or other copyright owners." No CFAA/DMCA/ToS named. Disclosure Policy is restrictive, not an inbound deadline: "Ford reserves the right to approve or deny any request for disclosure. Disclosing vulnerability information without Ford approval may result in a program ban." Response targets (first response 2 business days) are an SLA, not CVD. No security.txt (ford.com both paths 301 to www.ford.com then HTML 'resource removed'). corporate.ford.com timed out under curl (WAF), not needed for grade.”

“GM's own page https://www.gm.com/cybersecurity links the program: "To report a vulnerability concern, submit it here" (href https://hackerone.com/gm?type=team) and "To report a security concern, send an email to [email protected]." HackerOne GraphQL for handle gm: submission_state:"open", state:"public_mode". Policy text, "Safe Harbor": "GM agrees not to pursue civil action against researchers who comply with General Motors' and HackerOne's policies regarding the VDP. We consider activities conducted consistent with the GM Policy Terms to constitute "authorized" conduct under the Computer Fraud and Abuse Act. Also, if you comply with the GM Policy Terms, we will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope." and "If legal action is initiated by a third party against you and you have complied with the GM Policy Terms, we will, if asked, state that your actions were conducted in compliance with this policy." Explicit CFAA authorization and DMCA carve-out; no ToS carve-out language. Disclosure clause is restrictive, not an inbound deadline: "Participants must not publicly disclose vulnerability details until after GM confirms completed remediation of the vulnerability." No security.txt (both paths 404 to gm.com 404.html).”

“Citi now publishes its own page https://www.citi.com/reporting-vulnerability ("Citi's Cyber Security Disclosure Programs": "To report a vulnerability using BugCrowd's platform, please click here [https://bugcrowd.com/engagements/citi]. To report a vulnerability using HackerOne's platform, please click here [https://hackerone.com/citi_group?type=team]. Bugcrowd https://bugcrowd.com/engagements/citi still returns 200 with title "Vulnerability Disclosure: Citi's Responsible Disclosure Program - Bugcrowd" (Bugcrowd brief JS-rendered, badge unread). HackerOne policy text is a real VDP with rules and scope but carries NO legal commitment; it says the opposite: "Please note that this program should not be construed as encouragement or permission to perform any of the following activities: Hack, penetrate or otherwise attempt to gain unauthorized access to Citi software or systems in violation of applicable law... Citi does not waive any rights or claims with respect to such activities." Same sentence appears on the citi.com page. Disclosure: "This engagement does not allow disclosure. You may not release information about vulnerabilities found in this engagement to the public." (restrictive, not CVD). The H1 handle citi (no suffix) is an unclaimed stub (submission_state:null). No security.txt on citi.com or citigroup.com (all four paths 404 HTML). Policy URL switched from the JS-rendered Bugcrowd brief to the readable HackerOne policy; Bugcrowd remains a valid parallel channel.”

“No vulnerability-reporting channel found anywhere. https://www.homedepot.com/.well-known/security.txt and /security.txt both return HTTP 404 with an HTML 404 page (no security.txt). HackerOne GraphQL for handles homedepot, home_depot, homedepot_vdp, thehomedepot all return 'Team does not exist' (not even a stub). bugcrowd.com/engagements/homedepot and /engagements/home-depot return 'Resource not found 404'. homedepot.responsibledisclosure.com does not resolve. Candidate own-site paths (/c/security, /c/privacy-security, /c/report-security-vulnerability, /c/vulnerability-disclosure) return 403 error pages; corporate.homedepot.com/security and /page/cybersecurity return 404. The live Privacy and Security Statement (https://www.homedepot.com/privacy/privacy-and-security-statement) lists only [email protected] and [email protected], both privacy-request contacts, with no vulnerability-reporting language. Corroborating press: TechCrunch 2025-12-12 reported a researcher could not reach Home Depot about an exposed GitHub token because it 'does not have a way to report security flaws, such as a vulnerability disclosure or bug bounty program'. Wayback CDX was offline during this pass, so historical URLs could not be swept.”

“Fannie Mae has a first-party 'Reporting Technology Vulnerability' page with a submission form, but no legal commitment of any kind. Policy text: 'If you believe you have found a security vulnerability on any of our sites or applications, we encourage you to report it as described below so that our teams can investigate the matter.'... 'Any potential or real instances of security vulnerabilities should be reported to Fannie Mae's Information Security team.'... 'We will take your security vulnerability report under advisement but may not contact you in response or otherwise keep you apprised of the validity of the vulnerability you reported. We may share your security vulnerability report with law enforcement agencies or other industry participants that may be affected by the vulnerability.' No safe-harbor, no authorization to test, no CFAA/DMCA/ToS carve-out, no disclosure timeline; the only law-enforcement mention is the org reserving the right to share reports with it. Grading L2 (scope = 'any of our sites or applications', how to submit = form; no legal commitment). CAVEAT: the live page returns HTTP 403 to non-browser clients (WAF); the text above was read from the Wayback raw snapshot of 2026-05-11 (https://web.archive.org/web/20260511020037id_/https://www.fanniemae.com/about-us/reporting-technology-vulnerability) and matches the Google-indexed description of the live page. HackerOne handle 'fanniemae' exists but submission_state:null (unclaimed community stub, does not count). No security.txt (404 HTML on both paths). No Bugcrowd /engagements/ (fanniemae, fannie-mae both 404). Synack host does not resolve.”

“Bugcrowd engagement kroger-vdp (read 2026-09-17) carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research"). Kroger's policy text: "research conducted in good faith and in compliance with this Policy to be authorized conduct and we will not initiate legal action against you for such security research". Kroger's security.txt points to the program.”

“Verizon's own 'Report Security Vulnerability' page is live (HTTP 200) and gives a reporting channel with an explicit anti-authorization statement: 'Verizon does not endorse, solicit, or request independent testing of Verizon services and products for security vulnerabilities. Additionally, all use of our products, services, and externally-accessible sites and applications must follow all of our Terms and Conditions, as well as all applicable laws and regulations.'... 'Verizon cannot respond to every reported instance, but we will make a concerted effort to investigate each one and act where appropriate. Confidentiality is very important to Verizon and as such we will keep all information related to any disclosure confidential. In order to protect customer privacy, Verizon does request that you not post or share information about a potential and unverified vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability.' Contacts on the page: [email protected] (products/services), [email protected] (residential FiOS/DSL; also named in https://github.com/verizon/cve), [email protected]. No promissory non-pursuit, no authorization (the opposite), no CFAA/DMCA/ToS carve-out (ToS compliance is a constraint). The github.com/verizon/cve README's '90 days' clause is an OUTBOUND policy for bugs Verizon finds in suppliers' products, not an inbound commitment, so cvdTimeline stays false. The 'no disclosure until we have addressed it' clause is a researcher restriction, not an L5 signal. Graded L2 (real first-party VDP with scope + how to submit, no legal commitment). HackerOne 'verizon-wireless' handle exists with submission_state:null (unclaimed stub); verizon, verizon_vdp, verizonmedia, verizonbusiness do not exist. Yahoo/Verizon Media is a former subsidiary and not graded here. No security.txt: /.well-known/security.txt 404, /security.txt redirects to the homepage. No Bugcrowd /engagements/ (verizon, verizon-vdp 404). Synack host does not resolve.”

“GraphQL team(handle:"phillips66co") returns submission_state:null, state:null, policy:null, and the page's own meta description is class 'spec-external-unclaimed': 'This community-curated security page documents any known process for reporting a security vulnerability to Phillips 66...'. Per trap (a) a stub is found:false/L0. Handles phillips66 and phillips66_vdp do not exist. phillips66.com: /.well-known/security.txt and /security.txt both 404 (HTML); candidate pages /security, /cybersecurity, /report-a-vulnerability, /vulnerability-disclosure all return 'Page not found - Phillips 66'; the privacy statement (https://www.phillips66.com/privacy-statement/) offers only the general contact form and 800.527.5476, no security contact. bugcrowd.com/engagements/phillips66 and /phillips-66 return 404. phillips66.responsibledisclosure.com does not resolve. Note: search results for this company are polluted by Philips (Koninklijke Philips) disclosure pages, which are a different company. Wayback CDX was offline during this pass.”

“No disclosure channel found on any platform: HackerOne handles marathonpetroleum, marathon_petroleum, marathonpetroleum_vdp, mpc all 'Team does not exist'; bugcrowd.com/engagements/marathonpetroleum, /marathon-petroleum, /mpc all 404; marathonpetroleum.responsibledisclosure.com does not resolve. www.marathonpetroleum.com serves a Cloudflare 'Just a moment...' challenge (HTTP 403) to every non-browser request including both security.txt paths and the corporate Computer Security policy PDF, so the live site could not be read directly. Wayback raw snapshot of /.well-known/security.txt (2023-11-23) is the site's own '404 - Page Not Found' page; the 2026-08-20 Wayback snapshot of the Privacy Policy (https://web.archive.org/web/20260820025758id_/https://www.marathonpetroleum.com/Privacy-Policy/) contains no vulnerability-reporting or security-contact language (only 'how you can contact us about our privacy practices'). Web search surfaces only generic customer-relations addresses ([email protected]) and the internal MPC Policy 6004 Computer Security governance document, not a VDP. Wayback CDX was also offline this pass.”

“StoneX now publishes a named 'StoneX Responsible Disclosure Program' section on its Security & Fraud page with a HackerOne submission channel. Page text: "At StoneX, cybersecurity is fundamental to our operations. If you believe you have discovered a vulnerability affecting StoneX or our users, please report it promptly. We will investigate all valid submissions and address issues as quickly as possible. We ask that you adhere to StoneX's Vulnerability Disclosure Policy and HackerOne's Disclosure Guidelines, and make a good faith effort to avoid privacy violations, data disruption, or service degradation during your research."... "StoneX uses HackerOne to triage and validate responsibly disclosed vulnerability reports. Please submit your report." The 'Submit a Vulnerability' link is a HackerOne embedded_submissions form (UUID 5d52f1b8-...; returns HTTP 200 text/html from hackerone.com), i.e. a private/embedded program, not a public HackerOne team page (no public handle found: stonex, stonex_group, stonexgroup, stonex-group, stonex_vdp, intlfcstone, gaincapital, forexcom, cityindex all 'Team does not exist'; GraphQL embedded_submission_form(uuid) returns null unauthenticated). The referenced 'StoneX's Vulnerability Disclosure Policy' is NOT hyperlinked and was not locatable on stonex.com (site:stonex.com search only returns this page), so no scope statement and no legal/safe-harbor language was readable anywhere: graded L2 on the readable company-authored program page (named program + submission process + conduct rules) with the caveat that the fuller VDP document, if it exists inside the HackerOne form, was unread. security.txt at /.well-known/security.txt is valid text/plain: 'Contact: mailto:[email protected] / Encryption: https://www.stonex.com/.well-known/itsecurity.pgp / Preferred-Languages: en / Hiring:...' (no Policy: line, no Expires: line). Root /security.txt redirects to /en/security.txt/ and returns a Cloudflare 403 HTML page (not a security.txt). Note stonex.com is behind a Cloudflare JS challenge for curl; the policy page was read via WebFetch (both /en/ and /en-us/business/ variants carry the identical section).”

“State Farm publishes a company-authored 'Vulnerability Disclosure Policy' page. Promissory non-pursuit: "As long as you comply with this policy in disclosing information security issues to State Farm, State Farm will not take legal action against you or revoke access to State Farm applications." immediately followed by "State Farm takes information security seriously. We reserve all legal rights in the event of noncompliance." Scope: "If you have noticed an information security issue in a State Farm system while using www.statefarm.com or a State Farm mobile application, we want to hear about it." Submission: "Please disclose issues using the Vulnerability Disclosure Communication form located on this web page. For scoring, please follow Bugcrowd's vulnerability taxonomy". No explicit authorization to test and no CFAA/DMCA/ToS carve-outs; the Your Commitment section is conduct restrictions ("you agree not to compromise State Farm information or State Farm Information systems"). Disclosure clause restricts the researcher, not an inbound CVD deadline: noncompliance includes "Disclosure of an Information Security issue publicly (e.g. on social media) without the written consent of State Farm." -> L3. security.txt is valid text/plain at /.well-known/security.txt (root /security.txt redirects to it): '# State Farm Secure Vulnerability Disclosure / Contact: https://bugcrowd.com/statefarm-esf / Policy: https://www.statefarm.com/customer-care/privacy-security/security/vulnerability-disclosure-policy / Preferred-Languages: en / Canonical: https://www.statefarm.com/.well-known/security.txt' (no Expires: line). Bugcrowd: https://bugcrowd.com/statefarm-esf 301s to https://bugcrowd.com/engagements/statefarm-esf which returns 200 with title 'Vulnerability Disclosure: State Farm VDP - Bugcrowd', a real public engagement (not the catch-all). HackerOne: statefarm / state_farm / state-farm do not exist.”

“Bugcrowd engagement freddie-mac-vdp-ess (read 2026-09-17) carries Bugcrowd's "Partial safe harbor" tier ("This engagement provides a limited goodwill statement about not pursuing legal action related to security research"). Freddie Mac's own Vulnerability Disclosure Policy page gives scope and an intake address and adds no legal commitment of its own ("We do not authorize any activities that violate applicable laws").”

“The only channel is a root-path security.txt at https://www.humana.com/security.txt (200, Content-Type text/plain; charset=UTF-8): 'Contact: mailto:[email protected] / Expires: 2026-01-01T04:59:00.000Z / Preferred-Languages: English / Hiring: https://careers.humana.com/'. Note the file is STALE per RFC 9116: its Expires date (2026-01-01) passed eight months ago, and it carries no Policy: line. /.well-known/security.txt returns 404 HTML; bare humana.com (no www) does not answer (connection failure). No policy page exists: /legal/responsible-disclosure, /legal/vulnerability-disclosure-program and /legal/security all return HTTP 200 with the same 244 KB SPA shell as a made-up path (/legal/zzz-nonexistent-page also 200), and when rendered every one of them shows 'There was a problem on our end' (soft 404); /responsible-disclosure, /vulnerability-disclosure, /bug-bounty, /security are hard 404s; the /legal index page lists no security or disclosure link; Wayback has never archived those /legal/ paths. Despite the mailbox being named 'bugbounty', no bug bounty or VDP program is published anywhere: HackerOne humana / humana_vdp do not exist, Bugcrowd /engagements/humana 404, Synack humana.responsibledisclosure.com no DNS. Contact only, no policy document -> L1.”

“HackerOne GraphQL team(handle:"att") returns submission_state:"open", state:"public_mode", with a 14 KB company-authored policy: "#AT&T Bug Bounty Program Policy... We now use a pay per vulnerability model and utilize the HackerOne platform!" Scope: "The Program applies to security vulnerabilities found within AT&T's Environment, which includes, but is not limited to, AT&T's websites, exposed APIs, mobile applications, and devices." Focus assets listed (att.com/msapi, att.com/buy/, signin.att.com, identity.att.com, myATT apps). Recent update dated 5/28/26 (IDE-extension confusion exclusion) shows the policy is maintained. NO safe harbor of any kind: the Terms and Conditions contain only constraints, e.g. "You must comply with the Program and abide by the law." and "You may only exploit, investigate, or target vulnerabilities against your own accounts. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours". No non-pursuit promise, no authorization language, no CFAA/DMCA/ToS carve-out. Disclosure is researcher-restricting, not an inbound CVD deadline: "you affirm that you have not disclosed and agree that you will not disclose the vulnerability or your submission to anyone other than AT&T... Also notes DIRECTV assets out of scope (report to [email protected]) and LevelBlue assets out of scope (own VDP). No company-hosted policy: bugbounty.att.com no longer resolves (NXDOMAIN); att.com/legal/vulnerability-disclosure and /legal/terms.bugBountyProgram.html are the Legal Policy Center catch-all (title 'Terms of Service'), not a VDP; about.att.com and cybersecurity.att.com return 403. No security.txt: /.well-known/security.txt and /security.txt both 404 on www.att.com.”

“HackerOne GraphQL team(handle:"goldmansachs") returns submission_state:"open", state:"public_mode", with a 28 KB company-authored bug bounty policy: "Maintaining the security of our applications and networks is a high priority for Goldman Sachs. If you have information related to security vulnerabilities of GS products and services, please submit a report in accordance with the guidelines below." Scope is expressed via program rules, mobile guidance and an out-of-scope list (SDTO rewards reference *.gs.com, *.marcus.com, *.goldman.com, *.gsam.com); rewards up to $2000 MVH bonuses, 2026 Q1 MVH recognition listed (policy actively maintained). The Legal section contains constraints only, no safe harbor: "You must comply with all applicable Federal, State, and local laws in connection with your security research activities or other participation in this vulnerability disclosure program." and "Your testing must not violate any law, or disrupt or compromise any data that is not your own." Explicit NON-authorization for third-party hosts: "Goldman Sachs does not authorize testing on any applications that are hosted by 3rd parties." No non-pursuit promise, no CFAA/DMCA/ToS carve-out. Public Disclosure Policy is researcher-restricting, not an inbound CVD deadline: "Goldman Sachs will not be publicly disclosing reports at this time... Goldman Sachs reserves the right to deny any request for public disclosure. If a hacker publicly discloses without consent, they run the risk of a program ban." -> L2. Contact email in policy: [email protected] (for PII/scope questions). goldmansachs.com hosts no VDP: /security is a 'Security & Fraud Awareness' consumer page with no vulnerability-reporting text; /privacy-and-security has no HackerOne or disclosure mention; /responsible-disclosure, /vulnerability-disclosure 404. No security.txt: both paths 404 HTML on www.goldmansachs.com.”

“Bugcrowd engagement comcastvdp, the Comcast Xfinity Vulnerability Disclosure Program (read 2026-09-17), carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research"). Scope: "all the technologies, products, and services that Comcast Xfinity and Comcast Business provides".”

“Wells Fargo's responsible disclosure page now routes to its HackerOne bug bounty program, wellsfargo-bbp (open; policy read 2026-09-17): "We consider Good Faith Security Research to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Service ("TOS") and/or Acceptable Use Policies ("AUP") that conflicts with the standard for Good Faith Security Research outlined here"; "Will not bring legal action against you or report you for Good Faith Security Research, including for bypassing technological measures we use to protect the applications in scope". The Computer Fraud and Abuse Act is not named. Public disclosure is not permitted without consent.”

“Company page https://www.morganstanley.com/vulnerability-disclosure (HTTP 200, 'How to Report a Site or Security Vulnerability'): 'If you have found a cybersecurity issue or vulnerability in any of our applications, then we would like to hear from you through our responsible disclosure program. Our responsible disclosure program is managed by our third party vendor who will review and validate cybersecurity issues within the scope of this program.' It links to https://morganstanley.responsibledisclosure.com (Synack). The page explicitly withholds safe harbor: 'Morgan Stanley does not waive any rights or claims with respect to activities that are in violation of the law or could be interpreted as such.' Synack program (live host resolves to morganstanleyrd.zendesk.com; direct curl gets a Cloudflare 403 challenge; read via Wayback raw snapshot 2026-08-07): 'Welcome to Morgan Stanley Responsible Disclosure Powered by Synack. Security vulnerabilities may be submitted in connection with the applications of Morgan Stanley and its affiliated businesses, including those of E*TRADE, Shareworks, and Eaton Vance.' Scope listed ('OWASP Top 10 vulnerability categories', out of scope 'Theoretical vulnerabilities', 'Self XSS'), rules ('Not to engage in disruptive testing like DoS', 'You are not entitled to compensation'), and a conditional disclosure allowance 'you will be allowed to disclose the vulnerability after a fix has been issued' (permission-gated, not an inbound deadline). No 'will not take legal action', no authorization, no CFAA/DMCA/ToS carve-out anywhere: real VDP with scope + submission path but no legal commitment = L2. HackerOne 'morganstanley' is an unclaimed stub (submission_state null). security.txt: /.well-known/security.txt 404 (also 404 in Wayback), /security.txt 403 HTML.”

“No vulnerability disclosure channel found on any surface. valero.com returns its 'Valero 404' page for /security, /responsible-disclosure, /vulnerability-disclosure and /cybersecurity; /.well-known/security.txt and /security.txt both 404. The contact page (https://www.valero.com/contact-us, HTTP 200) lists only Careers@, CommunityRelations@, CustomerSupport@, SupplyChainAdmin@, cscredit@, mediarelations@, valeropayplus@ and [email protected], with no security or abuse address and no mention of 'vulnerability', 'responsible disclosure' or 'bug bounty'. HackerOne: 'valero' and 'valero_energy' do not exist, 'valeroenergy' is an unclaimed stub (submission_state null). Bugcrowd /engagements/valero, /valeroenergy, /valero-energy all 404. valero.responsibledisclosure.com does not resolve. Web search for Valero vulnerability disclosure returns only ESG/guiding-principles PDFs.”

“Dell Vulnerability Response Policy (read 2026-09-17): reports can be sent "directly to the Dell PSIRT via email" at [email protected], and "Dell will strive to acknowledge your vulnerability disclosure report within three (3) business days of receipt." The policy makes no statement about legal action or authorization of research. Dell runs two Bugcrowd engagements: dell-com is open with no safe-harbor tier; dell-product carries the "Partial safe harbor" tier but is currently paused, so it is not counted.”

“Company page https://security.target.com/vdp/ ('Report a Security Vulnerability - Security & Fraud - Target', HTTP 200): 'To report a potential security vulnerability in any of Target's guest-facing online services, please submit the details below for our security teams to review and investigate.' Submission is an embedded HackerOne-powered form on Target's own page ('By clicking submit you agree to the HackerOne Terms and Conditions. If you do not agree to the HackerOne Terms and Conditions you may submit your information to [email protected].'); there is no public HackerOne team ('target', 'target_vdp', 'targetcorp' do not exist). Safe harbor section: 'Target will not take legal action against you related to any activities conducted in a manner consistent with this Policy and otherwise in good faith. Target reserves all of its legal rights in the event of noncompliance with this policy.' That is a promissory non-pursuit (L3): the word 'authorized' appears only as 'request authorization to continue testing' and 'public disclosure of vulnerabilities will only be authorized after the vulnerability has been addressed and requires the express written consent of Target', which are constraints, not a grant of testing authorization; no CFAA/DMCA/ToS carve-out. Disclosure: 'Do not publicly disclose or share potential or confirmed vulnerability details without the written permission of Target.' so cvdTimeline false. security.txt: www.target.com, corporate.target.com and security.target.com all return HTML 404 on both paths. Bugcrowd /engagements/target 404 (the Bugcrowd 'kmartaustralia-vdp-pro' engagement is Kmart Group / Target Australia, an unrelated Wesfarmers company, not this Target).”

“tesla.com/legal/security (read 2026-09-17): "we will not take legal action against you nor ask law enforcement to investigate you provided you comply with the following Responsible Disclosure Guidelines"; "Tesla considers that a pre-approved, good-faith security researcher who complies with this policy to access a computer on a research-registered vehicle or energy product has not accessed a computer without authorization or exceeded authorized access under the Computer Fraud and Abuse Act ("CFAA")"; "Tesla will not bring a copyright infringement claim under the Digital Millennium Copyright Act ("DMCA") against a pre-approved, good-faith security researcher who circumvents security mechanism". No waiver of Tesla's terms of service. Researchers are asked to give "a reasonable time" before going public; there is no published disclosure deadline.”

“HackerOne GraphQL team(handle:"disney") returns submission_state:"open", state:"public_mode". Company-authored policy text: 'If we conclude, in our sole discretion, that you have complied with the requirements of the TWDC Program when reporting a security vulnerability, TWDC will not pursue claims against you in response to your report.' That is a promissory non-pursuit, not an authorization: the rules require researchers to 'not violate any law' and 'not publicly disclose or share vulnerability details without the written permission of TWDC', and 'Violation of any of these rules... may also result in TWDC taking further action, including but not limited to, bringing legal claims, against you.' No CFAA/DMCA/Terms carve-out language anywhere in the policy; the only Safe Harbor chrome would be HackerOne boilerplate, which does not count. No inbound disclosure deadline (only response SLAs: 'Time to first response... Five (5) business days', 'Time to triage... Ten (10) business days'). security.txt: disney.com and thewaltdisneycompany.com both 404 HTML at /.well-known/security.txt and /security.txt. No company-hosted policy page found; thewaltdisneycompany.com/contact-us does not carry one. Bugcrowd /engagements/disney 404. Synack disney.responsibledisclosure.com no connection.”

“J&J's own 'Coordinated Vulnerability Disclosure Program' page (jnj.com/coordinated-vulnerability-disclosure-statement, JS-rendered, read via WebFetch): scope is 'security vulnerabilities identified in Johnson & Johnson's infrastructure, websites, public-facing APIs, and applications'; submission: 'To voluntarily submit a potential vulnerability, please contact us via [email protected]'; 'We will acknowledge receipt of your report within 3 business days'; 'In all instances, we expect that the security researcher will act in good faith, without malicious intent, and report discoveries in a timely fashion.' The only legal language is restrictive: 'this CVD Program should not be understood as permission to perform any of the following' (accessing/retaining personal or proprietary data, exploiting with malicious intent, disrupting operations, violating local law) and 'Your participation is voluntary and does not create any expectation of employment, contractor relationship, or service-related compensation by J&J.' No promise not to pursue legal action, no authorization, no CFAA/DMCA/Terms carve-out, no inbound disclosure deadline: real VDP with scope + intake, no legal commitment = L2. Medical-device reports route via productsecurity.jnj.com/contact-us (separate email, same posture, no safe harbor). HackerOne 'jnj' is an unclaimed STUB (submission_state:null, state:null, policy:null) and does not count. security.txt: both /.well-known/security.txt and /security.txt on www.jnj.com return HTTP 200 text/html (SPA catch-all shell, no Contact: line), so no valid security.txt.”

“HackerOne GraphQL team(handle:"pepsico_vdp") returns submission_state:"open", state:"public_mode". Full company-authored policy read: 'Welcome to the PepsiCo Responsible Disclosure Program!... please report it to us using the "Submit Report" button on this page.' Program Rules cover intake and conduct ('Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.', 'Only interact with accounts you own or with explicit permission of the account holder.', 'No testing of Third-party Services.') plus a Core Ineligible list. Disclosure Policy is a restriction on the researcher: 'Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.' There is NO safe-harbor, no 'will not pursue legal action', no authorization and no CFAA/DMCA/Terms language in the policy text at all; recognition only ('PepsiCo VDP will recognize your finding after a fix has been issued'). The slug 'pepsico' is NOT_FOUND. No company-hosted VDP page on pepsico.com (search returns only privacy/ESG pages). security.txt: www.pepsico.com 404 HTML at both locations. Bugcrowd /engagements/pepsico 404. Synack no connection.”

“Boeing's own 'Vulnerability Handling and Disclosure' page (server-rendered, last modified 2026-08-13 per page metadata): 'If you believe you have found a vulnerability in a Boeing product, system, or asset, please submit the vulnerability information to Boeing through an encrypted email to [email protected]' with a PGP key at /vulnerabilitydisclosure/public-key; 'A Boeing representative will acknowledge receipt as soon as possible, typically within 3 business days.' Safe Harbor & Recognition section, verbatim: 'We consider activities conducted consistent with this policy to constitute authorized access under anti-hacking laws. To the extent your activities are inconsistent with certain Boeing terms and conditions, we waive those restrictions for the limited purpose of permitting security research under this policy. Boeing will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.' That is explicit authorization + an anti-hacking-law carve-out (cfaaCarveout true; the law is named generically as 'anti-hacking laws', not 'CFAA' by name) + a Terms waiver (tosCarveout true). No anti-circumvention/DMCA language (dmcaCarveout false). Disclosure clause is a researcher restriction, not an inbound deadline: 'Provide Boeing reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.' (cvdTimeline false). No bounty ('There is no monetary reward'), Hall of Fame recognition. security.txt: https://www.boeing.com/security.txt is HTTP 200 text/plain with 'Contact: mailto:[email protected]', 'Expires: 2034-08-08T06:59:00.000Z', 'Policy: https://www.boeing.com/vulnerabilitydisclosure', 'Canonical: https://www.boeing.com/security.txt'; the /.well-known/security.txt location is 404 (root-only placement, non-RFC-9116 path). HackerOne 'boeing' is an unclaimed STUB (submission_state:null) and does not count. Bugcrowd /engagements/boeing 404. Synack no connection.”

“HackerOne GraphQL team(handle:"ups") returns submission_state:"open", state:"public_mode". Company-authored Safe Harbor section, verbatim: 'Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.' That is a non-pursuit promise plus a generic 'authorized conduct' statement, but there is no carve-out naming anti-hacking law (CFAA), anti-circumvention law (DMCA) or UPS's own Terms, so it stays L3 rather than L4. Disclosure Policy restricts the researcher, no inbound deadline: 'please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.' Note the text still says 'As this is a private program' although state is public_mode (stale copy, does not affect grade). Response SLAs only (First Response 1 day, Triage 1 day). Slug 'ups_vdp' NOT_FOUND. security.txt: www.ups.com returns Akamai 'Access Denied' HTML (HTTP 200, Content-Type application/blank) at both /.well-known/security.txt and /security.txt to non-browser clients, and the Wayback raw snapshot (2023-06-01) redirects to the UPS 'Page Not Found' error page, so no valid security.txt is evidenced. No company-hosted VDP page found on ups.com. Bugcrowd /engagements/ups 404. Synack no connection.”

“Own-site VDP page 'Report a Vulnerability | RTX' (HTTP 200): "We accept good-faith, responsible reporting of potential security vulnerabilities in any product, system, or asset made by or belonging to RTX or its businesses. If you believe you have found a security vulnerability in a public facing RTX product, system, or asset, please review the vulnerability reporting guidelines and submit the form below." Guidelines are all constraints ("Do not engage in activity that could potentially harm...", "Do not access, exfiltrate, transfer, store, destroy, or otherwise compromise any RTX, customer, supplier, or any third-party data", "Provide RTX reasonable time to resolve any reported issue... before such information is shared with others"). No non-pursuit / legal-action language, no authorization to test, no CFAA/DMCA/ToS carve-out, no inbound disclosure deadline (the 'reasonable time' clause restricts the researcher). GPG key offered; "We will typically acknowledge receipt of your submission within three business days"; "There is no monetary reward or recognition program under this reporting process." Scope + how-to-submit with no legal commitment = L2. hackerone.com/rtx exists but GraphQL returns submission_state:null (unclaimed stub, does not count). No security.txt: rtx.com and www.rtx.com both 404 (HTML) at /.well-known/security.txt and /security.txt.”

“FedEx's own trust-center page 'FedEx Vulnerability Disclosure Program' (HTTP 200) says: "The assessment and validation of disclosed issues are conducted through our trusted third-party security partner. Access our Vulnerability Disclosure Program, managed by Synack, Inc, by clicking here." (href https://www.synack.com/vdp/fedex). The Synack program page (HTTP 200) states: "This Responsible Disclosure Program (the 'Program') page is for security researchers interested in reporting application security vulnerabilities... Vulnerabilities submitted to the Program through the form provided will be reviewed by Synack, Inc."; scope "The following web applications are in scope: *.fedex.com"; Rules of Engagement ("No Denial of Service testing", "No Physical or Social Engineering", "If able to gain access to a system, accounts, users, or user data, stop at point of recognition and report."); "Do not request compensation for time and materials or vulnerabilities discovered." The only non-pursuit language is Synack's platform Terms of Use ("Synack will not bring a private action against you or refer the matter for public inquiry"), which binds Synack, not FedEx; there is no FedEx-authored safe-harbor, authorization, CFAA/DMCA/ToS carve-out, or inbound disclosure deadline (researcher "will have the opportunity... to disclose the vulnerability" only after a fix). Real program with scope + submission path but no company legal commitment = L2. Submission form lives at fedex.responsibledisclosure.com (Zendesk brand fedexrd.zendesk.com); live fetch is Cloudflare-challenged (403 'Just a moment'), but the Wayback raw snapshot 2026-02-04 of /hc/en-us/requests/new renders the 'Submit a request - FedEx Responsible Disclosure' vulnerability form. hackerone.com/fedex is an unclaimed stub (submission_state:null). No security.txt: fedex.com/www.fedex.com 404 HTML at both paths.”

“the progressive.com Contact Us page (HTTP 200) carries a section headed "Reporting Security Vulnerabilities": "If you believe you have found a security vulnerability with one of our products or services, please email Progressive Security with your concerns." where 'Progressive Security' links to mailto:[email protected]. That is a named security contact with no policy document (no scope, no rules, no legal language) = L1 contact_only. Whether this line existed in June is not determinable from my fetch; it is present today. hackerone.com/progressivecorp exists but GraphQL returns submission_state:null (unclaimed stub; 'progressive' and 'progressive_vdp' do not exist). No security.txt: progressive.com/www.progressive.com return 404 HTML (FileNotFound.cshtml) at both paths. No Bugcrowd or Synack presence.”

“HackerOne GraphQL team 'lowes': submission_state:"open", state:"public_mode". Policy text ('LOWE'S VULNERABILITY REPORTING ELIGIBILITY POLICY'): "Lowe's will not take legal action against or suspend or terminate the accounts of those who discover and report security vulnerabilities in accordance with this Vulnerability Disclosure Policy. Lowe's reserves all legal rights in the event of any noncompliance." That is a promissory non-pursuit only: no explicit authorization to test, no CFAA/DMCA/ToS carve-out (the policy instead requires "You comply with all applicable laws and regulations, applicable Lowe's policies, your non-disclosure agreement and Security Vulnerabilities Reporting Terms and Conditions of Lowe's"). Scope: lowes.com, Android/iOS apps, uat.lpsdxp.com, talent.lowes.com, lowes.co.in, corporate.lowes.com. Response targets 5/10 business days. No security.txt: lowes.com 301s to www.lowes.com whose WAF drops curl (HTTP 000) at both paths, Wayback has no capture, corporate.lowes.com 404.”

“No disclosure channel found anywhere. www.energytransfer.com is a JS single-page app that returns HTTP 200 with the same empty shell for every path (control: /zzqx-nonexistent-9981 also 200), so /security and /vulnerability-disclosure 200s are catch-all, not pages. The site's embedded hydration JSON (read from /privacy-policy/) contains a corporate statement block "ENERGY TRANSFER'S CYBERSECURITY: Energy Transfer proactively protects the organization's property, mission, customers, employees, and the public through a robust cybersecurity program..." but zero occurrences of vulnerability-reporting language and no security@/cybersecurity@ mailbox; the only mailboxes are privacyoffice.mailbox@, media@, InvestorRelations@, publicawareness@, tariffs@, RoyaltyHotline@, Encroachments@, UnclaimedProperty@, gp_webmeteraccess@. security.txt at both paths on energytransfer.com and www.energytransfer.com is blocked by the F5 WAF (HTTP 403 'The requested URL was rejected'); the Wayback raw snapshot 2025-10-07 of /.well-known/security.txt is also a 'Request Rejected' page, so no security.txt has ever been captured. HackerOne: energytransfer / energy_transfer do not exist. Bugcrowd /engagements/energy-transfer and /energytransfer 404. Synack energytransfer.responsibledisclosure.com does not resolve.”

“security.txt at https://www.pg.com/.well-known/security.txt (HTTP 200, text/plain; also on us.pg.com): "Contact: https://vdp.pg.com" / "Expires: 2035-01-01T05:00:00.000Z". vdp.pg.com 301s to https://github.com/procter-gamble-vdp/submissions/blob/main/SECURITY.md (HTTP 200; full text read via raw.githubusercontent.com). Safe Harbor section: "When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be: Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy; Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and Lawful, helpful to the overall security of the Internet, and conducted in good faith." (the disclose.io template: authorization + anti-hacking, anti-circumvention and ToS carve-outs = L4). Scope: "any digital assets owned, operated, or maintained by The Procter & Gamble Company and Subsidiaries." Submission: "please use the GitHub Security Advisory 'Report a Vulnerability' tab"; questions to [email protected]. No monetary rewards. Not L5: "By participating, you agree you will not disclose vulnerability information reported to P&G to any other third party. Public disclosure may be allowed upon request, and only after granted written permission to do so from P&G" (restricts the researcher; no inbound deadline). Response targets 2/4 business days. HackerOne pg/procterandgamble/pandg/proctergamble/pg_vdp do not exist; Bugcrowd /engagements/pg, procter-gamble, procter-and-gamble 404.”

“No company-authored vulnerability disclosure channel found. HackerOne handle `sysco` is an unclaimed community stub (GraphQL: submission_state:null, state:null, policy:null). sysco.com is a Next.js catch-all: /responsible-disclosure, /vulnerability-disclosure and a random slug (/zzqx-not-a-real-page-9931) all return HTTP 200 with the identical 96 KB shell (4 x '404' markers inside), so those URLs are NOT real pages. /.well-known/security.txt returns 200 text/html (SPA shell) and /security.txt returns an F5 'The requested URL was rejected' 403 page; neither is a security.txt. sitemap.xml has no security/disclosure/vulnerability URL. Only email on the privacy notice is [email protected] (privacy, not a security-reporting contact). No bugcrowd.com/engagements/sysco (404), no sysco.responsibledisclosure.com (no DNS).”

“The parent publishes a company-authored 'American Express Responsible Disclosure Policy' as SECURITY.md across its official GitHub org (americanexpress/one-app and americanexpress/unify-simple-decision-table, identical text): 'If you believe you've found a security issue in one of our products or services please send it to us and include the following details with your report: A description of the issue and where it is located. A description of the steps required to reproduce the issue.'... 'Please email your message and any attachments to [email protected]'. No legal commitment, the opposite: 'Please note that this should not be construed as encouragement or permission to perform any of the following activities: Hack, penetrate, or otherwise attempt to gain unauthorized access to American Express applications, systems, or data in violation of applicable law;...' and 'American Express does not waive any rights or claims with respect to such activities.' The official @AmericanExpress X account also directs reporters to [email protected] (status 1364982105911001096, per search). No responsible-disclosure page exists on americanexpress.com itself (six candidate paths 404; en-us/security/ center lists only [email protected] for phishing). HackerOne `americanexpress` is an unclaimed stub (submission_state:null). Bugcrowd /engagements/americanexpress and /amex 404 (the amexglobalbusinesstravel.com/bugcrowd program is Amex GBT, a separate company, not graded). No security.txt (both paths 404 -> error page). L2 = policy doc + how to submit, no safe harbor; scope is only 'one of our products or services'.”

“Real Synack-hosted VDP: albertsons.responsibledisclosure.com is live (302 to /hc/en-us, then a Cloudflare managed challenge to curl, so the current text was read from the Wayback raw snapshot of 2026-02-04). Company-authored policy on the landing page: 'We are Albertsons Companies, Inc., including its subsidiaries and affiliated entities... Responsible Disclosure Policy: This page is for security researchers interested in reporting application security vulnerabilities. This is intended for application security vulnerabilities only.'... 'If you have reported an issue determined to be within program scope and to be a valid security issue, ResponsibleDisclosure.com will validate your finding and you will be allowed to disclose the vulnerability after a fix has been issued.' (a researcher restriction, not an inbound deadline). Scope: 'OWASP Top 10 vulnerability categories; Other vulnerabilities with demonstrated impact'; guidelines: 'Do not engage in disruptive testing like DoS... Do not engage in social engineering or phishing... Do not request compensation'. Full Rules of Engagement article (updated July 26, 2024): 'No Denial of Service testing; No Physical or Social Engineering; No testing of Third-party Services;... If able to gain access to a system, accounts, users, or user data, stop at point of recognition and report.' The only non-pursuit language is Synack's own platform ToS ('Synack commits that... Synack will not bring a private action against you or refer the matter for public inquiry'), which binds Synack, not Albertsons, so per the platform-boilerplate rule it is not graded as an Albertsons safe harbor. No authorization, CFAA/DMCA/ToS carve-outs, or disclosure deadline in the Albertsons-authored text. Also: albertsonscompanies.com/responsible-disclosure/default.aspx returns only a Cloudflare challenge (Wayback has no snapshot), so unverified; HackerOne `safeway` is an unclaimed stub (submission_state:null), `albertsons` not found; no bugcrowd /engagements/albertsons or /safeway (404); no security.txt (404).”

“No vulnerability disclosure channel found anywhere. adm.com /.well-known/security.txt and /security.txt both 404 (HTML '404 Error | ADM'), and the Wayback raw snapshot of /.well-known/security.txt is also the ADM 404 page. Candidate pages /en-us/responsible-disclosure/, /responsible-disclosure, /en-us/security/, /en-us/legal/ all 404. sitemap.xml has no security/disclosure URL. The privacy page and contact-us page contain no security email; the compliance page lists only [email protected] (general compliance/ethics, not a vulnerability channel). HackerOne adm / archer_daniels_midland / adm_vdp: team does not exist. No bugcrowd.com/engagements/adm (404). No adm.responsibledisclosure.com (no DNS). Web search (site:adm.com) returns nothing on vulnerability reporting.”

“Text: 'At MetLife, we take cybersecurity seriously and value the contributions of the security community at large.... If you believe you've found a security issue in one of our applications, services, products, websites, or systems, please send us a report.' Required details listed (system involved, issue type, 'A detailed description of the potential vulnerability, including the steps necessary to reproduce the vulnerability', suggested mitigation, perceived impact). No legal commitment, the opposite: 'Please note that this Responsible Disclosure Policy should not be construed as encouragement or permission to perform any of the following activities: Hack, penetrate, or otherwise attempt to gain unauthorized access to MetLife applications, systems, or data in violation of applicable law, including federal, state and international law;...' and 'MetLife does not waive any rights or claims with respect to such activities.' If PII is encountered: 'you should immediately halt your activity, purge related data from your system, and immediately contact MetLife.' No email address is published on the page (form only). HackerOne `metlife` is an unclaimed stub (submission_state:null). No bugcrowd /engagements/metlife (404), no metlife.responsibledisclosure.com. /.well-known/security.txt is 403 (HTML), /security.txt 404. L2 = published VDP with submission path and rules, no safe harbor, no authorization.”

“Valid RFC 9116 security.txt at /.well-known/security.txt (200, text/plain): 'Contact: mailto:[email protected]' / 'Policy: https://www.hcahealthcare.com/legal/responsible-disclosure' (root /security.txt is 404). Policy page 'HCA Healthcare Responsible Disclosure Statement, As of 6/1/2018': 'If you believe you're aware of a potential security vulnerability, please let us know by emailing our Information Protection & Security team directly at [email protected]. We also maintain an ethics line (1-800-455-1996)'. We ask that you not perform vulnerability or similar testing on products that are actively in use for public safety reasons. We ask that you not take advantage of any vulnerability you have discovered.' No legal commitment in either direction beyond: 'Notice: In the event you share information with us, you agree that the information you submit will be considered non-proprietary and non-confidential... Furthermore, you agree that submitting information does not create any rights for you or any obligation for us.' No safe harbor, no authorization, no CFAA/DMCA/ToS carve-out, no disclosure deadline. HackerOne `hcahealthcare` is an unclaimed stub (submission_state:null); hca / hca_healthcare / hca_vdp not found. No bugcrowd /engagements/hca or /hcahealthcare (404), no Synack host. L2 = policy doc + contact + testing rules, no legal commitment.”

“Safe Harbor section: "Lockheed Martin considers security research and vulnerability disclosure activities conducted consistent with this policy to be “authorized” conduct under the Computer Fraud and Abuse Act and other applicable computer use laws. To promote disclosure under this policy, Lockheed Martin will not pursue civil or criminal action, or send notice to law enforcement for accidental or good faith violations of this policy." No DMCA / anti-circumvention language and no Terms-of-Use waiver on the page. Disclosure clause is a RESTRICTION on the researcher, not an inbound CVD commitment: "Keep information about any vulnerabilities you have discovered confidential between yourself and Lockheed Martin until we have had minimum 120 days to verify and resolve the issue. HackerOne handle 'lockheedmartin' is an unclaimed stub (submission_state null); no Bugcrowd /engagements/ brief; no Synack; security.txt at /.well-known/ 302s to the homepage HTML and /security.txt 302s to the 404 page, so no security.txt.”

“The only security page on the site, https://www.newyorklife.com/about/privacy/information-security ('New York Life Cybersecurity and Information Security Program'), describes internal controls (preventative technologies, 24/7 event monitoring, relationships with law enforcement and cybersecurity leaders, security training directed by the CISO) and offers no reporting channel, no vulnerability wording and no security contact. HackerOne handles newyorklife / new_york_life / nyl do not exist (not even a stub). No Bugcrowd /engagements/ brief (newyorklife, new-york-life both 404). No Synack host. Web search for '"New York Life" vulnerability disclosure OR responsible disclosure' surfaces only the information-security page above.”

“Own policy page 'Responsible Disclosure Program' (HTTP 200): "By responsibly submitting your findings to Capital One in accordance with these guidelines Capital One agrees not to pursue legal action against you. Capital One reserves all legal rights in the event of noncompliance with these guidelines." and "Capital One uses HackerOne to triage and validate vulnerability reports made pursuant to our Responsible Disclosure Program... If you are unable to submit a report via HackerOne, you may send us an email at [email protected]." The page's Submit button targets a HackerOne embedded submission form (hackerone.com/555d8c87-becd-4083-9a2e-82cb78c7016c/embedded_submissions/new). HackerOne team handle 'capital-one' is a REAL public program (GraphQL submission_state 'open', state 'public_mode'); its policy text repeats the same non-pursuit clause and adds "Provide Capital One reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly" (a researcher restriction) and a response SLA "within two business days". Guidelines only require researchers to obey the law ("Do not engage in any activity that violates (a) federal or state laws"); there is no 'authorized' language, no CFAA / DMCA / Terms carve-out and no inbound disclosure deadline, so this is promissory non-pursuit only (L3). security.txt exists at ROOT only (https://www.capitalone.com/security.txt, text/plain, 'Contact: [email protected]', 'Policy: https://www.capitalone.com/digital/responsible-disclosure/') but is stale: 'Expires: 2025-12-14T05:00:00.000Z'; /.well-known/security.txt is a 404 redirect. No Bugcrowd /engagements/ brief, no Synack host.”

“Bugcrowd engagement allstate-vdp-pro, the Allstate Vulnerability Disclosure Program, running since 28 Nov 2023 (read 2026-09-17), carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research").”

“HackerOne team 'caterpillar' is a REAL public program (GraphQL submission_state 'open', state 'public_mode'; hackerone.com/caterpillar HTTP 200). The company-authored policy text ('# Vulnerability Disclosure Policy... At Caterpillar, information security is foundational to our strategy') carries its own '# Safe Harbor' section adopting the Gold Standard text: "We consider Good Faith Security Research to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Service (“TOS”) and/or Acceptable Use Policies (“AUP”) that conflicts with the standard for Good Faith Security Research outlined here. This means that, for activity conducted while this program is active, we: Will not bring legal action against you or report you for Good Faith Security Research, including for bypassing technological measures we use to protect the applications in scope; and, Will take steps to make known that you conducted Good Faith Security Research if someone else brings legal action against you." -> authorization + ToS waiver + anti-circumvention ('bypassing technological measures') carve-out; the CFAA is not named, so cfaaCarveout is left false. Scope: "All Caterpillar Inc. applications (web applications, API, iOS and Android mobile apps, etc) including the applications of Caterpillar brands such as... Cat Financial... Perkins, Progress Rail, SEM, Solar Turbines"; physical-proximity / Cat Equipment vulnerabilities are out of scope. Response target 'within five business days'. Disclosure is restricted, not committed: "Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express authorization from Caterpillar" (not an L5 signal). Own site: cat.com 'Report Potential Security Vulnerabilities' page (https://www.cat.com/en_US/support/maintenance/c/report-potential-information-security-vulnerabilities.html) is WAF-blocked to curl (403) but the Wayback snapshot of 2026-01-28 reads "If you believe that you have information about a potential cybersecurity vulnerability related to Caterpillar or our affiliates, please submit it through https://Hackerone.com/Caterpillar" and routes equipment/engine/turbine/locomotive vulnerabilities to a PGP-encrypted email process (page still says 'not included in the Bugcrowd program', a stale reference: bugcrowd.com/engagements/caterpillar and caterpillar-vdp-pro both 404). security.txt on caterpillar.com and www returns 403 WAF HTML at both paths and Wayback has no capture, so none verifiable.”

“Own PSIRT page (https://www.ibm.com/trust/security-vulnerability-management; /trust/security-psirt redirects here) 'Vulnerability reporting' section: "Report potential security and AI vulnerabilities in IBM products and websites, protected by IBM Safe Harbor Policy, using the reporting methods available in this section" with three routes: HackerOne ("Hackerone.com/IBM Third-party researchers and other security entities can report potential vulnerabilities in IBM products or websites"), email ("Report product vulnerabilities by emailing IBM at [email protected]. Use the IBM PGP public key to encrypt the email if necessary") and an anonymous form (https://www.ibm.com/support/pages/feedback/security-psirt). HackerOne team 'ibm' is a REAL public program (GraphQL submission_state 'open', state 'public_mode'); its policy says "Good Faith Security Research of IBM security flaws or vulnerabilities is protected by the IBM Safe Harbor Policy" and "IBM does not participate in a bug bounty awards program". The linked IBM Safe Harbor Policy PDF (https://www.ibm.com/downloads/documents/us-en/1227c12d3a38b16f, application/pdf, 1 page, dated February 2026 per its header; text recovered by decoding the PDF's subset-font glyph stream, so wording is reconstructed and should be eyeballed once in a viewer) reads: "If you comply with this policy during your security research, IBM will consider your Good Faith Security Research to be authorized, we will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, IBM will make this authorization known. In this context, Good Faith Security Research shall not be considered a data breach. IBM waives any relevant restrictions in our terms and conditions that conflict with the standard for Good Faith Security Research outlined here." -> authorization + promissory non-pursuit + Terms waiver; neither the CFAA nor the DMCA / anti-circumvention is named, so those carve-outs are false. Disclosure timing is a researcher restriction, not an inbound commitment: "Provide us a reasonable amount of time, as defined by IBM, to resolve the issue before you disclose it publicly. The recommended time frame for disclosure is no sooner than 30 days after the fix is made publicly available." security.txt is valid at /.well-known/security.txt (root /security.txt redirects to it): text/plain, 'Contact: https://www.ibm.com/trust/security-psirt', 'Contact: https://hackerone.com/ibm?type=team', 'Contact: mailto:[email protected]', 'Expires: 2026-10-17T00:00:00+00:00'. No Bugcrowd /engagements/ brief, no Synack host.”

“'Product Cybersecurity Coordinated Vulnerability Disclosure Policy' (Last Updated: November 22, 2022). Legal section: 'If you comply with this Policy during your security research, as determined by us in our sole discretion, we will consider your research to be authorized, and not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in compliance with this policy, we will make this authorization known.' No CFAA / DMCA / Terms carve-out; the page instead requires 'You will abide by all applicable laws and regulations' and 'By contacting us, you agree that information you provide will be governed by our site's Privacy Policy and Terms of Use.' Scope is narrow: 'The scope of our product cybersecurity vulnerability policy includes Medical Devices, Software as a Medical Device, and Mobile Medical Applications.' (corporate web/IT assets are NOT in scope). Submission is a web form on the page ('please submit a report to our team using the form below'); no email published. Researcher disclosure is restricted: 'you affirm that you have not disclosed and will not disclose the product cybersecurity vulnerability to anyone other than us' (no inbound CVD deadline). Promissory non-pursuit + authorization but no statutory carve-outs = L3.”

“com/msd). HackerOne GraphQL team(handle:"msd") returns submission_state:"open", state:"public_mode", with the full 'Responsible Vulnerability Disclosure Program' policy for 'Merck & Co., Inc., Rahway, NJ, USA (known as MSD outside the U.S. and Canada)'. Safe Harbor section (company-authored, not platform chrome): 'Any activities conducted in a manner the Company deems consistent with this policy will be considered authorized conduct and we will not initiate legal action against you for activities directly related to the identification of the reported vulnerability. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take reasonable steps to make it known that your actions were conducted in compliance with this policy.' No CFAA, DMCA or Terms-of-Service carve-out anywhere in the policy text. Scope: '*.merck.com', '*.msd.com', 'All other applications... owned by Merck & Co., Inc., Rahway, NJ, USA'. Disclosure is restricted, not a CVD deadline: 'you don't disclose any vulnerability reported through this program until Merck consents.' No bounty: 'no monetary rewards, bounties or other forms of transfer of value will be provided.'”

“Nationwide Mutual Insurance publishes a 'Reporting a vulnerability' page under /personal/cyber-security/: 'If you believe you've found a potential security issue in a Nationwide system or application, we appreciate your bringing it to our attention. Send details of the issue to [email protected], including: The affected system, website or application; Steps to reproduce the issue; Any supporting screenshots, logs or technical details'. Response commitment: 'We will acknowledge your submission within 3 business days'. Rules of engagement listed (no denial-of-service or load testing, no social engineering or phishing against Nationwide associates, no malware) and a disclosure restriction: 'Please do not publicly share details of the vulnerability until we've confirmed it has been resolved.' No safe-harbor, authorization, or legal-action language of any kind, and no scope list beyond 'a Nationwide system or application' = L2 (submission process + rules, no legal commitment). The parent page https://www.nationwide.com/personal/cyber-security/ repeats the 'Report a vulnerability: [email protected]' contact. Note: hackerone.com/nationwide_building_socie is Nationwide Building Society (UK), a different entity; not graded here.”

“Broadcom's parent-level channel is the 'Broadcom Product Security Center | Report A Security Issue | Security Vulnerability Submission by Email' page (React SPA; content read via the site's own JSON API /api/getjson?url=/support/resources/product-security-center&locale=en-us): 'When using email to report a potential security issue to Broadcom's Product Security Incident Response Team, please encrypt it using our PGP public key... Please direct these emails to [email protected].' It lists the information to include (products/versions affected, description, supporting technical details, 'Disclosure plans, if any', 'If you want public recognition') but contains NO scope, rules of engagement, safe-harbor, authorization or legal-action language, so the parent channel is contact-only = L1. HackerOne handles broadcom, vmware and symantec all return submission_state:null (unclaimed community stubs, not programs). SUBSIDIARY DRIFT, recorded but not graded per the parent rule: the VMware division page https://www.broadcom.com/support/vmware-services/security-response ('VMware External Vulnerability Response and Remediation Policy', reports to [email protected]) carries an L3-grade Safe Harbor clause: 'Any activities conducted in a manner consistent with this policy will be considered authorized conduct and VMware will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.' (no CFAA/DMCA/ToS carve-out, no CVD deadline). The Symantec division page https://www.broadcom.com/support/security-center/vulnerability-management ([email protected], 'confirm receipt of your report within three business days', ISO 29147) has no legal language at all. I have graded the parent PSC page as instructed.”

“'Responsible Disclosure Policy' / 'Vulnerability Disclosure Guidelines' page on delta.com: 'We welcome and encourage you to contact us about potential security vulnerabilities regarding networks and systems owned or controlled by Delta, including our website and mobile application (collectively, the "Delta Assets")'. Submission: 'Please send an email to our team at [email protected]. Encrypt your message and any supporting attachments using Delta's Vulnerability Disclosure PGP key'; 'we will send an acknowledgement to the sender within 5 business days'. Explicitly NOT a safe harbor: 'Delta reserves all legal rights in the event of your noncompliance with these guidelines, including your engagement in any out-of-scope activities to pursue legal action. Nothing in these guidelines is intended or shall be deemed or construed, in any way, to waive, alter, or impair any of the rights or remedies to which Delta is entitled under applicable law.' Terms of Use are a constraint, not a carve-out: 'All research activities regarding the Delta Assets must be conducted consistent with Delta's Terms of Use.' Out-of-scope list includes 'Any testing related to aircraft or ground support equipment'. Disclosure restricted ('Keep security vulnerability reports private and confidential... until we address the issue'), no CVD deadline. No bounty ('Delta does not have a "bug bounty" program'). Real VDP with scope and process but no non-pursuit promise = L2. security.txt exists at ROOT only: https://www.delta.com/security.txt (HTTP 200, Content-Type text/plain) with 'Contact: [email protected]' and a pointer to the policy URL; /.well-known/security.txt is 404.”

“No vulnerability disclosure channel found on publix.com or corporate.publix.com. No security.txt (both paths on publix.com, www.publix.com and corporate.publix.com return HTML), no HackerOne team, no Bugcrowd engagement, no Synack subdomain.”

“HackerOne GraphQL team(handle:"pfizer") returns submission_state:"open", state:"public_mode" (real program). Company-authored policy text: "Pfizer has partnered with HackerOne to handle reports of potential security or vulnerability issues in our products or services. Please note that this policy does not provide any form of defense or indemnity for any actions, nor does it authorize or encourage any actions that are either in breach of the law or of this policy." Safe Harbor section: "Pfizer will not initiate legal action against you for any security research activities under the HackerOne Vulnerability Disclosure Programs conducted in a manner consistent with this policy." Promissory non-pursuit only: the policy expressly disclaims authorization ("nor does it authorize or encourage any actions"), names no CFAA/DMCA/ToS carve-out, and the only disclosure clause is researcher-restricting ("Provide Pfizer reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly"), so no inbound CVD deadline. Secondary own-site channel: https://www.pfizer.com/cybersecurity ("The responsible disclosure of potential issues helps us ensure the security and privacy of our customers and data. Email us at [email protected]"; email decoded from Cloudflare obfuscation) carries the same non-authorization caveat and no safe-harbor sentence. security.txt absent (404 HTML at both /.well-known/security.txt and /security.txt on www.pfizer.com).”

“No vulnerability-reporting channel found. HackerOne GraphQL: tdsynnex, td_synnex, tdsynnex_vdp, tdsynnex-vdp all "Team does not exist"; synnex returns submission_state:null (unclaimed community stub, does not count). Bugcrowd /engagements/tdsynnex, /td-synnex, /synnex all 404 "Resource not found". tdsynnex.responsibledisclosure.com does not resolve. security.txt: www.tdsynnex.com/.well-known/security.txt and /security.txt both 301 to /us/en/... then 404 (Incapsula HTML). Own site: contact-us.html lists only [email protected] and 800-237-8931; privacy.html lists only [email protected]; terms-and-conditions.html has no security contact; the only "Cybersecurity" pages (/na/us/advancedsolutions/cybersecurity/, /na/us/services/cybersecurity/) are sales pages for services TD SYNNEX resells, not a disclosure policy. Web search for "TD SYNNEX" vulnerability disclosure / PSIRT / responsible disclosure returned no first-party policy.”

“TRAP (a): hackerone.com/conocophillips exists with SEO title "ConocoPhillips | Vulnerability Disclosure Policy" but GraphQL team(handle:"conocophillips") returns submission_state:null, state:null, policy:null, i.e. an unclaimed community-curated stub; conocophillips-vdp does not exist. TRAP (c): https://www.conocophillips.com/security.txt returns HTTP 200 but is the HTML homepage (Content-Type text/html, redirected to https://www.conocophillips.com/), not a security.txt; /.well-known/security.txt is 404 HTML. Own site: https://www.conocophillips.com/operations/safety-health-security/security/ describes the IT/OT Security Program and Cybersecurity Operation Center but offers no reporting email, form, or disclosure policy; /contact-us/ has no security address. Bugcrowd /engagements/conocophillips 404; conocophillips.responsibledisclosure.com does not resolve.”

“Contact only, no policy document. https://www.galaxy.com/security.txt (root location, HTTP 200, Content-Type text/plain) reads in full: "Contact: mailto:[email protected]" / "Expires: 2025-09-30T23:59:00.000Z" (the file is ~1 year past its own Expires date; /.well-known/security.txt is 404, so it sits only at the non-canonical root path). Corroborated on the company's own scam-warning page https://www.galaxy.com/warning under "Report issues with our site": "To report a bug or cybersecurity concern with our site please email [email protected]." (address decoded from Cloudflare email obfuscation). No scope, no rules of engagement, no safe-harbor or legal language anywhere on galaxy.com (homepage footer, /terms/, /privacy-policy/, /warning checked); galaxydigital.io 301s to galaxy.com. HackerOne galaxy, galaxydigital, galaxy_digital, galaxy-digital, galaxyhq all "Team does not exist"; Bugcrowd /engagements/galaxy, /galaxydigital, /galaxy-digital 404; Synack subdomains do not resolve.”

“AbbVie publishes a Coordinated Vulnerability Disclosure page at https://cvd.abbvie.com/ ("AbbVie's Coordinated Vulnerability Disclosure Process") with a defined scope and a submission form: "The scope of our cybersecurity coordinated product disclosure reporting process includes Medical Devices and Software as a Medical Device." and "If you have identified a potential vulnerability related to an AbbVie Medical Device or Software as a Medical Device, we ask you to fill in and submit the following form: Vulnerability Submission Form" (links to https://cvd.abbvie.com/vulnerability-submission, HTTP 200). Response commitments: "Acknowledge receipt of the submission within 5 business days." and "If AbbVie determines that disclosure is warranted, we will publish a notification on this page" (discretionary, not an inbound deadline). No safe-harbor, non-pursuit, authorization, CFAA/DMCA/ToS or timeline language; the only legal text is a submission-rights notice ("Your submission will be considered non-proprietary and non-confidential... submitting such information does not create any rights for you or impose any obligations on AbbVie"). Scope is product-only (medical devices / SaMD), not corporate web assets, so this is a real but narrow VDP: L2. HackerOne abbvie / abbvie_vdp / abbvie-inc / abbvie_inc all "Team does not exist" and hackerone.com/abbvie is HTTP 404 (the search-engine listing is stale); allergan is an unclaimed stub (null). Bugcrowd /engagements/abbvie 404; abbvie.responsibledisclosure.com does not resolve. security.txt on www.abbvie.com is Cloudflare-403 WAF-blocked to curl at both paths; Wayback CDX shows only 404 captures for /.well-known/security.txt (2023) and no capture for /security.txt, so treated as absent (unverified live).”

“HackerOne GraphQL team(handle:"prudential-financial") returns submission_state:"open", state:"public_mode" (real program; the bare "prudential" slug is an unclaimed stub, null). Company-authored Safe Harbor in the policy text: "Any activities conducted in a manner consistent with this Policy and within the Policy's scope will be considered authorized conduct by Prudential, including under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c). If legal action is initiated by a third party against you in connection with activities conducted under this Policy, we will make it known that your actions were conducted in compliance with this Policy." That is explicit authorization plus CFAA and DMCA carve-outs; there is no Terms-of-Service exemption (tosCarveout false). No inbound CVD deadline: the Disclosure Policy section restricts the researcher ("Any unauthorized public disclosure will be grounds for a program ban", "You agree to provide Prudential a reasonable amount of time to resolve the vulnerability") and the only dated commitments are response SLAs ("First Response 2 days / Time to Triage 2 days"), which are not an L5 signal. Own site: https://www.prudential.com/links/about/data-security-statement has no reporting channel; www.prudential.com/.well-known/security.txt and /security.txt are 404 HTML (apex prudential.com times out).”

“Live security.txt (plain text, RFC 9116) reads in full: "Contact: mailto:[email protected] / Preferred-Languages: en / Canonical: https://tjx.com/.well-known/security.txt / Canonical: https://www.tjx.com/.well-known/security.txt / Expires: 2027-04-16T23:00:00.000Z". No Policy: line, no policy document anywhere on tjx.com: the Cybersecurity & Privacy page (/corporate-responsibility/governance-integrity/cybersecurity-privacy, read via Wayback 2026-02-03 because tjx.com's Akamai WAF returns 403 to non-browser clients) describes the internal program ("Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats...") and offers no reporting channel. hackerone.com/tjx is an unclaimed stub (GraphQL submission_state:null). Only change since June: the file was renewed (Wayback 2026-02-03 copy carried Expires: 2026-04-16; live copy now Expires: 2027-04-16). Note for re-readers: curl to www.tjx.com/.well-known/security.txt gets an Akamai "Access Denied" 403 (text/html); the plain-text file was confirmed via WebFetch and matches the Wayback raw snapshot byte-for-byte apart from the Expires date.”

“No channel found on any surface. pfgc.com and www.pfgc.com return an IIS "404 - File or directory not found." HTML page at both /.well-known/security.txt and /security.txt (Wayback 2026-01-12 raw snapshot is the same 404). performancefoodservice.com (operating brand) also 404 at /.well-known/security.txt. The pfgc.com homepage and /About/Terms-of-Use contain no security, vulnerability, or researcher link or wording. HackerOne GraphQL: pfgc, performancefood, performance_food, pfg, performancefoodgroup, pfgc_vdp all "Team does not exist". bugcrowd.com/engagements/pfgc is a real 404 ("Resource not found 404 - Crowdcontrol"). pfgc.responsibledisclosure.com does not resolve. Web search returns no VDP, security.txt, or bounty listing for Performance Food Group.”

“Bugcrowd engagement united-vdp, the United Airlines Vulnerability Disclosure Program, running since 17 Aug 2021 (read 2026-09-17), carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research").”

“Oracle does not distribute exploit code (or proof of concept code) for vulnerabilities in our products.") with no researcher rules. The sibling Reporting page gives the channel: "If you are not an Oracle customer or partner, please email [email protected] with your discovery." and a credit policy: "To be eligible to receive credit, security researchers must follow responsible disclosure practices, including: Not publishing the vulnerability before Oracle releases a fix; Not disclosing exact details of the issue, such as exploits or proof-of-concept code; Coordinating disclosure with Oracle to allow sufficient time for remediation." No defined testing scope, no rules of engagement, no authorization, no legal-action promise, no CFAA/DMCA/ToS carve-out, no inbound disclosure deadline (the conditions restrict the researcher).”

“Cisco's canonical channel is the PSIRT Security Vulnerability Policy (HTTP 200): "This policy clearly states how Cisco addresses reported security vulnerabilities in Cisco products and services"; "Cisco welcomes reports from independent researchers, industry organizations, vendors, customers, and other sources concerned with product or network security"; contact "Email [email protected]" plus PGP key; product scope (supported Cisco products/services, cloud-hosted services, LDoS cut-off: "Once the LDoS has been reached, the Cisco PSIRT will continue to accept vulnerability reports but will not analyze, fix, or disclose potential vulnerabilities"); process ("The Cisco PSIRT investigates all reports of product security vulnerabilities"; "When the initial investigation is complete, results will be delivered to the incident reporter along with a plan for resolution and public disclosure"). No legal commitment to the researcher: no non-pursuit promise, no authorization to test, no CFAA/DMCA/ToS carve-out. Disclosure timing is Cisco's OUTBOUND schedule ("Cisco generally does not publicly disclose security vulnerabilities in a Cisco product until the Cisco PSIRT has completed the incident response process"; advisories "at 1600 Greenwich Mean Time (GMT)") and the reporter is asked "to maintain strict confidentiality until complete resolutions are available", so cvdTimeline is false. security.txt is live: PGP-signed plain text at https://www.cisco.com/.well-known/security.txt with "Contact: mailto:[email protected]", "Policy: https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html", "Expires: 2027-01-01T00:00:00.000Z" (curl gets an Akamai 403 HTML page; confirmed text/plain via WebFetch and the Wayback 2026-08-21 raw snapshot). Bug bounty: Cisco's own FAQ says "Most of the bug bounties at Cisco are private and managed by different bug bounty platforms such as HackerOne and Bugcrowd" and lists only subsidiary public programs (Cisco Networking/Meraki at bugcrowd.com/cisconetworking, ThousandEyes at bugcrowd.com/thousandeyes-og); per the subsidiary-drift rule these are not graded for the parent. hackerone.com/cisco: Team does not exist.”

“HP encourages anyone who suspects a vulnerability in one of our products or services to report it to us and work in a coordinated manner to mitigate the vulnerability via the following process: Submit suspected vulnerabilities to HP using the form below. HP will acknowledge receipt of the submission within two business days and begin investigating. If the vulnerability is confirmed, HP will notify the submitter with status updates until the resolution of the reported security issue. HP will work with the submitter regarding a coordinated public release of the vulnerability so that updates are available to protect customers and minimize potential risks." Scope is HP supported software/firmware products; submission is the on-page form (PGP key linked). No legal commitment in this text: no non-pursuit promise, no authorization, no CFAA/DMCA/ToS carve-out, no inbound disclosure deadline (a 2-business-day acknowledgement SLA is not a CVD timeline). New since June: a live RFC 9116 security.txt at https://www.hp.com/.well-known/security.txt (HTTP 200, text/plain): "Contact: mailto:[email protected]", "Policy: https://support.hp.com/us-en/document/ish_12775610-12775642-16", "Encryption: https://support.hp.com/us-en/document/ish_12766830-12766857-16", "Acknowledgements: https://support.hp.com/us-en/security-bulletins" (root /security.txt is a 404 HTML page). UNREAD: the linked HP Coordinated Vulnerability Disclosure document on support.hp.com (ish_12775610-12775642-16, also the my-en locale and c06144280) could not be fetched by any route (curl HTTP 000 on every attempt, WebFetch 60 s timeout x3, Wayback snapshots captured as 403, archive.ph none). Grade stands on the enable.hp.com text actually read. hackerone.com/hp is an unclaimed stub (submission_state:null).”

“HackerOne handle `chartercom` (the page Google titles "Charter Communications | Vulnerability Disclosure Policy") is an unclaimed community-curated STUB: GraphQL returns {"submission_state":null,"state":null,"policy":null}; handles charter, charter_communications, spectrum, charter_vdp, charter_communications_inc do not exist. security.txt: corporate.charter.com returns 404 text/plain at both /.well-known/security.txt and /security.txt; charter.com and spectrum.com 301 to www.spectrum.com which answers 403 text/html (WAF) at both paths, and the Wayback raw snapshot of https://www.spectrum.com/.well-known/security.txt is a Spectrum "404 Error - Page Not Found" HTML page. policy.charter.com/protecting-our-networks (200) describes Charter's cybersecurity program ("Charter devotes extensive resources, personnel, and time to defending against, evaluating, monitoring, and researching potential and emerging cybersecurity threats and vulnerabilities.") but names no reporting channel, address, or researcher policy. The Wayback copy of spectrum.com/policies (2025-04-01) links only broadband/RE-SIGN disclosures, nothing for vulnerability reporting. No Bugcrowd /engagements/ brief (charter, spectrum, charter-communications all 404) and no Synack *.responsibledisclosure.com host.”

“hackerone.com/aa (read 2026-09-17) publishes American Airlines' disclosure policy with scope (*.aa.com, *.envoyair.com, *.piedmont-airlines.com, *.psaairlines.com), response targets and a live HackerOne submission form ("You're about to submit a report to American Airlines"). Safe harbor: "Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you." No anti-hacking-law, DMCA or terms-of-service carve-out is named.”

“No HackerOne team exists for tyson, tysonfoods, tyson_foods, or tysonfoodsinc (all "Team does not exist"). security.txt: https://www.tysonfoods.com/.well-known/security.txt and /security.txt both 404 (HTML 404 page). https://www.tysonfoods.com/security 404. The Contact Us page (https://www.tysonfoods.com/contact-us, 200) lists only [email protected] (Consumer Relations), [email protected] / TellTysonFirst.com (Ethics), [email protected] and HQ phone numbers; no security or vulnerability address. Homepage has no security/vulnerability link. Web searches (general and site-restricted to tysonfoods.com / tyson.com) surface only the 10-K Item 1C cybersecurity narrative and privacy policies, no disclosure page. No Bugcrowd /engagements/ brief (tyson, tysonfoods 404) and no Synack host.”

“Intel runs a public bug bounty on Intigriti (method: Intigriti web submission; not in the method enum, recorded as web_form). Intel's own page https://www.intel.com/content/www/us/en/security/security-practices/vulnerability-management/bug-bounty-program.html (fetched live via WebFetch, 200): "If you believe you've found a security vulnerability in an Intel product or solution, please submit reports through the current provider: Intigriti." Intel's Vulnerability Handling Guidelines (intel.com is WAF-403 to curl; Wayback raw 2026-08-30): "To ensure proper triage, compliance verification, and researcher authentication, all vulnerability reports must be submitted through Intigriti." The Intel-authored program terms on the Intigriti page (fetched live, 200, raw HTML) carry a Safe Harbor section: "If you follow the program terms, we will not initiate a lawsuit or law enforcement investigation against you in response to your report. Please understand that this waiver does not apply to your security research that involves the networks, systems, information, applications, devices, products, or services of another party (which is not Intel). We cannot and do not authorize security research in the name of other entities." and, under eligibility: "You did not and will not violate any applicable law or regulation, including laws prohibiting unauthorized access to information. No DMCA / anti-circumvention or Terms-of-Service exemption appears anywhere in the program text (grep for DMCA, circumvent, terms of use/service: no hits). No inbound coordinated-disclosure deadline: the researcher covenant is restrictive ("You will not discuss or disclose vulnerability information with anyone not authorized by Intel") and acknowledgement is "at or after the time of public disclosure of the vulnerability, in coordination with the security researcher"; no N-day commitment, so cvdTimeline false. security.txt: live https://www.intel.com/.well-known/security.txt is 403 text/html (Akamai WAF) to curl; the Wayback raw snapshot of 2026-02-01 is text/plain with "Contact: mailto:[email protected]" (products), "Contact: mailto:[email protected]" (intel.com web presence), Canonical https://www.intel.com/security.txt, Policy pointing at the vulnerability-handling-guidelines page, but "Expires: 2022-10-11T19:30:00.000Z" (long expired). HackerOne: no team (intel, intel_vdp, intelcorp, intel_corp, intelcorporation not found); Bugcrowd /engagements/intel 404; no Synack host.”

“No HackerOne team exists for enterpriseproducts, enterprise_products, or epd ("Team does not exist"). security.txt: https://www.enterpriseproducts.com/.well-known/security.txt and /security.txt both 404 (HTML 404, also on the apex host). https://www.enterpriseproducts.com/security 404. Homepage (200) contains no security, vulnerability, or PSIRT link (only a generic /contact-us/ link). Web searches (general and site-restricted to enterpriseproducts.com) return only the 10-K cybersecurity narrative (SIEM, vulnerability scans, third-party pentests, CIRP) and pipeline-safety pages; no disclosure policy or researcher contact. No Bugcrowd /engagements/enterpriseproducts brief (404) and no Synack host.”

“Ingram Micro publishes a bug bounty program statement with a working submission form. Trust Centre article "CYBER SECURITY PROGRAM OVERVIEW" (Zendesk host answers 403 to curl and WebFetch; text read from the Wayback raw snapshot of 2025-05-24, and the page is still indexed live): "Bug Bounty Program Ingram Micro recognizes the power of security as a community. As a result, we reward security researchers who discover and report vulnerabilities in our applications and ecosystem. These are awarded based on several factors including severity and impact of the vulnerability reported. HackerOne handle `ingrammicroinc` (Google-titled "Ingram Micro | Vulnerability Disclosure Policy") is an unclaimed STUB: GraphQL {"submission_state":null,"state":null,"policy":null}; ingrammicro, ingram_micro, ingram do not exist. security.txt: ingrammicro.com 301s to www.ingrammicro.com, which refused/timed out (curl exit 000, HTTP/1.1 and IPv4 retried) at both paths; Wayback raw for /.well-known/security.txt is 404, so no security.txt is credited. No Bugcrowd /engagements/ brief (ingrammicro, ingram-micro 404) and no Synack host.”

“No parent-level channel exists: www.gd.com/.well-known/security.txt and /security.txt both 404 (HTML); candidate pages /security, /vulnerability-disclosure, /responsible-disclosure, /report-a-vulnerability all 404; the only cyber content on gd.com is board-oversight prose on /responsibility/governance ('The board oversees risk management... including... cybersecurity... risks'), no reporting channel. HackerOne handle 'generaldynamicssharedr' (SEO title 'General Dynamics Corp | Vulnerability Disclosure Policy') is an unclaimed community stub: GraphQL submission_state:null, policy:null. Subsidiary drift note (trap e, NOT graded): General Dynamics Information Technology (gdit.com, 'a General Dynamics Company') runs its own web-form VDP at https://www.gdit.com/vulnerability-disclosure-program/ scoped to *.gdit.com, with 'If you make a good faith effort to comply with this policy during your security research, GDIT will consider your research to be authorized... GDIT will not recommend or pursue legal action related to your research' and 'Public disclosure of vulnerabilities identified through this program is not permitted.' That is a subsidiary policy for subsidiary assets, not a gd.com channel, so the parent stays L0.”

“HackerOne GraphQL team(handle:uber): submission_state:"open", state:"public_mode", full policy text returned (27,749 chars, 'Uber Bug Bounty Program Terms'). Section 'Good Faith Disclosures and Safe Harbor' is a promissory non-pursuit only: 'If you have made a good faith effort to abide by these Program Terms, we will not initiate or recommend legal action against you, and if a third party initiates legal action, we will make it known that your activities were conducted pursuant to the Bug Bounty Program.' No explicit authorization to test (the only 'authorized' language is a limit: 'Stop at that point in your testing where you have an adequate proof of concept... Actions taken beyond this are not authorized'), no CFAA, DMCA or Terms-of-Service carve-out anywhere in the policy (zero hits for CFAA/DMCA; Terms of Use are cited as rules the researcher must follow: 'Follow the rules outlined in this policy: This includes the Program Terms, Uber Terms of Use'). Disclosure is researcher-restricting, not an inbound deadline: 'Do not publicly disclose a vulnerability submission without our explicit review and consent' and 'You must get written consent by submitting a disclosure request through the HackerOne platform.' HackerOne's generic Gold Standard Safe Harbor chrome is not adopted in the policy prose (trap d).”

“Bugcrowd engagement usaa (read 2026-09-17) carries Bugcrowd's "Partial safe harbor" tier ("This engagement provides a limited goodwill statement about not pursuing legal action related to security research"). USAA also serves a valid PGP-signed security.txt.”

“TIAA's security center links its Responsible Disclosure policy to a HackerOne-hosted submission form that carries the full policy (read 2026-09-17): "When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be: Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy; Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP)". No published disclosure deadline.”

“No channel found on either corporate (libertymutualgroup.com) or consumer (libertymutual.com) domain. www.libertymutualgroup.com/.well-known/security.txt and /security.txt return Akamai 403 'Access Denied' HTML (not a security.txt); Wayback raw snapshot of the same path is 404 (never captured). www.libertymutual.com/.well-known/security.txt and /security.txt return the Next.js 404 shell (HTML). Candidate pages www.libertymutual.com/security, /about-liberty-mutual/security, /customer-support/security, /vulnerability-disclosure, /responsible-disclosure all 404. The corporate Terms and Conditions page renders only a logo to non-browser clients (no vulnerability-reporting content). HackerOne handles libertymutual, liberty_mutual, libertymutualinsurance, libertymutualgroup, liberty_mutual_insurance all 'Team does not exist'; Bugcrowd /engagements/libertymutual and /liberty-mutual 404; Synack libertymutual.responsibledisclosure.com has no DNS and synack.com/vdp/libertymutual|liberty-mutual|libertymutualgroup 404. Wayback CDX for both domains filtered on disclos/vulnerab/security-research/bug-bounty returns only financial, climate and claims disclosure pages. Two web searches for a Liberty Mutual responsible-disclosure or vulnerability-disclosure program returned only breach news and cyber-insurance product pages.”

“Real Synack-hosted VDP, linked from Travelers' own site: https://www.travelers.com/about-travelers/security/travelers-information-security-practices has a 'Vulnerability Disclosure Program' section ('Our Vulnerability Disclosure Program provides a clear, structured process for security researchers to report potential application security vulnerabilities they discover in our systems. This program outlines the scope, process and guidelines for responsible reporting') whose 'Learn more about the Travelers Vulnerability Disclosure Program' link goes to https://www.synack.com/vdp/travelers/. That page (200) defines scope and submission: 'This Vulnerability Disclosure Program (the "Program") is for security researchers interested in reporting cybersecurity vulnerabilities... Vulnerabilities submitted to the Program through the form provided will be reviewed by Synack, Inc.'; 'The following web applications are in scope: *.travelers.com'; Rules of Engagement ('No Denial of Service (DoS) testing', 'No Physical or Social Engineering', 'If able to gain access to a system, accounts, users, or user data, stop at point of recognition and report'); 'Not request compensation for time and materials or vulnerabilities discovered.' There is no Travelers-authored legal commitment: no 'legal action', 'authorized', 'safe harbor', CFAA or DMCA sentence in the program text (the only 'legal'/'authorized' hits are in Synack's own Terms of Use and Privacy Policy boilerplate appended below, which is platform text, trap d). Disclosure clause is post-fix and permissive, not a deadline: 'If you submit a valid vulnerability, you will be notified after a fix has been issued, and you will have the opportunity to be added to the Acknowledgments page and to disclose the vulnerability.' Graded L2: real VDP with scope and submission route, no legal commitment. security.txt: www.travelers.com/.well-known/security.txt returns WAF 403 HTML, /security.txt returns the site 404 page, and the Wayback raw snapshot (2026-02-01) of /.well-known/security.txt is a 404, so no security.txt. HackerOne handle 'travelers' is an unclaimed stub (submission_state:null); travelers.responsibledisclosure.com has no DNS (the Synack VDP lives on synack.com/vdp/ instead).”

“No vulnerability-reporting channel found anywhere. https://www.bms.com/.well-known/security.txt and https://www.bms.com/security.txt both return HTTP 404 with an HTML '404' page (not WAF-blocked, so the absence is authoritative). HackerOne GraphQL for handles bms, bristolmyerssquibb, bristol-myers-squibb, bms_vdp all return 'Team does not exist' (not even a stub). bugcrowd.com/engagements/bms and /engagements/bristol-myers-squibb return 'Resource not found 404 - Crowdcontrol'. bms.responsibledisclosure.com does not resolve. Guessed pages /security.html, /responsible-disclosure.html, /vulnerability-disclosure.html all 404. The contact-us form (https://www.bms.com/contact-us.html) offers interest areas routed to incubatorsupport@, mg-transparency_bms@, timeback@, [email protected] and similar, with no security or vulnerability option. The only 'disclosure' pages on bms.com concern clinical-trial disclosure. The FY2025 10-K says BMS follows the NIST CSF but names no researcher-facing channel.”

“The Coca-Cola Company publishes its own 'Vulnerability Disclosure Policy' (dated 01/24/2024, PDF linked as 'Vulnerability Disclosure Policy' from https://www.coca-colacompany.com/policies-and-practices/privacy-and-data-protection). Non-pursuit promise, company-authored: 'The Coca-Cola Company reserves all of its legal rights in the event of noncompliance with this Policy, but it does not intend to pursue legal action against any party that conducts security research and discloses information to us in good faith and as outlined in this Policy.' No explicit authorization to test and no CFAA/DMCA/ToS carve-outs; the policy says the opposite for third parties: 'No part of this policy should be understood to authorize research on behalf of any third-party to The Coca-Cola Company.' Researcher must comply 'with all applicable laws'. No inbound CVD deadline; disclosure is gated on consent: out of scope is 'Publicly disclosing any potential vulnerability without the express written consent of The Coca-Cola Company.' Submission channel: 'The Coca-Cola Company has partnered with Intigriti, a leading crowdsourced security research platform, for the administration of our Vulnerability Disclosure Program.' The Intigriti program is REAL and live: the public API https://app.intigriti.com/api/core/public/programs/tccc/coca-cola returns name 'The Coca-Cola Company Vulnerability Disclosure Program', handle coca-cola, 3,004 submissions, last activity 2026-09-17, scope '*.coca-cola.com *.ko.com *.coca-colacompany.com *.coke.com *.cokestore.com...' plus the Coca-Cola iOS/Android apps; rewards are Coke Store discount codes ($25 to $250), not cash. The Intigriti record carries a platform-level 'safeHarbour: true' flag, which is platform chrome and was NOT used for grading (trap d). HackerOne handles cocacolaco ('The Coca-Cola Company | Response Policy') and cocacolahbc are unclaimed STUBS (submission_state null, policy null) and do not count. Bugcrowd: bugcrowd.com/coca-cola is the catch-all; /engagements/coca-cola and /engagements/cocacolo return 404. No security.txt: both paths on www.coca-cola.com and www.coca-colacompany.com return HTML 404. Level 3: real VDP with a promissory non-pursuit clause but no authorization language or statutory carve-outs.”

“cvdTimeline downgraded true -> false. The policy page 'What Is Nike's Responsible Disclosure Program?' is live (HTTP 200; article body is delivered inside the page's Next.js data and reads in full). It is a real VDP: scope 'We accept submissions for the following domains and systems. Sites http[s]://*.nike.com/* http[s]://*.converse.com/* http[s]://*.nike.net/*... Apps (iOS and Android) SNKRS Nike NRC (Nike Run Club) NTC (Nike Training Club)'; 'This is not a bug bounty program. We make no offer of reward or compensation for identifying issues.'; 'Please use our Responsible Disclosure Form to submit the requested information.' (form at https://www.nike.com/help/disclosure, HTTP 200, 'Nike Responsible Disclosure Form' with Name/Email/URL Location/Description/Steps to Reproduce fields); 'please reach out to [email protected] for clarification before engaging in the conduct.' No legal commitment of any kind: the only reprisal language is 'Open dialogue to discuss issues without fear of reprisal', which is not a non-pursuit promise, and no CFAA/DMCA/ToS text appears. Please refrain from sharing your report with others while we work on our patch... By submitting your report, you agree to treat the report as confidential for 90 days after submission.' Nike commits to patching, not to disclosing, and the clause restricts the researcher; per the grading rule (a response/patch SLA or a researcher restriction is NOT an L5 signal) cvdTimeline is set false. HackerOne 'nike' is an unclaimed STUB (submission_state null, policy null) and does not count. No security.txt: both paths on www.nike.com and about.nike.com return HTML 404. Level unchanged at 2.”

“MassMutual publishes a 'Responsible Disclosure Policy (RDP)' at /protecting-your-information/responsible-disclosure-policy, linked from the Privacy & Security Center card 'Report a Cybersecurity Issue: MassMutual is committed to protecting our business and customers from cyberattacks. If you believe you have identified a potential MassMutual security issue, please notify us as soon as possible by emailing a report of your findings using the button below.' Policy text (from the page's embedded Sitecore layout data): 'Our Responsible Disclosure Policy (RDP) is intended to give security researchers a mechanism to report security issues in any of our information systems and applications. MassMutual RDP Rules: Please provide detailed reports with reproducible steps... Social engineering (e.g., phishing, vishing, smishing) is prohibited. Do not access, copy, store, transfer, or download any proprietary or confidential MassMutual data... Do not engage in any activity that violates any applicable law or regulation... Failure to abide by MassMutual's terms and conditions will be deemed by MassMutual, in its sole discretion, to be unauthorized activity. MassMutual expressly reserves all rights afforded to it, by law or in equity, in this regard.' and 'Report a security issue:... please notify us as soon as possible by emailing a report of your findings using the button below: Email Report... Public disclosure of the issue outside of this reporting mechanism without the consent of MassMutual is strictly prohibited.' The Email Report button target embedded in the page data is [email protected]. Scope plus a submission mechanism, but no non-pursuit promise, no authorization to test (the text only reserves rights and labels non-compliance 'unauthorized activity'), no CFAA/DMCA/ToS carve-outs, and disclosure is gated on consent: Level 2. Caveat on how it was read: www.massmutual.com returns Akamai 'Access Denied' HTTP 403 to every non-browser client tried (curl with browser headers, Bun fetch, WebFetch timed out), so the policy was read from the Internet Archive raw capture of 2025-12-11 (web.archive.org/web/20251211232635id_/...) and the parent page from the 2026-08-19 capture; the live page is indexed by search under the same title 'Responsible Disclosure Policy (RDP)'. No security.txt: both paths return the same Akamai 403 HTML live, and the Wayback CDX shows /.well-known/security.txt captured as 404 on 2023-06-01. No HackerOne team (massmutual, massmutual_vdp, mass_mutual: NOT_FOUND), Bugcrowd /engagements/massmutual 404, Synack massmutual.responsibledisclosure.com no DNS.”

“Page title 'BHP's Responsible Disclosure | BHP', dated 7 October 2021, still live: 'Inform [email protected] of any findings of potential application vulnerabilities'; 'Submissions must be sent to [email protected].' Scope rules present ('Do not attempt to exploit any potential vulnerabilities', 'Do not attempt to perform network Denial of Service', 'Do not use scanners or automated tools'). Only commitment: 'We Promise to: Acknowledge the receipt of your potential vulnerability report in a timely manner.' Confidentiality is mandatory, not a CVD deadline: 'we require that all such reports remain confidential and are not disclosed to third parties or as part of paper reviews or conference submissions.' No legal-action language, no authorization, no safe harbor, no CFAA/DMCA/ToS carve-out, no compensation ('we do not provide any form of compensation'). Fetch note: www.bhp.com returns HTTP 403 to direct curl (WAF); the live page was read through the r.jina.ai text proxy (HTTP 200, same title and body) and cross-checked against the Wayback snapshot 20260414064334 (identical text). /.well-known/security.txt and /security.txt both 403 direct and render the BHP 404 page via proxy: no security.txt.”

“Page 'Vulnerability Disclosure Program | CommBank' (HTTP 200): 'You can responsibly disclose suspected vulnerabilities to the CommBank Cyber Security Team by emailing [email protected].' Scope/prohibited list present ('the following types of research are strictly prohibited: Accessing or attempting to access accounts or information you are not authorised to... Any attempts of a Denial of service (DoS)'). Explicitly NO waiver: 'Any activity or attempt to gain unauthorised access to CommBank software or systems in violation of law. CommBank does not waive any rights or claims with respect to such activities.' Researcher-restricting confidentiality clause only: 'ask that you do not publicly disclose, discuss or confirm the details of any suspected security issues.' 'CommBank does not compensate individuals or organisations'. No promissory non-pursuit, no authorization, no carve-outs, no CVD deadline. security.txt exists at root only (https://www.commbank.com.au/security.txt, Content-Type text/plain, 'Contact: mailto:[email protected]', 'Policy: https://www.commbank.com.au/support/security/vulnerability-disclosure-program.html') but is STALE: 'Expires: Thu, 30 Jun 2024 23:59 +1000'; /.well-known/security.txt returns 404. HackerOne handle 'commonwealthbank' exists but submission_state:null (unclaimed stub, does not count).”

“Bugcrowd engagement 'Westpac Banking Corporation Vulnerability Disclosure Engagement' is live: state 'in_progress', participation 'open', startsAt 2024-12-03, rewardAllocation 'no_reward', brief version publishedAt 2026-08-05. Brief text read in full via the engagement's changelog JSON endpoint (not JS-rendered): Bugcrowd safeHarborStatus = {status:'full', label:'Safe harbor', description:'This engagement is fully committed to providing safe harbor for good-faith security research.'} and the company-authored brief carries the full disclose.io template verbatim: 'Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith.' Scope: *.westpac.com.au, *.stgeorge.com.au and other group brands; 'Max 50 requests/min', header 'X-Bug-Bounty:<bugcrowdusername>'. cvdTimeline false: the engagement's Bugcrowd flag coordinatedDisclosure=true is a platform disclosure setting, and no inbound N-day disclosure deadline appears in the brief prose. Westpac's own page https://www.westpac.com.au/security/how-to-report/responsible-disclosure.html ('Responsible Disclosure at Westpac') points to the same program: 'Please report any technical issues through our Vulnerability Disclosure Program or alternatively, email [email protected]' (href = https://bugcrowd.com/engagements/westpac-vdp-pro); that page itself carries no safe-harbor language. No security.txt (www.westpac.com.au /.well-known/security.txt and /security.txt both 404). HackerOne 'westpac' is an unclaimed stub (submission_state:null).”

“Bugcrowd engagement "NAB's Responsible Disclosure Program" is live: state 'in_progress', participation 'open', startsAt 2017-11-28, rewardAllocation 'no_reward', brief publishedAt 2025-03-18, serviceLevel 'P1 24/7'. Brief read in full via the changelog JSON endpoint. Bugcrowd per-engagement badge safeHarborStatus = {status:'partial', label:'Partial safe harbor', description:'This engagement provides a limited goodwill statement about not pursuing legal action related to security research.'}. Company prose: 'Thank you for participating in NAB's Responsible Disclosure Program... To make a disclosure you'll need to first Sign up with Bugcrowd'; 'No monetary disbursements for findings will be provided on this program'; 'We cannot authorize security testing against systems that do not belong to us'; 'The use of personal credentials for testing purposes is strictly prohibited and may trigger or result in investigations by the NAB fraud team and/or law enforcement.' No CFAA/DMCA/ToS carve-out, no explicit authorization grant, no CVD deadline (coordinatedDisclosure=false, 'NAB may not correspond with you directly, disclose remediation steps or timeframes'). Scope: *.nab.com.au, *.jbwere.com.au and others. NAB's own page https://www.nab.com.au/about-us/security ('Responsible disclosure program... managed by Bugcrowd. Please note all disclosures must be made via Bugcrowd, not directly to NAB. NAB does not condone malicious or illegal behaviour') links https://bugcrowd.com/nationalaustraliabankog which 302s to the /engagements/ URL. No security.txt (www.nab.com.au both paths 404). HackerOne 'nab' and 'national_australia_bank' are unclaimed stubs (submission_state:null).”

“Bugcrowd engagement 'ANZ Responsible Disclosure Program' is live: state 'in_progress', participation 'open', startsAt 2022-08-30, rewardAllocation 'no_reward', brief publishedAt 2026-05-07. Brief read in full via the changelog JSON endpoint. Bugcrowd per-engagement badge safeHarborStatus = {status:'partial', label:'Partial safe harbor', description:'This engagement provides a limited goodwill statement about not pursuing legal action related to security research.'}. As with NAB: the company-authored prose contains no non-pursuit sentence of its own, so safeHarborPromissory rests on Bugcrowd's per-engagement attestation; downgrade to false / L2 if the auditor rules the badge insufficient. Company prose does grant scoped authorization: 'Testing is only authorised on the targets listed as in scope. Any app/service/domain/property of ANZ not listed in the targets section is out of scope.' and 'We cannot authorise security testing against systems that do not belong to us' (testingAuthorized true on that basis; no CFAA/Criminal Code, DMCA/Copyright Act or ToS carve-out anywhere). Restrictions: 'The use of automated scanning tools is prohibited'; 'The use of personal credentials, your own or discovered, for testing purposes is strictly prohibited'; confidentiality is researcher-restricting ('You must treat all information... as strictly confidential'), no inbound disclosure deadline (coordinatedDisclosure=false). 'there are no monetary payments for findings on this program.' Scope: *.anz.com.au and others. ANZ's own page https://www.anz.com.au/security/ ('Disclose a security vulnerability... report it via Bugcrowd, who manage our Responsible Disclosure Program. All disclosures must be made through Bugcrowd, not directly to ANZ.') links https://bugcrowd.com/engagements/anz-vdp. security.txt: https://anz.com/.well-known/security.txt is 200 text/plain with 'Contact: https://bugcrowd.com/engagements/anz-vdp', 'Expires: 2027-06-01T23:59:59.000Z', 'Canonical: https://plus.anz.com.au/.well-known/security.txt' (canonical resolves via plus.anz to the same file); www.anz.com.au and www.anz.com both 404 on both paths. No HackerOne team (anz / anz_bank / anzbank: Team does not exist). ADDED testingAuthorized signal (explicit 'Testing is only authorised on the targets listed as in scope') and a valid security.txt on the anz.com apex.”

“No vulnerability-reporting channel found for the parent. www.wesfarmers.com.au is a catch-all CMS: /security, /responsible-disclosure, /vulnerability-disclosure, /contact-us and a random slug all return HTTP 200 with <title>404 Page not found</title>, and both /.well-known/security.txt and /security.txt return 200 text/html (the same 404 shell), which is not a security.txt. The real pages found from the homepage nav, /security-privacy ('Security & privacy', website security and privacy notice) and /util/contact ('Contact'), contain no vulnerability, responsible-disclosure or security-researcher text; the only corporate mailbox published is the general 'To contact us, please email us at [email protected]' (not a security contact). HackerOne handle 'wesfarmers' exists but submission_state:null (unclaimed community stub, does not count); subsidiary stubs 'bunnings' and 'kmart' are likewise submission_state:null; officeworks / kmart_group not found. No Bugcrowd /engagements/ brief for wesfarmers, wesfarmers-vdp, bunnings, kmart, kmartgroup, officeworks (all 404). Synack wesfarmers.responsibledisclosure.com does not resolve.”

“Bugcrowd engagement is live (headerProps state "in_progress", rewardAllocation "no_reward", startsAt 2022-03-10, badge safeHarborStatus.status "full": "This engagement is fully committed to providing safe harbor for good-faith security research."). Brief text read via the public changelog JSON (/engagements/macquarie-group-vdp/changelog/46d1a2b6-012c-4bfa-9bbc-6134e09167c0.json), not guessed. Company-authored prose: "Testing is only authorized on the targets listed as in scope." and "Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith." No inbound CVD deadline; the opposite: "This program or engagement does not allow disclosure. You may not release information about vulnerabilities found in this program or engagement to the public." (coordinatedDisclosure=false). Macquarie's own site links to the program: https://www.macquarie.com/au/en/disclosures/security-and-fraud.html says "We encourage reporting of any suspected vulnerabilities in accordance with our Vulnerability Disclosure Program. We will validate and fix vulnerabilities in accordance with this program. Report a vulnerability" (href bugcrowd.com/macquarie-group-vdp). HackerOne "macquariegroup" is an unclaimed stub (submission_state null). No security.txt (404 HTML at /.well-known/security.txt and /security.txt on macquarie.com and www).”

“No vulnerability disclosure channel found. HackerOne "newmont" exists only as an unclaimed community stub (GraphQL submission_state null, state null, policy null; "newmont_corporation" not found). Bugcrowd /engagements/newmont returns 404 "Resource not found". newmont.responsibledisclosure.com does not resolve. https://www.newmont.com/.well-known/security.txt returns HTTP 200 but body is the literal text "Invalid key" with Content-Type text/html (same in the 2024-12-06 Wayback id_ snapshot), so it is not a security.txt; /security.txt is a 404 HTML page. Homepage navigation and footer (About Us, Operations & Projects, Investors, Sustainability, Careers, Contact Us, Suppliers, Legal, Site Map, Privacy Statements, Matching Gifts) carry no security-reporting link or security@ address; web search for a Newmont VDP / bug bounty / security.txt returns only 10-K cybersecurity boilerplate.”

“No vulnerability disclosure channel found. HackerOne slugs goodman / goodman_group / goodmangroup all "Team does not exist" (not even a stub). Bugcrowd /engagements/goodman 404. goodman.responsibledisclosure.com does not resolve. security.txt: www.goodman.com/.well-known/security.txt and /security.txt are 404 (Next.js HTML shell); au.goodman.com both paths 404; Wayback id_ snapshot 2024-12-20 of www.goodman.com/.well-known/security.txt is also a 404. The live www/au/us goodman.com hosts sit behind a Cloudflare JS challenge (403 "Just a moment...") to both curl and WebFetch, so the live homepage/footer could not be read; the 2025-10-17 Wayback id_ copy of https://www.goodman.com/privacy lists only [email protected] and regional privacy-* addresses plus [email protected], with no security or vulnerability-reporting language, and web search across goodman.com surfaces only office-contact, investor and privacy pages.”

“HackerOne "riotinto" (surfaced by web search with the SEO title "Rio Tinto | Vulnerability Disclosure Policy") is an unclaimed community stub: GraphQL submission_state null, state null, policy null; rio_tinto and rio-tinto "Team does not exist". Bugcrowd /engagements/riotinto and /engagements/rio-tinto 404. riotinto.responsibledisclosure.com does not resolve. security.txt at both paths on riotinto.com and www is a 404 ("The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.", text/html). Rio Tinto's own cyber page https://www.riotinto.com/en/sustainability/ethics-compliance/cyber-security is governance prose only ("We invest in enhancing our cyber security measures... We govern cyber security through a Risk Management Committee (RMC) that reports to our Chief Financial Officer") with no reporting instructions, email or researcher language; /en/contact carries no email addresses.”

“HackerOne fortescue / fortescue_metals / fmg all "Team does not exist". Bugcrowd /engagements/fortescue 404. fortescue.responsibledisclosure.com does not resolve. security.txt at both paths on fortescue.com and www redirects to a 404 HTML "Page not found" (og:url fortescue.com/en/404). https://www.fortescue.com/en/contact lists community@, employment@, ffi@, investors@, media@, procurement@, reception@ and [email protected] only; no security, cyber or vulnerability-reporting contact, and no responsible-disclosure text anywhere on the homepage or contact page. Web search for a Fortescue VDP returns nothing company-specific.”

“Bugcrowd engagement is live (headerProps state "in_progress", rewardAllocation "no_reward", startsAt 2022-11-08). Badge read from the public changelog JSON (/engagements/telstra-vdp/changelog/02b46900-9459-4816-9127-17a43d8b3df8.json): safeHarborStatus.status "partial", label "Partial safe harbor", description "This engagement provides a limited goodwill statement about not pursuing legal action related to security research." Company-authored prose in the brief: "Thank you for participating in Telstra Vulnerability Disclosure Program. Telstra takes the security of our systems and our customer data seriously... We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets." and "Testing is only authorised on the targets listed as in scope... Telstra utilises and hosts a number of third-party providers and services which may be listed as subdomains of those which are in scope. We cannot authorise testing against these systems." No CFAA / Criminal Code / DMCA / Copyright Act / Terms carve-out language anywhere in the brief fields (description, targetsOverview, additionalInformation), so L4 is not supported. No inbound CVD deadline (coordinatedDisclosure=false). Telstra's own hub https://www.telstra.com.au/cyber-security-and-safety confirms the channel: "So we've partnered with Bugcrowd on the Vulnerability Disclosure Program so people can submit cyber security vulnerabilities. Explore the disclosure program" (href bugcrowd.com/engagements/telstra-vdp); its "Got a computer security concern" form is a general customer security/privacy concern form, not a VDP. HackerOne "telstra" is an unclaimed stub (submission_state null). No security.txt (404 HTML at both paths on telstra.com.au, www, and telstra.com).”

“No channel found. HackerOne handle 'csl' exists but GraphQL returns submission_state:null, state:null, policy:null = unclaimed community stub, does not count (csl_limited, csllimited, cslltd, cslbehring, seqirus: Team does not exist). Bugcrowd /engagements/csl, /csl-limited, /cslbehring all 404. Synack csl/cslbehring.responsibledisclosure.com do not resolve. csl.com (and cslbehring.com, seqirus.com, which 301 to csl.com) answered HTTP 429 'Vercel Security Checkpoint' on every path tried (/.well-known/security.txt, /security.txt, /security, /contact-us, /vulnerability-disclosure, /responsible-disclosure) from three egress paths (curl, WebFetch, r.jina.ai relay); Web search surfaces no CSL Limited VDP; the only 'CSL' VDP hit (csl-group.com, [email protected]) is CSL Group Ltd, a UK IoT-connectivity company unrelated to CSL Limited (ASX:CSL), do not attribute it. The csl.com data-protection page also returned 429.”

“HackerOne handle 'woodsideenergy' (SEO title 'Woodside Energy | Vulnerability Disclosure Policy') is an unclaimed stub: GraphQL submission_state:null, state:null, policy:null (woodside, woodside_energy: Team does not exist). Bugcrowd /engagements/woodside and /woodside-energy 404. Synack woodside.responsibledisclosure.com does not resolve. https://www.woodside.com/.well-known/security.txt and /security.txt both 404 ('Page not found'). woodside.com/security, /responsible-disclosure, /vulnerability-disclosure return a Cloudflare challenge (403 'Just a moment...'), not content. The company's own Cyber Security page (https://www.woodside.com/sustainability/governance/cybersecurity) describes its internal program (ACSC reporting, SoCI attestation, OT CSIRT, awareness training) and contains no researcher-facing reporting channel, no security contact and no disclosure policy: 'Woodside's approach to Cyber Security remains multi-faceted and dynamic to reflect the changing cyber threat landscape and our expanding global operating footprint.'”

“No channel found. https://www.transurban.com/.well-known/security.txt returns HTTP 200 but text/html (the site homepage, '<!DOCTYPE HTML>... theme--transurban', a catch-all rewrite), which is NOT a security.txt; /security.txt redirects to /security which is 404 ('Transurban Group | Page not found'). linkt.com.au (the consumer brand) behaves the same (/.well-known/security.txt serves the homepage HTML, /security.txt redirects to a 404). transurban.com/security, /security-disclosure, /responsible-disclosure, /vulnerability-disclosure all 404. HackerOne transurban, linkt, transurbangroup: Team does not exist. Bugcrowd /engagements/transurban and /linkt 404. Synack transurban.responsibledisclosure.com does not resolve. transurban.com/contact-us lists only [email protected] and [email protected]; the Linkt 'Scams and fraud' help centre and 'Is it really from us?' pages cover scam reporting only ([email protected], [email protected], [email protected]) with no vulnerability-reporting language. Web search finds only scam-awareness content and third-party security-rating pages.”

“The Woolworths Group contact page still carries a 'Vulnerability Disclosure' heading: 'To report a potential security vulnerability associated with Woolworths Supermarkets, Countdown Supermarkets. Big W, or our Rewards brand, email vulnerabilitydisclosure.com.au' (the visible text is mangled; the mailto href is [email protected]). No policy document is linked from it. The only policy-like prose sits on the BIG W subsidiary scams page under 'Responsible disclosure:' 'Security is core to our values, and we appreciate the input of security researchers acting in good faith to help us maintain a high standard for the security and privacy of our customers... Woolworths expects security researchers to act with integrity and does not condone... Security research that involves potential or actual damage to Woolworths users, systems, applications, customers or partners. Testing and research activities that violate laws and regulations... Woolworths expects security researchers to keep any findings confidential and to provide us a reasonable amount of time to resolve the issue before you disclose it publicly. The linked 'Vulnerability Disclosure Collection Notice' (woolworths.co.nz PDF) is a privacy collection notice only. HackerOne 'woolworthslimited' (SEO title 'Woolworths | Vulnerability Disclosure Policy') is an unclaimed stub: submission_state:null, policy:null. security.txt: woolworthsgroup.com.au 404 both paths; woolworths.com.au 403 (WAF) direct and 404 via relay; everyday.com.au 404. Bugcrowd woolworths/woolworths-group/woolworthsgroup 404; Synack no DNS.”

“Non-pursuit: 'To encourage responsible disclosure, we will not take legal action against security researchers acting in good faith in relation to the discovery and reporting of a potential security vulnerability, provided that all such potential security vulnerabilities are discovered and reported strictly in accordance with this Responsible Disclosure Program. In the event of any non-compliance, we reserve all our legal rights.' Testing is not authorised beyond what the researcher already has: 'We allow you to conduct vulnerability research and testing only on our services and products to which you have authorised access.' and 'you should not engage in any activity that violates applicable laws' (a constraint, not a carve-out; no CFAA/Criminal Code/Copyright Act/DMCA/ToS language). Researcher-side disclosure is restricted, not an inbound deadline: 'Please do not publicly disclose the details of any potential security vulnerabilities without express written consent from us.' 72-hour acknowledgement is a response SLA only. 'QBE does not compensate for disclosure.' Contact: 'emailing our Global Security Operations Centre at [email protected]'. HackerOne 'qbe' is an unclaimed stub (submission_state:null). security.txt 404 at both paths on www.qbe.com (Wayback CDX shows 404 on every capture 2024-2025). Bugcrowd qbe/qbe-insurance 404; Synack no DNS.”

“No channel found. https://www.aristocrat.com/.well-known/security.txt and https://www.aristocrat.com/security.txt both return HTTP 404 when fetched through a path the WAF admits (curl gets a blanket 403 on aristocrat.com; WebFetch reached the privacy-policy and contact-us pages, so its 404 on both security.txt paths is a real 404). aristocrat.com/security, /responsible-disclosure, /vulnerability-disclosure: 403 (WAF) / not found. The Contact Us page lists only [email protected] and [email protected]; the Privacy Policy page has no security-researcher or vulnerability-reporting language. HackerOne aristocrat, aristocratleisure, aristocrat_leisure, aristocrattechnologies, aristocrat_technologies, aristocrattech, pixel_united: Team does not exist. Bugcrowd /engagements/aristocrat, /aristocrat-leisure, /aristocrat-technologies 404. Synack aristocrat.responsibledisclosure.com does not resolve. Web search returns only the 2023 MOVEit 'Statement on Cyber Incident', governance PDFs (whistleblower, risk, continuous disclosure) and no VDP.”

“Coles's only channel is its Bugcrowd engagement, coles-vdp-pro. On 2026-09-17 the engagement is paused, with the notice: "Effective immediately, the Coles VDP program is coming to an end. Bugcrowd and Coles will be working together to continue triaging and validating all submissions that have come in to-date" (paused 23 Jun 2026). The brief still shows Bugcrowd's full "Safe harbor" tier, but with intake closed the level is shown as unverified.”

“Web search for 'Northern Star Resources' + vulnerability/responsible disclosure returns only ESG/governance disclosures.”

“No vulnerability disclosure page on brambles.com (/security and /vulnerability-disclosure 404) or chep.com; /enquiries lists only [email protected]. https://www.brambles.com/critical-updates (their cyber-incident notice page) contains no researcher-reporting instructions. security.txt 404 at both paths on brambles.com and www.chep.com. Trap noted: the 'Bramble Responsible Disclosure Policy' at brmbl.io is an unrelated company (Bramble), not Brambles/CHEP.”

“evolutionmining.com.au redirects to evolutionmining.com; /.well-known/security.txt and /security.txt both 404 (nginx HTML). /security/, /vulnerability-disclosure/, /cyber-security/ all 404. The contact page (https://evolutionmining.com/contact/, WAF 403 to plain curl, 200 with a browser UA) carries no security contact. Trap noted: the web-search hit https://www.evolution.com/vdp-policy/ ([email protected]) belongs to Evolution AB, the Swedish online-casino supplier, not Evolution Mining Ltd.”

“No vulnerability disclosure page: /security, /vulnerability-disclosure, /responsible-disclosure all 404 ('Page not found | Global packaging solutions | Amcor'). /.well-known/security.txt and /security.txt both 404 (Next.js HTML). https://www.amcor.com/contact-us and the privacy policy publish only business/privacy mailboxes ([email protected], [email protected], [email protected]), no security contact. Web search for Amcor vulnerability/responsible disclosure returns only governance and privacy pages.”

“Bugcrowd engagement santos-vdp (read 2026-09-17) carries Bugcrowd's full "Safe harbor" tier. Santos's policy text: "activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate and legal action against you". Santos serves a valid text/plain security.txt ([email protected]) whose Expires date lapsed on 2026-07-21.”

“No vulnerability-disclosure page, policy, or contact found anywhere on computershare.com. https://www.computershare.com/.well-known/security.txt and /security.txt both 404 (text/html). Subdomain probes ic4.computershare.com, www-us.computershare.com and landing.computershare.com return HTTP 200 for /.well-known/security.txt but with Content-Type text/html (SPA/login shells, NOT a security.txt; trap c); www-au / www-uk redirect to https://www.computershare.com/404.asp. Candidate paths /security, /corporate/security, /responsible-disclosure, /vulnerability-disclosure all 404. The corporate homepage (https://www.computershare.com/corporate) and the shareholder-and-other-enquiries contact page carry no security, PSIRT or disclosure link and no email address. HackerOne GraphQL: handles computershare and computershare_vdp return 'Team does not exist'. Bugcrowd /engagements/computershare 404. computershare.responsibledisclosure.com does not resolve. The only third-party trace is an Open Bug Bounty XSS report (openbugbounty.org/reports/159122/), which is not a company channel.”

“Submission: 'To responsibly disclose a suspected vulnerability, please contact the Suncorp Cyber Security Team by emailing [email protected].' Scope: 'the program relates only to the information, systems or services of the Suncorp Group of companies, which does not include Suncorp Bank (Norfina Limited).' No legal commitment of any kind: the page contains no safe-harbor, no 'will not take legal action', no authorization-to-test language; instead 'Suncorp reserves the right to act against individuals engaged in any of the activities listed above' and 'engaging in any activity that seeks unauthorized access to Suncorp systems or software in violation of the law' is listed as prohibited. Confidentiality clause restricts the researcher rather than committing Suncorp: 'By submitting a report to us, you agree to refrain from publicly disclosing, discussing, or confirming the details of any suspected security issues until we have had the opportunity to address them and confirmed this to you in writing.' 'Suncorp does not provide compensation for reporting vulnerabilities.' No security.txt on suncorp.com.au or suncorpgroup.com.au (404 text/html at both paths; suncorpgroup.com.au serves 200 for arbitrary non-file paths but security.txt is a true 404). HackerOne handle suncorpgroup exists but submission_state:null (unclaimed stub, does not count); suncorp and suncorp_vdp not found. No Bugcrowd engagement. Note: www.suncorp.com.au sits behind Imperva and failed DNS resolution from this sandbox; fetched live via --resolve to 45.60.11.44 (HTTP 200) and cross-checked against the Wayback copy.”

“HackerOne handle scentregroup exists (SEO title 'Scentre Group | Vulnerability Disclosure Policy') but GraphQL returns submission_state:null, state:null, policy:null: an unclaimed community stub (trap a), not a program. https://www.scentregroup.com/.well-known/security.txt and /security.txt both 404 text/html; https://www.westfield.com.au/.well-known/security.txt 404 ({"error":"Not found"}) and /security.txt 404. Bugcrowd /engagements/scentregroup, scentre-group, westfield all 404. Own site is Cloudflare-challenged for non-browser clients (403 'Just a moment...' on every path for curl and WebFetch), so read via Wayback: the 2026-01-21 homepage and 2026-01-31 /contact-us snapshots link only /contact-us and westfield.com.au/privacy-policy, no security, disclosure or PSIRT link; Wayback CDX for scentregroup.com shows no URL containing security/vulnerab/disclos other than securityholder (investor) pages and physical-security news. Web search across scentregroup.com and westfield.com.au finds no disclosure policy.”

“https://www.pls.com/.well-known/security.txt and /security.txt both 404 text/html; pilbaraminerals.com.au redirects to www.pls.com (same 404s). HackerOne GraphQL: pilbaraminerals and pls return 'Team does not exist'. Bugcrowd /engagements/pilbaraminerals and /pls 404. Live site is Cloudflare-challenged for non-browser clients (403 'Just a moment...'), so read via Wayback: the 2026-09-15 homepage snapshot exposes the full site navigation (about, assets, sustainability, invest, news, careers, suppliers, privacy-policy, terms-of-use) with no security, vulnerability, responsible-disclosure or PSIRT page and no email address; the 2026-06-21 /contact snapshot likewise. Wayback CDX for pls.com and pilbaraminerals.com.au returns only continuous-disclosure (ASX) documents for the terms security/vulnerab/disclos. Web search finds no PLS disclosure program.”

“the L1 contact_only grade rested on the iag.com.au security.txt, and that file is gone. The brand canonicals are gone too: nrma.com.au (Wayback 2026-02-03) and cgu.com.au (2025-11-20) security.txt are 404, wfi.com.au 404 (2026-01-06), and sgio/sgic have no capture after 2024-01. Live probes of www.iag.com.au, nrma.com.au, cgu.com.au, sgio.com.au, sgic.com.au and iag.co.nz all return Akamai 403 'Access Denied' to non-browser clients on every path including the homepage, so no current IAG page could be read directly; the archived /contact-us (2026-01-04) lists investor.relations@, corporateaffairs@, properofficer@ and similar mailboxes but no security or vulnerability contact, and /privacy-and-security has had no 200 capture since 2019. HackerOne handle iag exists but GraphQL submission_state:null (unclaimed stub, trap a). The Bugcrowd engagements 'iag-transform-vdp-pro' and 'iagloyalty-vdp-pro' that surface in search belong to International Airlines Group (Avios/IAG Loyalty, UK), not Insurance Australia Group (trap e). [email protected] may still be a working mailbox but is no longer published anywhere fetchable, so no verifiable channel exists.”

“Bugcrowd brief read directly via https://bugcrowd.com/engagements/originenergy-og1/changelog/0596f021-4ec5-453c-8ab9-08340895d163.json (not JS-rendered): brief.safeHarborStatus = {status:'full', label:'Safe harbor', description:'This engagement is fully committed to providing safe harbor for good-faith security research.'}; participation 'open', statusLabel 'In progress', productLabel 'Bug Bounty' (paid, not timeboxed), brief published 2026-08-10. Company-authored Safe Harbor section: 'When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; No inbound coordinated-disclosure deadline anywhere in the brief and the engagement flag coordinatedDisclosure is false, so cvdTimeline stays false (L4, not L5). Valid security.txt at /.well-known/security.txt (200, text/plain): '# Please leverage our Vulnerability Disclosure Program (managed by Bugcrowd) for reporting all security issues. Contact: https://bugcrowd.com/engagements/originenergy-og1... Contact: mailto:[email protected] / Policy: https://bugcrowd.com/engagements/originenergy-og1 / Expires: 2027-02-15T14:00:00.000Z'; root /security.txt 404. HackerOne handles originenergy and origin exist as unclaimed stubs (submission_state:null); the Bugcrowd program is the real channel.”

“No security.txt: https://south32.net/.well-known/security.txt and /security.txt return HTTP 404 (IIS 'File or directory not found' HTML); www.south32.net both paths 404; Wayback raw snapshot 20251203 of /.well-known/security.txt is also a 404. The live site sits behind Cloudflare and answers 403 'Attention Required' / 'Just a moment' to every crawler path probed (/security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /trust, /cybersecurity, /contact-us, /sitemap.xml), so the Wayback copy of /contact-us (20251117) was read instead: it offers only a scam-report form ('If you come across any services offering "investments" and using South32 branding... please report them to us using this form') and EthicsPoint ('one of our options for confidentially reporting a business conduct concern'); no vulnerability, security-research or security@ contact anywhere. HackerOne slugs south32 / south32_vdp: 'Team does not exist'. Bugcrowd /engagements/south32 404. Synack south32.responsibledisclosure.com does not resolve. Web search (site:south32.net security vulnerability) surfaces only privacy, anti-bribery and annual-report pages.”

“L3 -> L4. That page directs researchers to 'Submit vulnerabilities to our Bugcrowd program at: https://Bugcrowd.com/engagements/rea-mbb-og' and requires them to 'Adhere to the in-scope, out-of-scope, good behaviour, and terms outlined in our public Bug Bounty Program (whether the researcher chooses to submit via the platform or not)'. The Bugcrowd brief was read this pass via the engagement changelog JSON (brief version d9a84c1d-2911-4875-abbb-696accf7c084): brief.safeHarborStatus.status = 'full' ('This engagement is fully committed to providing safe harbor for good-faith security research') and the REA-authored brief prose carries the full disclose.io/Bugcrowd template: 'Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy'. No HackerOne program (rea-group, rea_group, reagroup, realestate, realestate_com_au, rea all 'Team does not exist').”

“https://lynasrareearths.com/.well-known/security.txt and /security.txt (and www) return 404 HTML ('404 - Not found' / WordPress theme 404). Own-site sweep: /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /trust, /cybersecurity all 'Page not found - Lynas Rare Earths'. The WordPress page-sitemap.xml lists no security/disclosure page; the only 'security' hit is /location-security/ ('Location Security - Lynas Rare Earths'), a physical-site page. /contact/ exposes only [email protected], [email protected] and [email protected]; no security contact. Web search finds only the Continuous Disclosure Policy (ASX market disclosure), a whistleblower program and ESG reports. HackerOne slugs lynas / lynasrareearths / lynas_rare_earths: 'Team does not exist'. Bugcrowd /engagements/lynas 404. Synack lynas.responsibledisclosure.com does not resolve.”

“promed.com.au and www.promed.com.au answer HTTP 406 'Not Acceptable... generated by Mod_Security' (HTML) for both /.well-known/security.txt and /security.txt; the Wayback raw snapshot (20251003) of /.well-known/security.txt is a 404 theme page, so no security.txt exists. Own-site sweep with a browser UA: /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /trust, /cybersecurity all 'Page not found - Pro Medicus'. /contact/ lists only [email protected] and [email protected] (product support), and the privacy statement only [email protected] for privacy complaints; no security or vulnerability contact. Subsidiary visageimaging.com (the product company) also has no security.txt at either path and 404s on /security, /responsible-disclosure, /vulnerability-disclosure. Web search returns only the Dec-2025 Visage mailbox-breach coverage and corporate pages, no disclosure policy. HackerOne slugs promedicus / pro_medicus / promed / visage: 'Team does not exist'. Bugcrowd /engagements/promedicus and /pro-medicus 404. Synack promedicus.responsibledisclosure.com does not resolve.”

“https://sghl.com.au/.well-known/security.txt and /security.txt (and www) return 404 HTML ('Page not found » SGH Ltd'). Own-site sweep: /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /trust, /cybersecurity all 'Page not found » SGH Ltd'; homepage links only /contact and /privacy. /contact exposes only [email protected] plus a scam warning ('Official communications from SGH will only ever come from the domain @...'); no security or vulnerability contact. Subsidiary domains www.westrac.com.au, www.coates.com.au, www.boral.com.au all 404 on /.well-known/security.txt (checked for completeness; parent is what is graded). Web search returns only annual reports, modern-slavery statements and portfolio pages. HackerOne slugs sevengroup / seven_group_holdings / sghl / sgh: 'Team does not exist'. Bugcrowd /engagements/sghl and /seven-group 404. Synack sghl.responsibledisclosure.com does not resolve.”

“https://soulpatts.com.au/.well-known/security.txt and /security.txt (and www) return 404 with a Next.js HTML shell (text/html, no Contact: line). Own-site sweep: /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /trust, /cybersecurity all '404: This page could not be found.'; homepage links only /contact and /privacy-policy. /contact exposes only [email protected] and the Computershare registry address [email protected]; no security or vulnerability contact. Web search (Soul Pattinson / soulpatts vulnerability disclosure) returns only ASX filings, the privacy policy PDF and investor FAQs. HackerOne slugs soulpatts / soul_pattinson / whsp: 'Team does not exist'. Bugcrowd /engagements/soulpatts 404. Synack soulpatts.responsibledisclosure.com does not resolve.”

“No security.txt: https://www.jameshardie.com/.well-known/security.txt and /security.txt both return 404 text/html (SPA shell). Privacy policy (https://www.jameshardie.com/privacy-policy/) has no vulnerability/researcher/disclosure language; only email is [email protected] (data-protection officer, not a security channel). Web search for James Hardie vulnerability disclosure / responsible disclosure returns only IR filings, governance policies and the employee ethics hotline. HackerOne slugs jameshardie / james-hardie / james_hardie: 'Team does not exist'. Bugcrowd /engagements/jameshardie and /james-hardie: 404. Synack jameshardie.responsibledisclosure.com: no DNS. Common paths (/security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /trust etc.) on www.jameshardie.com: none return 200.”

“Bugcrowd engagement qantas-vdp-ess (read 2026-09-17) carries Bugcrowd's full "Safe harbor" tier ("This engagement is fully committed to providing safe harbor for good-faith security research"); the program's change log shows the tier was raised from partial on 2025-10-30. Qantas's security.txt, served at both standard paths, routes reports to [email protected].”

“https://www.bluescope.com/.well-known/security.txt and /security.txt: 404 text/html. Privacy policy (https://www.bluescope.com/privacy-policy) and contact page (https://www.bluescope.com/contact) contain no vulnerability / security-researcher / responsible-disclosure language and expose no security email. Web search for BlueScope vulnerability disclosure returns only the ASX Continuous Disclosure Policy (financial disclosure, not security), governance pages and 2020 ransomware coverage. HackerOne bluescope / bluescopesteel / bluescope_steel: 'Team does not exist'. Bugcrowd /engagements/bluescope and /bluescope-vdp: 404. Synack bluescope.responsibledisclosure.com: no DNS. Common security paths on www.bluescope.com: none 200.”

“https://www.mineralresources.com.au/.well-known/security.txt and /security.txt: 404 text/html (Next.js error shell). Privacy policy (https://www.mineralresources.com.au/privacy-policy/) has no vulnerability / researcher / responsible-disclosure language; emails on it are [email protected], [email protected] and a named individual, none a security channel. Web search for MinRes vulnerability disclosure returns only ethics/integrity, privacy, governance and supply-chain pages (the 'security' references are physical-security licensing under the WA Security and Related Activities (Control) Act 1996). HackerOne mineralresources / mineral-resources / minres: 'Team does not exist'. Bugcrowd /engagements/mineralresources, /mineral-resources, /minres: 404. Synack: no DNS. Common security paths: none 200.”

“https://apa.com.au/.well-known/security.txt and /security.txt (and www.): 404 text/html (Next.js error shell). Privacy statement (https://apa.com.au/privacy-statement) and contact page (https://www.apa.com.au/contact-us) contain no vulnerability / researcher / responsible-disclosure language; emails exposed are [email protected], [email protected] and the MUFG share-registry address, none a security channel. Web search for 'APA Group' vulnerability disclosure returns only unrelated Australian bodies (APSC, APRA, Australian Payments Plus, American Psychological Association on HackerOne). HackerOne apa / apagroup / apa_group / apa-group: 'Team does not exist'. Bugcrowd /engagements/apa, /apa-group, /apagroup: 404. Synack apa/apagroup.responsibledisclosure.com: no DNS. Common security paths on apa.com.au: none 200.”

“The 'Security and privacy' help page (https://www.medibank.com.au/help/security-and-privacy/) says only "We're working 24/7 to help keep your personal and health data safe and secure" with no researcher reporting channel; the privacy page (https://www.medibank.com.au/privacy/) exposes only [email protected] and [email protected]. A web search for the exact string [email protected] returns no page containing it. Web search for Medibank vulnerability disclosure / bug bounty returns only 2022 breach coverage and other companies' programs. HackerOne medibank / medibankprivate / medibank_private: 'Team does not exist'. Bugcrowd /engagements/medibank, /medibank-vdp, /medibank-private: 404. Synack medibank.responsibledisclosure.com: no DNS. Common security paths on www.medibank.com.au: none 200.”

“security.txt (200, text/plain, PGP-signed) at https://wisetechglobal.com/.well-known/security.txt: "Contact: mailto:[email protected]" / "Expires: 2026-11-27T22:45:02z" / "Canonical: https://www.wisetechglobal.com/.well-known/security.txt" / "Canonical: https://www.cargowise.com/.well-known/security.txt" (identical file served at https://www.cargowise.com/.well-known/security.txt). No Policy: line. Root /security.txt is 404. The only security page, https://www.wisetechglobal.com/what-we-do/information-security/, is an ISO 27001 / SOC assurance page ("vulnerability detection processes", "View our latest certificates and reports") with zero disclosure, researcher, CSIRT or reporting language. /security, /trust, /responsible-disclosure, /vulnerability-disclosure, /legal/responsible-disclosure all 404. No HackerOne team (wisetech, wisetechglobal, wisetech_global, wisetechglobal_vdp, cargowise all NOT_FOUND), no Bugcrowd /engagements/ (wisetech, wisetechglobal 404), Synack wisetechglobal/wisetech.responsibledisclosure.com no DNS.”

“Xero's own policy page (200) under the heading "Safe harbour": "Provided you're conducting vulnerability research in line with the terms set out here, we consider this research to be: authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; exempt from restrictions in our terms of use or other relevant terms and conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and lawful, helpful to the overall security of the Internet, and conducted in good faith." Page ends "Ready to disclose a security issue? Submit a security issue" linking to bugcrowd.com/engagements/xero-vdp-pro. Bugcrowd brief read via changelog JSON (https://bugcrowd.com/engagements/xero-vdp-pro/changelog/1547a736-9a83-4e30-8d34-37bb413b4dcd.json): name "Xero Vulnerability Disclosure Engagement", participation "open", rewardAllocation "no_reward", publishedAt 2024-11-26; brief.safeHarborStatus = {status:"partial", label:"Partial safe harbor"} (Bugcrowd badge), but the brief prose carries the full template: "Testing is only authorized on the targets listed as in scope" and "Safe Harbor:... Authorized in accordance with the Computer Fraud and Abuse Act (CFAA)... Exempt from the Digital Millennium Copyright Act (DMCA)... Exempt from restrictions in our Terms of Use". coordinatedDisclosure:false in the brief and no inbound disclosure deadline anywhere on the Xero page, so cvdTimeline false (L4, not L5). No security.txt (both paths 404 HTML). No HackerOne team (xero, xero_vdp, xero-vdp NOT_FOUND).”

“"The Lottery Corporation Responsible Disclosure Statement" (200): "Provided that you follow these guidelines when reporting an issue to us, we commit to: Not pursue legal action related to your discovery and reporting of the vulnerability (in relation to any non-compliance with these guidelines, we reserve all of our legal rights); Work with you to understand and resolve the issue quickly (including an initial confirmation of your report within 10 working days upon receipt of submission)". Scope: "This Statement covers any product or service we own." Submit: "To report a security vulnerability or security defect, email [email protected]." No authorization to test and an explicit disclaimer: "This Statement is intended to align with all relevant legislative requirements and does not give you permission to breach any laws nor cause us to breach any laws." Disclosure clause restricts the researcher rather than committing the org: "Keep information about the discovery... confidential between you and us until sufficient time has passed to resolve the matter, but no less than 90 days" and "once a security vulnerability is resolved we will agree upon a date for you to be able to disclose your findings". security.txt (200 text/plain, PGP-signed): "Contact: mailto:[email protected]", "Encryption: https://thelotterycorporation.com/.well-known/pgp-key.txt", "Expires: Fri, 31 Jan 2027"; root /security.txt serves the HTML policy page (not a security.txt). Hall of Fame lists two researchers. HackerOne: tlc handle exists but submission_state:null (unclaimed stub, and not evidently this company); thelotterycorporation, lottery_corporation, the_lottery_corporation, thelott NOT_FOUND. Bugcrowd /engagements/thelotterycorporation and lottery-corporation 404. Synack no DNS.”

“No channel found. https://www.vicinity.com.au/.well-known/security.txt returns HTTP 301 with Location pointing to itself (CloudFront redirect loop; curl gives up after 10 redirects, never a text/plain body); root /security.txt is a Next.js 404 page. Wayback CDX for the same path shows only 301/308 captures from 2023-06/07 and no 200 snapshot (archive partially offline at audit time). Homepage (200, 215 KB) link scan finds only /contact-us, /investors/security-price, /privacy-policy; /security and /responsible-disclosure are 404; contact-us page lists feedback@, investor.relations@, media.relations@ etc. but no security@ or cyber contact. No HackerOne team (vicinity, vicinitycentres, vicinity_centres NOT_FOUND), no Bugcrowd /engagements/ (vicinity, vicinity-centres 404), Synack vicinity.responsibledisclosure.com no DNS. Web search returns nothing Vicinity-specific.”

“No channel found. Both /.well-known/security.txt and /security.txt return HTTP 200 but redirect to the Sitecore HTML error page https://www.alsglobal.com/Errors/Error404?item=%2f.well-known%2fsecurity (text/html, not a security.txt). /en/security, /en/responsible-disclosure, /en/vulnerability-disclosure, /security all land on the same Error404 page. The full sitemap.xml (2.27 MB) contains no URL matching secur/disclos/vuln/trust/cyber. The only security-adjacent page is https://www.alsglobal.com/en/cyber-incident ("Cyber incident updates... Update: 24 June 26... ALS is aware that a threat actor has published information online that it claims was obtained from ALS systems during the cyber incident identified in May 2026"), a breach-notification page with no researcher reporting channel. The Data Protection and Cybersecurity Statement PDF names only [email protected] and [email protected]. No HackerOne team (als, alsglobal, als_limited, alsglobal_vdp NOT_FOUND), no Bugcrowd /engagements/ (als, alsglobal 404), Synack alsglobal/als.responsibledisclosure.com no DNS.”

“The rest of the site (homepage, /security, /responsible-disclosure, /cyber-security, /contact-us, /sitemap/sitemap-index.xml) answers every curl UA tried (Chrome, curl, Googlebot, custom) and WebFetch with a Cloudflare 403 "Just a moment" JS challenge, so company-page coverage is WAF-limited; robots.txt (200) only points at /sitemap/sitemap-index.xml, itself challenged. Web search returns nothing Charter Hall-specific. No HackerOne team (charterhall, charter_hall, charterhallgroup NOT_FOUND), no Bugcrowd /engagements/ (charterhall, charter-hall 404), Synack charterhall.responsibledisclosure.com no DNS.”

“No vulnerability-reporting channel found. https://www.nextdc.com/about-us/security-risk-management (200) is a marketing page about physical/data-centre security with no researcher contact, no disclosure policy and no security email; the only addresses on nextdc.com contact/home pages are [email protected] and [email protected]. /.well-known/security.txt and /security.txt both 404 (text/html). /security, /responsible-disclosure, /vulnerability-disclosure all 404. HackerOne GraphQL: handles nextdc and nextdc_vdp return 'Team does not exist'. Bugcrowd /engagements/nextdc 404. Synack nextdc.responsibledisclosure.com does not resolve. Web search (site:nextdc.com vulnerability/responsible disclosure) surfaces only the corporate Continuous Disclosure Policy PDF (ASX listing-rule disclosure, not security).”

“Orica now publishes a dedicated 'Vulnerability disclosure' statement at https://www.orica.com/vulnerability-disclosure (also /frfr/ and /ruru/ locale copies), first captured by the Wayback Machine 2026-08-31, i.e. new since the June audit. Quotes: 'Orica welcomes reports of suspected security vulnerabilities from customers, security researchers, suppliers, partners, and members of the public.' / 'Please email suspected vulnerability reports to: [email protected]' (address is Cloudflare-obfuscated in the HTML, decoded from data-cfemail). Scope: 'You may report suspected vulnerabilities affecting Orica owned or Orica operated: public websites; customer, supplier, or partner portals; applications and mobile apps; Cloud hosted services; Internet accessible systems; APIs or online services; and digital products, software, firmware...' plus a list of 'Activities that are not authorised'. Response: 'will aim to acknowledge receipt within five business days'. 'Orica does not currently operate a bug bounty program and does not offer financial rewards.' Legal posture: the page asks researchers to 'act in good faith' and 'comply with applicable laws and regulations' but contains NO non-pursuit promise, no explicit authorisation of testing, and no carve-out of the Criminal Code / Copyright Act / Terms, so L2 (scope + how to submit, no legal commitment). Disclosure: 'Orica supports coordinated vulnerability disclosure. We ask that you do not publicly disclose... until Orica has had a reasonable opportunity to investigate' = researcher restriction, no inbound deadline, so cvdTimeline false. No security.txt confirmable (403 challenge on both paths; Wayback has no capture of it, 404). HackerOne 'orica' is an unclaimed stub (submission_state:null). Bugcrowd /engagements/orica 404.”

“The carsales 'Responsible Disclosure Program' page still exists (200) and is unchanged ('Last update: April 2024'). Quotes: 'When you're ready to let us know about a potential security vulnerability, please send an email to [email protected]' (PGP key offered); 'Please note, we don't provide any compensation for any reported security vulnerabilities.'; 'Once you have reported the potential security vulnerability, you will receive an e-mail from us confirming we have received your submission. We will investigate your discovery and keep you informed on our progress.' Legal posture is a constraint, not a safe harbour: 'Please don't engage in any activities that violate any laws, breach our website Terms & Conditions... If you do, we will put the handbrake on, cease your participation in the Responsible Disclosure Program and reserve all our legal rights.' No non-pursuit promise, no authorisation, no carve-outs, no disclosure timeline. Hall of Fame lists researchers through 2024. Parent domain cargroup.com has no security page (/security, /responsible-disclosure, /vulnerability-disclosure, /contact all 404) and no security.txt (404 both paths). carsales.com.au/.well-known/security.txt returns 200 but text/html (SPA shell, no Contact: line) so NOT a security.txt; /security.txt redirects to /404/. HackerOne 'carsales' is an unclaimed stub (submission_state:null); cargroup/car_group/carsales_vdp not found. Bugcrowd /engagements/carsales, cargroup, car-group, carsales-vdp all 404.”

“txt). https://www.stockland.com.au/.well-known/security.txt returns 200 text/plain: 'Contact: mailto: [email protected]' / 'Expires: 2027-02-10T22:00:00.000Z' / 'Preferred-Languages: en' / 'Hiring: https://www.stockland.com.au/careers'. No Policy: line and no policy page found on stockland.com.au (/security, /vulnerability-disclosure, /responsible-disclosure, /cyber-security all 404). Root /security.txt is 404 (HTML). HackerOne 'stockland' (https://hackerone.com/stockland, SEO title 'Stockland | Vulnerability Disclosure Policy') is an unclaimed community stub: GraphQL submission_state:null, policy:null, so it does not count. Bugcrowd /engagements/stockland 404; Synack subdomain does not resolve.”

“The only security-related page is https://www.asx.com.au/legals/security-and-fraud, which is a phishing/scam page, not a vulnerability channel: 'Report suspicious emails to [email protected]' and 'Please be aware that this mailbox is for the reporting of suspected phishing e-mails, hoaxes and scams only. A personal response will not be sent.' For anything else it says only 'have any other concerns around the cyber security of ASX assets, please contact us' (link to the generic contact-us page, which lists no security address). No vulnerability disclosure or responsible disclosure policy exists on asx.com.au (/security, /about/security, /vulnerability-disclosure, /responsible-disclosure, /about/cyber-security all 404). security.txt 404 (HTML) on both paths. HackerOne handles asx, asx_vdp, asxlimited: 'Team does not exist'. Bugcrowd /engagements/asx and /asx-limited 404. Synack subdomain does not resolve. Web search returns only ASX's Listing Rule cyber-incident disclosure guidance for listed entities (not ASX's own VDP).”

“Read via the brief changelog JSON (https://bugcrowd.com/engagements/sonic-vdp-pro/changelog/3f4cffdb-b7b7-49e5-ab22-4038907649f1.json): brief.safeHarborStatus = {status:'full', label:'Safe harbor', description:'This engagement is fully committed to providing safe harbor for good-faith security research.'}. Per Bugcrowd docs (https://docs.bugcrowd.com/researchers/disclosure/disclose-io-and-safe-harbor/): 'Full safe harbor status is granted to programs that are committing to all the requirements' of the disclose.io core terms ('Programs displaying the disclose.io logo are committing to a set of core terms that is focused on creating a safe harbor for good-faith security research'), i.e. the disclose.io/Bugcrowd template (authorised under CFAA-equivalent, exempt from DMCA-equivalent, exempt from ToS restrictions). The L4 signals here derive from that program-owner-selected full badge; the company-authored prose itself (identical on the Bugcrowd brief and the sonichealthcare.com page) contains no legal language: 'The Sonic Healthcare vulnerability disclosure policy gives security researchers a point of contact to directly submit their research findings...'; scope 'Any product, service, IP or domain wholly owned by Sonic Healthcare on the public internet'; 'Please note, there may not necessarily be compensation'; disclosure restriction 'Any vulnerability reported under this policy must be kept confidential. Please do not publicly release your research until we have had the opportunity to finish investigating and fixing or mitigating the vulnerability' (researcher restriction, no inbound deadline, so cvdTimeline false). The company page now says 'To learn more about our vulnerability disclosure engagement, or to report a potential vulnerability, please visit: https://bugcrowd.com/engagements/sonic-vdp-pro' and lists 13 acknowledged researchers. security.txt is valid text/plain at BOTH /.well-known/security.txt and /security.txt (www and apex): 'Contact: https://bugcrowd.com/engagements/sonic-vdp-pro' / 'Policy: https://www.sonichealthcare.com/privacy-and-security/vulnerability-disclosure-policy/' / 'Acknowledgments: https://bugcrowd.com/engagements/sonic-vdp-pro/hall_of_fames' / 'Expires: 2034-05-13T13:37:00Z' (WAF returns 403 to non-browser UAs; fine with a browser UA). HackerOne: sonichealthcare, sonic_healthcare, sonic, sonichealthcare_vdp all 'Team does not exist'.”

“com). The SaaS+ Security page states: "concerns in relation to the TechnologyOne SaaS platform can report this to TechnologyOne using any one of the channels below: Log a support case and identify it as a security/privacy issue and request a P1 rating / Email [email protected] or [email protected] to notify TechnologyOne of a privacy or security breach, data breach or to request data breach support/investigations". This is a customer breach-notification contact, not a researcher disclosure policy: no scope, no submission guidance for external researchers, no safe-harbor or authorisation language, no security.txt. READ VIA WAYBACK ONLY: every technology1.com / technologyonecorp.com /.co.uk /.co.nz URL returns a Cloudflare 403 JS challenge to curl and WebFetch (the 2026-07-23 Wayback capture of this page also captured the challenge); the quote is from the 2025-10-05 Wayback snapshot (https://web.archive.org/web/20251005161919id_/https://www.technology1.com/saas-plus/security), identical text in the 2025-02-02 snapshot. HackerOne: technologyone/technology1/technology_one/technologyone_vdp/technologyone_ltd/technology_one_ltd/t1 all NOT_FOUND. Bugcrowd /engagements/technologyone, technology1, technology-one all 404. Synack technologyone/technology1.responsibledisclosure.com do not resolve. /.well-known/security.txt and /security.txt on technology1.com, www.technology1.com, technologyonecorp.com: 403 HTML challenge (Wayback: 404 HTML on both www.technology1.com and www.technologyonecorp.com).”

“No vulnerability-reporting channel found. hackerone.com/thegptgroup EXISTS but is an unclaimed community-curated STUB: GraphQL team(handle:"thegptgroup") returns {"submission_state":null,"state":null,"policy":null} and the page body reads "community-curated security page documents any known process for reporting a security vulnerability to The GPT Group"; per trap (a) this does not count. www.gpt.com.au/.well-known/security.txt and /security.txt: 404 (text/html). www.gpt.com.au/security, /vulnerability-disclosure, /responsible-disclosure: 404. Privacy policy (https://www.gpt.com.au/privacy-policy) lists only [email protected] for privacy matters, no security contact; contact page (https://www.gpt.com.au/contact) has no security mention and no email addresses. Homepage footer links: contact, privacy-policy, securityholder-communications (investor, not infosec).”

“No vulnerability-reporting channel found. www.greatland.com.au/.well-known/security.txt and /security.txt: 404 (WordPress HTML). /security and /vulnerability-disclosure: 404. Privacy policy (https://www.greatland.com.au/privacy-policy/) names only [email protected] for privacy matters and a "Speak up" whistleblower link; nothing about security vulnerabilities. Contact page (https://www.greatland.com.au/contact/) lists only [email protected] and no security/cyber mention. Homepage footer links: contact, privacy-policy only.”

“No vulnerability-reporting channel found on the parent (ramsayhealth.com) or the Australian site (ramsayhealth.com.au). www.ramsayhealth.com/.well-known/security.txt and /security.txt: 404 (HTML). www.ramsayhealth.com.au/.well-known/security.txt and /security.txt: 200 but text/html "Not Found | Ramsay Health Care" page, not a security.txt (trap c). /security, /vulnerability-disclosure, /responsible-disclosure, /en/security: 404. Group privacy policy (https://www.ramsayhealth.com/en/privacy-policy/) and summary give only [email protected] for privacy matters; AU privacy policy: "By email: [email protected]... Attention: Corporate Privacy Officer". Homepage footers list only contact, privacy, terms and the Speak Up (whistleblower) program; no security or disclosure page.”

“No vulnerability-reporting channel found. qube.com.au and www.qube.com.au /.well-known/security.txt and /security.txt: 404 (nginx HTML). /security and /vulnerability-disclosure: 403 (site returns 403 to curl for unknown paths; WebFetch reads the site). Homepage footer (https://qube.com.au/) links only Privacy Policy (/privacy/), Website Terms of Use, Ethical Conduct; no security or disclosure page.”

“No vulnerability-reporting channel found. www.jbhifi.com.au/.well-known/security.txt: 404 (HTML); www.jbhifi.com.au/security.txt: 404 (empty text/plain body, Shopify catch-all, no Contact: line). Shopify /pages/security, /pages/vulnerability-disclosure, /pages/responsible-disclosure, /pages/report-a-vulnerability, /pages/security-vulnerability: all 404. Privacy policy resolves to the Zendesk-backed help article https://www.jbhifi.com.au/pages/help-and-support/360052938974, which is fully client-rendered (live HTML and the 2026-09-07 Wayback capture contain no article text, no email addresses); the underlying Zendesk host (support.jbhifi.com.au, jbhifi.zendesk.com) 301s back to the shell or serves a Cloudflare challenge, so the article body could not be read and no security contact was observable. Homepage HTML exposes no security/disclosure/privacy links (menu is JS-rendered). Search budget exhausted before a JB Hi-Fi-specific bug-bounty query could run; no platform program exists on HackerOne/Bugcrowd/Synack under any tried slug.”

“Page live 2026-09-17 (HTTP 200, title 'Vulnerability Disclosure Policy | Ampol'). Expectations: 'Extend Safe Harbour for your vulnerability research that is related to this policy'. Safe Harbour section verbatim: 'When conducting vulnerability research according to this policy, we consider this research conducted under this policy to be: Authorised in view of any applicable anti-hacking law; Authorised in view of relevant anti-circumvention laws; Lawful, helpful to the overall security of the Internet, and conducted in good faith.' Scope lists *.ampol.com.au, *.ampcharge.com.au, *.ugoselfserve.com.au, *.ampol.com.sg, *.ampolusa.com plus four /24s. Channel: 'The Official Channel for reporting vulnerabilities is the HackerOne submission form on this page' (the embedded HackerOne form is JS-rendered and not present in the static HTML; no hackerone.com program handle is exposed and GraphQL finds no team for ampol/ampol_vdp/ampolaustralia). No ToS carve-out language. Not L5: 'You must gain explicit permission from Ampol Australia before disclosing any issues identified' (restricts the researcher; no inbound disclosure deadline). security.txt at /.well-known/security.txt and /security.txt both return 200 text/html (Next.js shell), so no valid security.txt.”

“No vulnerability-reporting channel found. The only security-adjacent corporate page, https://www.cochlear.com/global/en/corporate/data-privacy-and-security (200, last updated 27 Oct 2025), contains no vulnerability / researcher / disclosure language; its only contact instruction is 'If you have further questions about our approach to data privacy and security, please contact your local customer service team.' /.well-known/security.txt and /security.txt on www.cochlear.com both 404. Global, AU and US sitemaps contain no security/vulnerability/disclosure/PSIRT URL. Guessed paths (/security, /responsible-disclosure, /vulnerability-disclosure, /global/en/corporate/product-security,.../report-a-vulnerability) all 404. Web search for Cochlear vulnerability disclosure returned nothing Cochlear-specific.”

“https://www.tpgtelecom.com.au/.well-known/security.txt returns 200 text/plain with body: 'Contact: mailto:[email protected] / Expires: 2027-01-01T01:00:00.000Z / Preferred-Languages: en'. No Policy: line. Identical security.txt is served on brand domains www.tpg.com.au and www.iinet.net.au (both 200 text/plain, same Contact). Root /security.txt is 404. No policy document anywhere on tpgtelecom.com.au (/security, /vulnerability-disclosure, /responsible-disclosure, /vulnerability-disclosure-program all 404 'OOPS! | TPG Telecom'; sitemap has no security/disclosure URL; Group Privacy Policy and Contact pages carry no vulnerability language). HackerOne hackerone.com/tpg_telecom exists but GraphQL returns submission_state:null / state:null / policy:null and the page is a 'community-curated security page' STUB, so it does not count as a program.”

“www.atlasarteria.com is a Next.js SPA with a catch-all router: /.well-known/security.txt, /security.txt, /security, /vulnerability-disclosure and a random nonexistent path (/zzz-nonexistent-qqq) ALL return 200 text/html with the same app shell (title 'Visual Editor'), so the 200s are not security.txt files or policy pages (trap c). The shell HTML contains zero occurrences of 'vulnerab'. Sitemap lists only /about/legal-framework, /contact, /privacy-policy and no security or disclosure page; the Privacy Policy and Contact Us pages mention 'robust cybersecurity measures' in SEO metadata only, with no reporting channel.”

“/.well-known/security.txt and /security.txt on perseusmining.com both 404 (text/html WordPress 404). /security and /vulnerability-disclosure return 404 'Page not found - Perseus Mining'. WordPress sitemap index (page-sitemap.xml) lists only privacy-policy, contact and occupational health-and-safety pages; no cyber/vulnerability/disclosure page. Privacy Policy and Contact Us pages contain no vulnerability-reporting language. Web search returned only perseus.de (an unrelated German company) and Perseus Mining's environmental/TSF disclosure page.”

“Wayback CDX shows only 404 captures of /.well-known/security.txt from 2023-06 through 2026-01 (no text/plain capture ever). HackerOne hackerone.com/aurizon exists but GraphQL returns submission_state:null / state:null / policy:null and the page is a 'community-curated security page' STUB (trap a), so no program. /security, /vulnerability-disclosure, /responsible-disclosure redirect to /404-error. Sitemap has only /contact and /privacy-policy (no security page); Privacy policy and Contact pages carry no vulnerability-reporting language.”

“No disclosure channel found. HackerOne handle `mirvac` exists but GraphQL returns {"submission_state":null,"state":null}: an unclaimed community-curated stub, not a program (trap a). security.txt: 404 text/html at https://mirvac.com/.well-known/security.txt, /security.txt, and both www variants. Sitemap (https://www.mirvac.com/sitemap.xml) has no security/disclosure/vulnerability page; the only cyber page, https://www.mirvac.com/cyber-security-awareness-guide, is customer scam-awareness advice ("Use our simple security checklist to help protect yourself... please contact your legal representation or a Mirvac team member over the phone") with no vulnerability-reporting instruction or address. Contact page lists only state customer mailboxes ([email protected] etc.); privacy policy lists [email protected] only (0 hits for 'vulnerab'/'cyber'). Probed /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /cyber-security, /security-policy, /bug-bounty: none 200.”

“No disclosure channel found. security.txt: 404 text/html at https://genesisminerals.com.au/.well-known/security.txt and /security.txt (www redirects to apex, same 404). HackerOne genesisminerals, genesis_minerals, genesisminerals_vdp: "Team does not exist" (the search hits hackerone.com/genesis_mining and hyundai-genesis are unrelated companies). WordPress sitemap_index.xml sub-sitemaps contain no security/disclosure/vulnerability page; only /contact-us/ and email-alert pages. Contact page (live 403 to curl; read via Wayback 2026 snapshot) lists [email protected] only, 0 hits for 'vulnerab'/'cyber'. Probed /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /cyber-security, /security-policy, /bug-bounty: none 200.”

“No disclosure channel found. security.txt: apex and www both 404 (text/html 404Error page) at /.well-known/security.txt and /security.txt. HackerOne challenger, challenger_vdp, challengerlimited, challengerau: "Team does not exist". Sitemap (https://www.challenger.com.au/sitemap.xml) has privacy, contact-us, complaints pages but no security/disclosure/vulnerability page; the 'Stronger-super-disclosures' hits are financial-product disclosures. Contact page lists [email protected]; privacy page lists [email protected] plus OAIC/AFCA addresses; 0 hits for 'vulnerab'/'cyber'/'security incident' on either. Probed /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /cyber-security, /security-policy, /bug-bounty: none 200.”

“No disclosure channel found. security.txt: nginx 404 text/html at https://whitehavencoal.com.au/.well-known/security.txt, /security.txt, and both www variants. HackerOne whitehavencoal, whitehaven, whitehaven_coal: "Team does not exist". WordPress sitemap_index sub-sitemaps contain no security/disclosure/vulnerability page (the 'disclosure' hits are the ASX Continuous Disclosure Policy PDF and environmental reports). /contact/ page has no email address and 0 hits for 'vulnerab'/'cyber'/'security incident'; /privacy-policy/ 404. Probed /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /cyber-security, /security-policy, /bug-bounty: none 200.”

“No disclosure channel found. Live site WAF-blocks every non-browser fetch (403 text/html on /, /.well-known/security.txt and /security.txt for desktop, mobile and curl UAs, and WebFetch), so security.txt was checked via Wayback raw: https://web.archive.org/web/2id_/https://www.eagersautomotive.com.au/.well-known/security.txt resolves to a 2026-01-02 snapshot that is a 404 HTML page, and the root /security.txt has no Wayback capture at all. HackerOne eagersautomotive, eagers, eagers_automotive, apeagers: "Team does not exist". Wayback homepage snapshot 2026-09-08 has only annual-reports, contact-us and privacy-policy links, no security page; contact-us lists [email protected] only, 0 hits for 'vulnerab'/'cyber'. Web search surfaces only coverage of the Dec-2023 cyberattack on Eagers, no disclosure program. Probed 10 likely paths: all 403 (WAF), none confirmable; treated as absent given no sitemap, no Wayback evidence, and no third-party reference.”

“No disclosure channel found. security.txt: 404 text/html at https://www.dexus.com/.well-known/security.txt and /security.txt (apex redirects to www). HackerOne dexus, dexus_vdp, dexusgroup: "Team does not exist". Sitemap (https://www.dexus.com/sitemap.xml) has no security/disclosure/vulnerability page; 'securities' hits are REIT fund pages. Contact page lists [email protected] and registry mailboxes; privacy policy lists [email protected] plus OAIC/NZ privacy addresses; 0 hits for 'vulnerab'/'cyber'/'security incident' on either. Probed /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /cyber-security, /security-policy, /bug-bounty: none 200. Web search returns only a third-party UpGuard rating page, no Dexus-authored policy.”

“No vulnerability disclosure channel found. security.txt: https://igo.com.au/.well-known/security.txt and /security.txt (and www. variants) all return HTTP 404 text/html ('404 - File or directory not found.'). Site paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /cyber-security, /trust all 404. Sitemap has no security/vulnerability/disclosure URLs. Privacy policy (https://www.igo.com.au/site/utilities/privacy-policy) only says 'IGO takes reasonable steps to ensure the security of your personal information' and publishes no security contact. HackerOne GraphQL: igo, igo_limited, igolimited all 'Team does not exist'. Bugcrowd /engagements/igo 404. Synack igo.responsibledisclosure.com does not resolve. Web search for IGO + 'vulnerability disclosure'/'responsible disclosure' returned nothing for igo.com.au.”

“No vulnerability disclosure channel found. security.txt: https://www.worley.com/.well-known/security.txt and /security.txt both return HTTP 404 text/html ('The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.'). Site paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /cyber-security, /trust all 404. Sitemap (https://www.worley.com/sitemap.xml) contains only investor/media contact pages (ir-contacts, media-requests, contact-us) and no security, vulnerability or disclosure URL; /en/contact-us publishes no security or cyber contact. HackerOne GraphQL: worley, worleyparsons, worley_vdp all 'Team does not exist'. Bugcrowd /engagements/worley 404. Synack worley.responsibledisclosure.com does not resolve. Web search returned only third-party breach coverage (Clop, Nov 2025), no Worley-authored disclosure policy.”

“com.au). Policy page still live (HTTP 200, title 'Vulnerability Disclosure Policy | Endeavour Group'); the contact email is Cloudflare-obfuscated in the HTML and decodes to [email protected]. Scope: 'This Vulnerability Disclosure policy applies to independent security researchers for any internet facing systems or Software as a Service (SaaS) cloud services.' How to submit: 'To report a security vulnerability to the Endeavour Group Cyber Security team email [email protected] with the subject: INDEPENDENT SECURITY RESEARCHER ADVISORY.' No legal commitment, only a reservation of rights: 'It will be viewed as a collaboration if security vulnerabilities are reported to us in accordance with this policy. In the event that a security vulnerability is not reported in accordance with this policy, we reserve all of our legal rights. We acknowledge that responsible security research will occur and will work with the security research community.' No non-pursuit promise, no authorisation to test, no Criminal Code / Copyright Act / ToS carve-out. Disclosure clause restricts the researcher (not an inbound CVD deadline): 'Details of any potential security vulnerabilities must not be publicly disclosed without our express written consent from an appropriately authorised endeavour group employee.' Response SLA only: 'we will aim to respond to you with an initial response within 5 business days.' No bounty ('We do not compensate individuals or organisations'), public recognition with consent. security.txt: /.well-known/security.txt and /security.txt on endeavourgroup.com.au 404 (nginx HTML); danmurphys.com.au and bws.com.au return 403 HTML (WAF), not a security.txt. HackerOne GraphQL: endeavourgroup, endeavour, endeavour_group, endeavourgroup_vdp, edg all 'Team does not exist'. Bugcrowd /engagements/endeavourgroup, /endeavour-group, /endeavour, /edg all 404. Synack does not resolve.”

“No vulnerability disclosure channel found. security.txt: https://capmetals.com.au/.well-known/security.txt and /security.txt both return HTTP 404 with a WordPress HTML 404 page (text/html; charset=UTF-8), not a security.txt. Site paths /security-policy, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /cyber-security, /trust all 404 (/security 301s to an unrelated ASX announcement 'security-class-reinstatement-to-quotation', i.e. securities, not cyber). Sitemaps contain no security/vulnerability/disclosure page; /contact/ and /privacy-policy/ publish no security contact. HackerOne GraphQL: capricornmetals, capmetals, capricorn_metals all 'Team does not exist'. Bugcrowd /engagements/capricornmetals 404. Synack capricornmetals.responsibledisclosure.com does not resolve. Web search returned nothing company-specific.”

“security.txt: https://www.hub24.com.au/.well-known/security.txt returns HTTP 404 (nginx HTML with an Incapsula script); /security.txt returns 200 but the body is the Imperva/Incapsula challenge HTML (text/html), not a security.txt (trap c). www.hub24.com.au is a catch-all behind Incapsula: EVERY path (/security, /responsible-disclosure, /vulnerability-disclosure, and a nonexistent /zzz-nonexistent-xyz) returns HTTP 200 with the same ~1,045-byte challenge shell, so 200s prove nothing. The Yoast sitemaps (page-sitemap.xml, post-sitemap.xml) list NO vulnerability/responsible-disclosure page; they do list https://www.hub24.com.au/cyber-security/, /cyber-security-measures-on-hub24/ and /cyber-security-standard-extended-to-hub24-group/ (sitting alongside the client-facing /cyberhub/ marketing series). Those three pages could not be read: Incapsula blocks curl and WebFetch (empty body), the wp-json API is also challenged, and the Wayback Machine was offline ('Internet Archive services are temporarily offline') during this audit; the one earlier Wayback capture seen (2026-03-17) had also archived the Incapsula shell. HackerOne GraphQL: hub24, hub24_vdp 'Team does not exist'. Bugcrowd /engagements/hub24 404. Synack hub24.responsibledisclosure.com does not resolve. Web search returned nothing HUB24-specific.”

“No vulnerability disclosure channel found. security.txt: https://www.rameliusresources.com.au/.well-known/security.txt and /security.txt both return HTTP 404 with a WordPress HTML 404 page (text/html; charset=UTF-8), not a security.txt. Site paths /security, /security-policy, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /report-a-vulnerability, /cyber-security, /trust all 404. Sitemaps list only /contact/, /privacy-policy/ and /sustainability/reports-disclosures/ (ESG disclosures, not vulnerability disclosure); /contact/ publishes no security contact and the privacy policy only says 'The Company will take all reasonable steps to protect the security of the personal information that it holds.' HackerOne GraphQL: ramelius, rameliusresources, ramelius_resources all 'Team does not exist'. Bugcrowd /engagements/ramelius 404. Synack ramelius.responsibledisclosure.com does not resolve. Web search returned nothing company-specific.”

“Own page: "If you think you've found a security vulnerability, report it via Bugcrowd, who manage our Vulnerability Disclosure Program. All disclosures must be made through Bugcrowd, not directly to Bendigo Bank." and "Bendigo Bank does not compensate individuals or organisations for identifying potential or confirmed security vulnerabilities." Bugcrowd brief read via changelog JSON (brief 'Bendigo Bank Responsible Disclosure Program', engagement code bendigobank-vdp): brief.safeHarborStatus = null (no safe-harbor badge). Brief prose has scope (*.bendigobank.com.au, *.adelaidebank.com.au, *.bendigoadelaide.com.au, Up Bank, iOS/Android apps, 11 additional web targets), rules of engagement ("Unauthenticated testing is only permitted", 6 rps rate limit), and the only legal language is a constraint, not a commitment: "You are expected, as always, to comply at all times with all applicable laws and with the BugCrowd Standard Disclosure Terms". No non-pursuit promise, no authorisation under the Criminal Code / Copyright Act, no ToS carve-out, no disclosure timeline. HackerOne hackerone.com/bendigobank exists but submission_state:null (unclaimed stub, does not count). No security.txt (all four paths on bendigoadelaide.com.au and bendigobank.com.au return HTML 200, not text/plain).”

“Live policy page (Published Time 2026-01-07) read in full: "You can responsibly disclose potential security vulnerabilities to AGL's Global Security Operations Centre by emailing [email protected]. Please use encrypted email if available. By emailing us, you will be deemed to have accepted these AGL's Responsible Disclosure Program terms." Scope/rules present (12 prohibited research types, 3 out-of-scope finding types), response SLA "we will acknowledge your report within 72 hours". Authorisation is restricted, not a grant: "We allow you to conduct vulnerability research and testing only on our services and products to which you have authorised access." No non-pursuit / legal-action language (0 hits for 'legal action', 'safe harbour', 'prosecut', 'Criminal Code', 'Copyright Act'), no ToS carve-out. Disclosure clause is researcher-restricting, not an inbound deadline: "Please do not publicly disclose the details of any potential security vulnerabilities without express written consent from us." Text is identical to the Wayback 2025-07-20 capture (latest in CDX). Note: agl.com.au WAF returns 403 to direct curl/WebFetch (page, sitemap and all four security.txt paths); page content was obtained via the r.jina.ai reader proxy and cross-checked against the Wayback raw snapshot. Wayback capture of /.well-known/security.txt (2026-02-02) is application/json (assetlinks-style), not a security.txt. HackerOne hackerone.com/aglenergy exists but submission_state:null (unclaimed stub).”

“No vulnerability-reporting channel found. security.txt at /.well-known/security.txt and /security.txt on steadfast.com.au and www.steadfast.com.au all 404. Candidate paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /responsible-disclosure-policy, /cyber-security all 404 (after 308 to trailing slash). Full sitemap.xml grep for secur/disclos/vulnerab returns only cyber-insurance marketing articles (e.g. /well-covered/business-insurance/why-your-business-needs-cyber-insurance/), no disclosure page. Privacy policy ([email protected]) and contact-us pages contain no vulnerability/security-researcher wording. No HackerOne team (steadfast, steadfastgroup: 'Team does not exist'), no Bugcrowd /engagements/ (steadfast, steadfast-group: 404), no Synack subdomain.”

“No vulnerability-reporting channel found. security.txt at /.well-known/security.txt and /security.txt on downergroup.com and www.downergroup.com all 404. Candidate paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /responsible-disclosure-policy, /cyber-security all 404 (after 301 to apex). WordPress sitemap index + page-sitemap.xml (255 pages) contain no URL matching secur/disclos/vulnerab/cyber. /contact-us lists only business mailboxes ([email protected], [email protected] etc.), no security address; /privacy/ has no vulnerability or researcher wording. No HackerOne team (downer, downergroup, downer_edi: 'Team does not exist'), no Bugcrowd /engagements/ (downer, downer-group, downergroup, downer-edi: 404), no Synack subdomain; downer.com.au / downergroup.com.au do not resolve.”

“No vulnerability-reporting channel found. security.txt at /.well-known/security.txt and /security.txt on cleanaway.com.au and www.cleanaway.com.au all 404. Candidate paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /responsible-disclosure-policy, /cyber-security all 404. sitemap.xml grep for secur/disclos/vulnerab/cyber matches only /health-services/biosecurity and /health-services/secure-clinical-waste (waste services), no disclosure page. /contact-us and /privacy-statement contain no security email or vulnerability/researcher wording. No HackerOne team (cleanaway: 'Team does not exist'), no Bugcrowd /engagements/ (cleanaway, cleanaway-vdp: 404), no Synack subdomain.”

“No vulnerability-reporting channel found. security.txt at /.well-known/security.txt and /security.txt on regisresources.com.au and www.regisresources.com.au all 404. Candidate paths /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /responsible-disclosure-policy, /cyber-security all 404. WordPress sitemap index: page-sitemap.xml (33 pages) has no security/disclosure page; post-sitemap.xml matches only corporate-governance PDFs (Continuous-Disclosure-Nov-25.pdf, Securities-Trading-Policy-Nov-25.pdf, Tailings-Dam-Disclosure-2025.pdf, Whistleblower-Protection-Policy-Jun-26.pdf), none of which is a vulnerability disclosure policy. /contact lists only [email protected] and IR/PR agency addresses. No HackerOne team (regisresources, regis_resources: 'Team does not exist'), no Bugcrowd /engagements/ (regis-resources, regisresources: 404), no Synack subdomain.”

“https://telixpharma.com/.well-known/security.txt and /security.txt both return HTTP 404 (text/html). Homepage, /contact/, /privacy-policy/ and /legal-notices/ contain no 'vulnerability', 'responsible disclosure' or security-contact text; the only published contact for a related function is 'contact our Privacy Officer via [email protected]' (privacy page). Sitemap index (5 nested sitemaps) lists no URL containing secur/vulnerab/disclos/trust. HackerOne GraphQL for telix, telixpharma, telix_pharmaceuticals: 'Team does not exist'. bugcrowd.com/engagements/{telix,telix-pharmaceuticals,telixpharma}: 404. telix.responsibledisclosure.com: no DNS.”

“The brief's own prose (data.brief.targetsOverview) carries a 'Safe Harbor' section: 'When conducting vulnerability research according to this policy, we consider this research to be: Authorised in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith.' Authorization: 'We invite the security researcher community to test SEEK's web applications and services' and 'Testing is only authorised on assets listed as in scope.' Scope: *.seek.com, *.employer.seek.com, *.seekpass.co, *.jobsdb.com, *.jobstreet.com, plus corporate/API domains and the iOS/Android apps. No inbound coordinated-disclosure deadline (JSON coordinatedDisclosure=false, disclosedReportsEnabled=false; no N-day disclosure clause in the brief), so cvdTimeline=false and L4 not L5. No security.txt: seek.com.au and www.seek.com.au redirect to au.seek.com where /.well-known/security.txt and /security.txt return 404 HTML. HackerOne GraphQL for seek, seek_com_au, seekltd, seek_vdp: 'Team does not exist'.”

“Platform channels are clean: HackerOne GraphQL for westgold and westgold_resources: 'Team does not exist'; bugcrowd.com/engagements/{westgold,westgold-resources}: 404; westgold.responsibledisclosure.com: no DNS.”

“https://www.metcash.com/.well-known/security.txt and /security.txt return HTTP 404 (text/html); the apex metcash.com and metcash.com.au variants 301 to the www homepage (HTML, not a security.txt). page-sitemap.xml lists only /legal/, /legal/privacy-policy/, /legal/terms-conditions/, /legal/credit-data-policy/, /legal/group-and-third-party/ and /contact/ as legal/contact pages; none of /legal/, /contact/ or /legal/privacy-policy/ contains 'vulnerability', 'responsible disclosure' or a security mailbox. The contact page lists only business, careers ([email protected]), privacy ([email protected]) and 'Metcash Speak Up' (whistleblowing) channels. HackerOne GraphQL for metcash and metcash_vdp: 'Team does not exist'. bugcrowd.com/engagements/metcash: 404. metcash.responsibledisclosure.com: no DNS.”

“https://thea2milkcompany.com/.well-known/security.txt and /security.txt return HTTP 404 (Next.js HTML); the www host 301s to the homepage. The 1,153-URL sitemap contains no security/vulnerability/trust page (its only 'disclosure' hits are ASX 'disclosure of relevant interests' announcements). /legal, /contacts and /privacy-policy contain no 'vulnerability' or 'security research' text; the only related contact is 'Privacy Officer Email: [email protected]'. The consumer domain a2milk.com is a catch-all SPA (any path, including /zzq-random-slug-xyz, returns 200 with an ~8 KB shell and zero policy text), so its 200s for /vulnerability-disclosure are not a policy; a2milk.com and a2milk.com.au security.txt both 404. HackerOne GraphQL for a2milk, thea2milkcompany, a2_milk_company, a2milkcompany: 'Team does not exist'. bugcrowd.com/engagements/{a2milk,a2-milk-company,the-a2-milk-company}: 404. a2milk/thea2milkcompany.responsibledisclosure.com: no DNS.”

“Ansell's Vulnerability Disclosure Policy: "If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorised and we will work with you to understand and resolve any cybersecurity issue quickly, and Ansell will not recommend or pursue legal action related to your research". No anti-hacking-law or terms-of-service carve-out is named, and the disclosure window is a request to researchers ("how long we ask security researchers to wait before publicly disclosing"), not a deadline Ansell sets for itself. Live security.txt (text/plain, Expires 2027-07-31) gives [email protected] and points to the policy.”

“security.txt served as text/plain at both /.well-known/security.txt and /security.txt (amp.com.au 301s to www). Body is an ASCII-art banner spelling 'infosec at amp.com.au' followed by: 'contact: mailto:<see above>' and 'encryption: https://www.amp.com.au/infosec_pubkey.txt' (pubkey fetched, 200 text/plain). No Policy: line, no Expires: line. The AMP security page (https://www.amp.com.au/help-and-support/security, 'Account Security, Data Protection & Identity Verification') is consumer fraud/scam guidance with zero occurrences of 'vulnerab', 'responsible disclosure' or 'security researcher'; sitemap sweep found no disclosure page (the 'incident-and-disclosure-reporting' URL is RITS bank T&Cs). HackerOne 'ampau' (SEO title 'AMP | Vulnerability Disclosure Policy') is an unclaimed community stub: GraphQL submission_state:null, state:null, policy:null.”

“No channel found. /.well-known/security.txt and /security.txt both 404 (text/html 'Page not found') on boq.com.au and www.boq.com.au. HackerOne 'boq' exists only as an unclaimed stub: GraphQL submission_state:null, state:null, policy:null. Sitemap sweep of www.boq.com.au for secur/disclos/vulnerab returned only shareholder regulatory disclosures, APRA Pillar 3 pages, consumer security pages (ob-security, online-security-hub) and media releases; the single 'vulnerabilities' hit on the Online Security Hub is ACSC consumer guidance ('cyber security threats such as software vulnerabilities, online scams'), not a reporting channel. 'protecting-your-information' page exposes only [email protected] (scam reporting, not a vulnerability contact). Guessed paths /security, /responsible-disclosure, /vulnerability-disclosure, /help-and-support/security all 404.”

“Identical security.txt (200 text/plain) at /.well-known/security.txt on www.dynonobel.com.au, www.dynonobel.com and www.incitecpivot.com.au: 'Contact: mailto:[email protected]' / 'Expires: 2025-12-31T12:59:00.000Z' / 'Preferred-Languages: en' / 'Canonical: https://Incitech.com.au/.well-known/security.txt'. No Policy: line. Root /security.txt is 404 on all three hosts. Sitemaps of dynonobel.com, dynonobel.com.au and dynonobel.com/en carry no security/disclosure page; /security 404; contact page has no vulnerability wording.”

“Page 'Report a Vulnerability | Fisher & Paykel Healthcare' (200) still live and unchanged: 'At Fisher & Paykel Healthcare, we support coordinated vulnerability disclosure, which means reporting any security flaws discovered in our computer software, hardware or data systems. We welcome vulnerability testing by security researchers and customers and encourage you to report any vulnerability findings to us.' Submission: 'For reports relating to Medical Devices please contact customer care. If your report is related to any other matter please send an email to [email protected]' (address Cloudflare-obfuscated in HTML, decoded from data-cfemail). Response: 'make every effort to respond to enquiries within 10 business days' (an SLA, not a CVD deadline). Rules: 'Do not perform any vulnerability or similar testing that seeks to disrupt products that are actively in use... Do not prematurely disclose findings.' No sentence promising non-pursuit of legal action, no explicit authorization language, no CFAA/DMCA/ToS carve-out, no disclosure deadline. 'We welcome vulnerability testing' is encouragement, not a legal authorization, so testingAuthorized stays false. security.txt absent on fphcare.com and www (404 HTML at both paths).”

“Page 'Responsible Reporting | Light & Wonder' (200) still live: 'This Statement sets out how you can help us to protect all our clients and systems, by safely and securely reporting any vulnerabilities identified within our software, hardware, or source code.' Submission: 'If you identify a vulnerability, we would be grateful if you could report it as soon as possible to [email protected]' (Cloudflare-obfuscated, decoded from data-cfemail). Restrictions: 'Please DO NOT: Report the vulnerability to any party other than reporting it via e-mail to L&W... Report or post about the vulnerability on any social media or other channels. Exploit, copy, use or access the vulnerability except where strictly necessary to report its presence. Take any action that might violate any applicable laws or agreements'. Response: 'L&W will respond to you as soon as possible with an assessment of the issue and an anticipated date of resolving it'; 'L&W does not offer any form of financial compensation'. No promise not to pursue legal action, no authorization to test, no CFAA/DMCA/ToS carve-out (laws are cited only as constraints), no inbound disclosure deadline; the no-disclosure clause is a researcher restriction. security.txt: lnw.com/www.lnw.com 404 at both paths; explore.lnw.com/security.txt returns 200 but text/html (SPA shell), not a security.txt.”

“HackerOne GraphQL team(handle:"resmed"): submission_state:"open", state:"public_mode" (real program). Company-authored policy text, Safe Harbor section: 'Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.' This is a promissory non-pursuit plus a generic 'authorized conduct' statement; it names no statute (no CFAA / Criminal Code / DMCA / Copyright Act) and no ToS exemption, so cfaa/dmca/tos carve-outs are false. Disclosure policy is researcher-restrictive, not a CVD deadline: 'Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization' and 'Disclosing the vulnerability publicly in any way before ResMed provides permission is prohibited.' Response targets are SLAs (first response 5 business days, triage 10). The same policy is mirrored on ResMed's own site at https://www.resmed.com/en-us/security/ ('Resmed Responsible Disclosure Program'), which links to https://hackerone.com/resmed. security.txt: /.well-known/security.txt 404 on resmed.com/www; /security.txt 200 but redirects to the HTML security page (not a security.txt).”

“No vulnerability-disclosure channel found. https://www.sandfire.com.au/.well-known/security.txt and /security.txt both return HTTP 404 (text/html WordPress 404 page); Wayback raw snapshot of /.well-known/security.txt also 404. Guessed pages /security and /vulnerability-disclosure return a real 404 (title 'Page not found - Sandfire'). Homepage links only to /contact-us/ (generic contact form, no security email, no mailto) and the 2024 Privacy Policy PDF (no security-reporting language). HackerOne GraphQL team(handle:'sandfire') -> 'Team does not exist'. bugcrowd.com/engagements/sandfire -> 404 'Resource not found'. sandfire.responsibledisclosure.com does not resolve.”

“No vulnerability-disclosure channel found on the parent domain. https://sigmahealthcare.com.au/.well-known/security.txt and /security.txt (www + apex) return HTTP 404 text/html; Wayback raw snapshot also 404. /security, /vulnerability-disclosure and /responsible-disclosure all return a real 404 ('Page not found - Sigma Healthcare'). Sitemap and homepage expose only /contact-us/ ([email protected], a medical-information mailbox) and /privacy-policy ([email protected], General Counsel; the only 'security' mention is 'the collection, storage, use, disclosure, security and disposal of TFN information', i.e. privacy law, not vulnerability reporting). HackerOne GraphQL team(handle:'sigmahealthcare') and 'sigma_healthcare' -> 'Team does not exist'. bugcrowd.com/engagements/sigmahealthcare -> 404. sigmahealthcare.responsibledisclosure.com does not resolve. Subsidiary note: the merged group's retail brand chemistwarehouse.com.au is behind a Cloudflare challenge (HTTP 403 'Just a moment...' on /.well-known/security.txt, /security.txt, /security, /responsible-disclosure; Wayback raw of its security.txt is 404), so it could not be read here; per the parent-policy rule it would not change the parent grade in any case.”

“No vulnerability-disclosure channel found. TRAP (c) applies: https://www.tweglobal.com/.well-known/security.txt and /security.txt return HTTP 200 but Content-Type text/html (the Next.js app shell), with no Contact: line; the Wayback raw snapshot is the same HTML shell. The site is a soft-404 catch-all: /security, /vulnerability-disclosure and a nonsense path all return HTTP 200 with the Storyblok '404' story ('full_slug':'tweglobal/shared/404'), so those 200s are not real pages. Sitemap lists only /contact and /investors/investor-contacts; /en-us/contact exposes [email protected], [email protected] and named investor/media contacts, no security mailbox; /en-us/privacy gives [email protected] and a generic '7. Security: We take appropriate measures to keep your personal information secure' section, no researcher-reporting language. HackerOne GraphQL team(handle:'treasurywineestates'), 'tweglobal', 'twe' -> 'Team does not exist'. bugcrowd.com/engagements/tweglobal and /treasurywineestates -> 404. tweglobal.responsibledisclosure.com does not resolve. Brand-site check: www.penfolds.com/.well-known/security.txt and /security.txt return HTTP 410 (HTML).”

“Block's channels are its Bugcrowd engagements (cashapp, square, afterpay). On 2026-09-17 all three are paused "until further notice" (paused between 2 and 8 Sep 2026) with no submission link. The Cash App brief still shows Bugcrowd's full "Safe harbor" tier and says "we promise not to bring legal action against researchers who" follow the policy, but with intake closed the level is shown as unverified. cash.app's security.txt expired on 2026-01-01.”

“No vulnerability-disclosure channel found anywhere. HackerOne GraphQL for handle 'astrazeneca' returns submission_state:null, state:null, policy:null (community-curated STUB, does not count); 'astrazeneca_vdp' does not exist. https://www.astrazeneca.com/.well-known/security.txt and /security.txt both 301 to https://www.astrazeneca.com/404.html (HTML, not a security.txt); Wayback raw snapshot of security.txt is 404 (never existed). bugcrowd.com/engagements/astrazeneca 404. astrazeneca.responsibledisclosure.com does not resolve. The azcomsitemap.xml contains no security/vulnerability/disclosure page; guessed URLs (/security.html, /vulnerability-disclosure.html, /responsible-disclosure.html, /cybersecurity.html) all 301 to /404.html. The contact-us page offers only a 'Report a concern' EthicsPoint whistleblowing link (secure.ethicspoint.eu), which is a compliance hotline, not a security-vulnerability channel.”

“Bugcrowd engagement hsbc-vdp-pro (read 2026-09-17) carries Bugcrowd's "Partial safe harbor" tier: "This engagement provides a limited goodwill statement about not pursuing legal action related to security research". The brief also reproduces Bugcrowd's standard safe-harbor wording, which appears on partial-tier programs too, so the tier is the signal that is graded. HSBC serves a valid security.txt (Expires 2026-09-24).”

“Policy page still live ('Page last updated: 22 Oct 2025'; Scope and submission are defined: 'You can send the report to the [email protected] email address.' and in-scope examples 'Remote Code Execution, SQL injection vulnerabilities, Authentication or authorization flaws, Server-side code execution bugs, Encryption vulnerabilities'. No legal commitment of any kind: the only legal language is a warning, 'Certain hacking activities constitute criminal actions. To protect you and us please act in good faith and follow these rules of ethical engagement', plus 'This Policy is not intended to encourage hacking attempts in connection with Shell information technology infrastructure'. No 'will not pursue/take legal action' sentence, no authorization, no CMA/CFAA/DMCA/ToS carve-out. Disclosure is restricted, not scheduled: 'not to disclose the vulnerability to others without consultation with our analysts'. Response SLA only: 'We aim to reply within three (3) business days to acknowledge your report.' No security.txt at either path on shell.com or www.shell.com (all 404 HTML). HackerOne 'shell' is an unclaimed stub (submission_state:null).”

“No vulnerability-disclosure channel found. The only cyber page on the site, https://www.riotinto.com/en/sustainability/ethics-compliance/cyber-security, is governance narrative ('We govern cyber security through a Risk Management Committee (RMC) that reports to our Chief Financial Officer') with no reporting address, form, or researcher guidance. The full sitemap.xml has no vulnerability/disclosure/security-reporting URL; /en/utility/contact lists no security contact; guessed URLs (/en/security, /en/responsible-disclosure, /en/vulnerability-disclosure) all 302 to /en/404. security.txt: both /.well-known/security.txt and /security.txt on riotinto.com and www.riotinto.com return 404 HTML; Wayback raw snapshot 404 (never archived). HackerOne 'riotinto' is an unclaimed stub (submission_state:null); 'rio_tinto' and 'riotinto_vdp' do not exist. bugcrowd.com/engagements/riotinto and /rio-tinto 404. riotinto.responsibledisclosure.com does not resolve.”

“Reporting: 'please contact us by emailing [email protected] making sure that you adhere to the Guidelines for Engagement' (PGP key offered). Promissory non-pursuit in the 'Legalities' section: 'By responsibly submitting your findings to Rolls-Royce and where you have acted in good faith and in accordance with this Vulnerability Disclosure policy, Rolls-Royce affirms that it will not pursue legal action against you. Rolls-Royce reserves all legal rights in the event of noncompliance with this Vulnerability Disclosure policy.' No authorization and no carve-out; the law is cited only as a constraint: 'It does not give you permission to act in any manner that is inconsistent with the law' and 'Do not engage in any activity that violates any applicable laws and regulations in any country where Rolls-Royce data, products, services, systems or networks reside'. Every footer also disclaims binding effect: 'no contractual or other binding commitment is implied.' NOT L5: only a 72-hour acknowledgement SLA and a researcher restriction, 'please allow us enough time to fix the vulnerability or issue before sharing with a third party or making any information public.' Alternative channel offered: NCSC vulnerability reporting. No security.txt at either path on rolls-royce.com / www (404 HTML). HackerOne 'rollsroyce' is an unclaimed stub (submission_state:null); 'rolls-royce' and 'rolls_royce' do not exist.”

“Unilever's only channel is its Bugcrowd engagement, unilever-vdp. On 2026-09-17 the engagement is paused, with the notice: "This engagement has been paused. You should pause all testing activity immediately until further notice." (paused 8 Sep 2026). The brief still shows Bugcrowd's full "Safe harbor" tier, but with intake closed the level is shown as unverified until the program resumes. unilever.com serves no security.txt.”

“No channel found on 2026-09-17. https://www.bat.com/.well-known/security.txt and /security.txt both return HTTP 403 text/html, and the body is BAT's own AEM error page titled "British American Tobacco - 404" (the same 403 + 404-page body is served for a random nonexistent path, while the real page /privacy-notice returns 200), so it is not a security.txt. Wayback shows only 404 captures for the security.txt path (2023-10 to 2024-01). The 973-URL sitemap.xml contains no security, disclosure, vulnerability or cyber page, and the homepage carries no such link. HackerOne GraphQL: Team does not exist for bat, bat_vdp, batplc, british_american_tobacco, britishamericantobacco. Bugcrowd /engagements/ 404 for bat, bat-vdp, british-american-tobacco, britishamericantobacco (positive control /engagements/tesla returned 200). bat.responsibledisclosure.com does not resolve.”

“https://www.gsk.com/.well-known/security.txt returns 200 text/plain (Last-Modified 2026-08-18, so refreshed since June but substantively the same): "Contact: https://gsk.com/speakup" / "Expires: 2027-06-14T22:00:00.000Z" / "Preferred-Languages: en" / "Canonical: https://gsk.com/.well-known/security.txt" / "Hiring: https://jobs.gsk.com/gb/en". No Policy: field. The contact redirects to https://gsk.caseiq.app/portal, GSK's general Speak Up (ethics/whistleblowing) case portal, not a vulnerability-specific intake, and there is no published policy, scope or safe-harbor text. Root /security.txt returns 200 with an empty body and no content type (not a valid security.txt). The identical file is served on us.gsk.com. HackerOne handle "gsk" exists but submission_state:null (unclaimed stub, does not count). gsk.com sitemap.xml has no disclosure, vulnerability or security-reporting page.”

“BP's channel is a Synack-hosted responsible disclosure portal scoped to *.bp.com, with a live acknowledgments page. The only non-pursuit statement on the portal is Synack's own ("Synack will not bring a private action against you"); BP itself publishes no commitment not to pursue researchers and no authorization to test, and disclosure is permitted only after a fix. This is a real disclosure program with no legal commitment from the company.”

“Barclays's security.txt points to a Synack-hosted responsible disclosure portal and to [email protected]. The only non-pursuit statement on the portal is Synack's own ("Synack will not bring a private action against you"); Barclays adds no commitment of its own not to pursue researchers and no authorization to test. This is a real disclosure program with no legal commitment from the company.”

“Policy PDF s.4 Legal: "LBG affirms that it will not seek prosecution of any security researcher who reports any security vulnerability on a LBG service or system, where the researcher has acted in good faith and in accordance with this Policy." The Computer Misuse Act is cited as a constraint, not a carve-out: "It does not give permission to act in any manner that is inconsistent with the law... including but not limited to: The Computer Misuse Act (1990)", and "This Policy does not provide the security researcher any form of indemnity". No authorization language, no DMCA/CDPA or Terms carve-out. Disclosure is restricted, no deadline: "You agree not to disclose vulnerability details to anyone other than LBG without LBG's written permission." Scope: "All LBG owned services and sites are in scope." Report to [email protected]. CAVEAT: on 2026-09-17 the entire lloydsbankinggroup.com origin (homepage, robots.txt, sitemap.xml and this PDF) served an Akamai bot-block page ("Lloyds Banking Group - Error", Error 1007, HTTP 200 text/html) to curl and to WebFetch, so the live PDF could not be re-read today. Text was read from the Wayback raw PDF capture of 2026-04-11, which is byte-for-text identical (diff) to the 2024-04-12 capture; the most recent capture (2026-08-05) is the same bot-block HTML, so removal since April cannot be ruled out from here. No security.txt: both paths return the 200 HTML error page, and every Wayback capture of /.well-known/security.txt from 2025-07 to 2026-02 is text/html. HackerOne handle "lloydsbankinggroup" is an unclaimed stub (submission_state:null).”

“No channel found on 2026-09-17. https://www.nationalgrid.com/.well-known/security.txt and /security.txt both return a genuine origin 404 ("The requested URL... was not found on this server"). HackerOne handle "nationalgriduk" exists but submission_state:null (unclaimed community stub, does not count); nationalgrid, national_grid, national-grid, nationalgrid_vdp do not exist. Bugcrowd /engagements/ nationalgrid, national-grid, nationalgrid-vdp all 404 (positive control returned 200). nationalgrid.responsibledisclosure.com does not resolve. The nationalgrid.com sitemap.xml (2,330 URLs, Wayback raw capture 2026-02-03; live sitemap is Cloudflare-challenged) lists no vulnerability-disclosure, responsible-disclosure or security-reporting page; the only security URLs are shareholder-security, press items and the physical-security pages /stories/grid-work-stories/national-grid-security-uk and /us/national-grid-security-us. CAVEAT: live HTML paths on www.nationalgrid.com returned a Cloudflare "Just a moment..." challenge (403) to curl and WebFetch, so direct path probes (/security, /responsible-disclosure, /vulnerability-disclosure etc.) were inconclusive live; the sitemap is the basis for the negative. US site nationalgridus.com: security.txt and the same path probes all redirect to /404.aspx.”

“Policy page text (read via Wayback raw snapshot dated 2026-09-14, because the live URL serves an Imperva/Incapsula bot challenge to curl and 403 to WebFetch): "Scope *. baesystems.com"... "Where to report Submit a vulnerability disclosure to us at [email protected]."... "Whilst we appreciate your co-operation you will not be paid a reward for reporting a vulnerability."... Guidance: "Once we receive your report, we will contact you if any further actions are required" / "Do not break any laws or regulations" / "Do not disrupt or deny the network/system/service". Page dated 09 February 2024. Scope + what to report + where to report, with no non-pursuit promise, no authorisation, no Computer Misuse Act carve-out ("Do not break any laws" is a constraint) and no disclosure timeline.”

“Bugcrowd brief read without a browser via the changelog JSON (changelog 49d03813-c82a-496c-ad34-2305039031ac, publishedAt 2024-10-28): engagement state "in_progress" (statusLabel "In progress", not paused), participation "open", rewardAllocation "no_reward", data.brief.safeHarborStatus.status "full" ("This engagement is fully committed to providing safe harbor for good-faith security research."). Company-authored brief prose: "Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy". No L5: the brief says "This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public" (a researcher restriction, not an inbound deadline; the platform flag coordinatedDisclosure:true is metadata only). Note the carve-out cites the US CFAA, not the Computer Misuse Act 1990. security.txt (text/plain, 200) on natwestgroup.com and natwest.com: "Contact: mailto:[email protected]", "Expires: 2027-12-31T23:59:00.000Z", "Policy: https://bugcrowd.com/natwest-vdp" (302 to /engagements/natwest-vdp).”

“Contact-us page, section "Report a security issue": "If you have concerns about the security of our websites, applications or online services, or if you identify a potential security vulnerability, please contact [email protected]." Section "Bug bounty and security testing": "Standard Chartered does not operate a bug bounty programme and does not permit: hacking, penetration testing or attempts to gain unauthorised access to our systems, applications or services"... "If you identify a potential security vulnerability during your normal use of our products, services or online platforms, please: notify us as soon as possible; do not attempt to exploit the issue; do not access, modify, download or remove data; do not publicly disclose details of the issue"... "A member of our Cyber Security Team will acknowledge receipt of your report and may contact you if additional information is required." This is a contact address plus reporting guidance inside a general contact page; there is no scope, research is explicitly NOT permitted, there is no non-pursuit promise and the only disclosure language restricts the reporter. Graded L1 contact only, not a VDP. Wording note: the section was rewritten between the Wayback captures of 2026-06-30 (old text: "we would encourage you to make a voluntary disclosure of it by reporting it here: [email protected]. You should act in accordance with recognised responsible disclosure principles") and 2026-09-03 (new "does not operate a bug bounty programme and does not permit..." text); the substance and the level are unchanged. No security.txt at either path (404 HTML).”

“No vulnerability reporting channel found. /.well-known/security.txt and /security.txt both return 404 text/html ("Page not found | Anglo American"). The full sitemap.xml (1,861 URLs) lists no security, vulnerability or disclosure page; the only adjacent pages are /site-services/avoid-online-scams (fraud and phishing advice, no security-researcher contact) and a cyber-crime story page. /site-services/contact-us and /site-services/terms-and-conditions contain no vulnerability, disclosure or security-contact text. No HackerOne team, no Bugcrowd engagement, no Synack portal.”

“Root security.txt (200, Content-Type text/plain; charset=utf-8, last-modified 2021-10-01), full text: "Contact: mailto:[email protected]" / "Expires: 2024-01-01T04:59:00.000Z" / "Hiring: https://www.relx.com/careers". No Policy: line, and the file is past its own Expires date (stale since 2024-01-01), but it is still served and is the only channel. /.well-known/security.txt is 404. www.relx.com/security returns the same three lines, not a policy page. The sitemap (130 URLs) has no disclosure or security-policy page. Parent only, per subsidiary-drift rule: the HackerOne 'lexisnexis' team is an unclaimed stub (submission_state null, policy null), and an Elsevier Synack portal exists (elsevier.responsibledisclosure.com redirects to /hc) but is Cloudflare-challenged and unread, and is a subsidiary channel, so neither is graded.”

“No vulnerability reporting channel found. It is Compass, Inc. (US real estate), not Compass Group PLC (UK contract catering), so it must not be attributed to this company. On compass-group.com (Akamai WAF returns 403 to plain curl; fetched with full browser headers): /.well-known/security.txt and /security.txt both return 404 text/html ("Page Not Found | Compass Group"; the 2025-05-02 Wayback capture is the same 404); en.sitemap.xml lists no security, vulnerability or disclosure page; /en/contact-us.html and /en/site-services.html contain no vulnerability, disclosure or security-contact text. No Compass Group HackerOne team, Bugcrowd engagement or Synack portal.”

“LSEG's channel is a Synack-hosted responsible disclosure portal, lseg.responsibledisclosure.com, with scope and a submission form. The only non-pursuit statement on the portal is Synack's own ("Synack will not bring a private action against you"); LSEG itself publishes no commitment not to pursue researchers, so this is a real disclosure program with no legal commitment from the company.”

“No vulnerability disclosure channel found. HackerOne handle 'antofagasta' exists but GraphQL returns submission_state:null, state:null, policy:null (unclaimed community stub, does not count). www.antofagasta.co.uk/.well-known/security.txt returns HTTP 500 (IIS error HTML) and /security.txt returns 404; Wayback raw snapshot (2025-07-05) of /.well-known/security.txt is also a 404. /security is a 404 ('Error 404 | Antofagasta PLC'). The homepage's only reporting route is the 'Tu Voz' whistleblowing platform (/tu-voz-whistleblowing/), which is ethics/conduct reporting, not security. bugcrowd.com/engagements/antofagasta 404; antofagasta.responsibledisclosure.com has no DNS record.”

“No vulnerability disclosure channel found. www.diageo.com/.well-known/security.txt and /security.txt both return 404 ('Page not found | Diageo', text/html). Guessed paths /en/security, /en/responsible-disclosure, /en/vulnerability-disclosure all 404. The diageo.com sitemap contains no security/vulnerability/disclosure page (only press releases). The homepage's only reporting route is the SpeakUp ethics line (secure.ethicspoint.com), not security. HackerOne GraphQL: diageo, diageo_vdp, diageoplc all 'Team does not exist'. bugcrowd.com/engagements/diageo 404; diageo.responsibledisclosure.com has no DNS record.”

“The 'Vulnerability Disclosure Programme' page is live and readable (HTTP 200). Scope: 'This programme applies to: Any platform or service under Glencore's direct ownership or indirectly controlled or operated by Glencore plc worldwide.' Submission: 'Please submit your vulnerability report through the webform below.' Non-pursuit: 'Our commitment: We will not pursue legal action / demands (unless deliberate non-compliance with this programme). We will provide a response and acknowledgement of your lodgement of your report within 7 days.' Also: 'We encourage responsible disclosure of any vulnerabilities that may be found in our systems or applications. We will not compensate you for reporting any potential or confirmed vulnerabilities.' and 'We will review requests for public disclosure.' (a discretionary review, not an inbound disclosure deadline). No explicit authorisation to test and no Computer Misuse Act / DMCA / Terms-of-use carve-outs; out-of-scope list includes 'Actions that violate international law'. security.txt is live at /.well-known/security.txt (HTTP 200, Content-Type text/plain): 'Contact: https://www.glencore.com/service/report-vulnerability / Policy: https://www.glencore.com/service/report-vulnerability / Preferred-Languages: en, de'; root /security.txt is a 404 HTML page.”

“No vulnerability disclosure channel found. www.cocacolaep.com serves a Cloudflare 'Just a moment...' challenge (HTTP 403) to curl and WebFetch on every path including /.well-known/security.txt and /security.txt, so the site was read via Wayback raw snapshots: /.well-known/security.txt (snapshot 2026-01-01) is the CCEP 404 error page (text/html), the homepage (snapshot 2026-09-16) footer links only to the Policy Hub PDF, terms-and-conditions, /contact/ and regulatory reports, and /gb/company/report-concerns/ (snapshot 2025-11-19) is a Code of Conduct whistleblowing page: 'If you believe that our Code of Conduct has been violated... please use our whistleblower channels for this purpose' with no mention of security vulnerabilities. HackerOne GraphQL: cocacolaep, ccep, coca-cola-europacific-partners, cocacola_ep, cocacolaeuropacific, ccep_vdp all 'Team does not exist' (hackerone.com/cocacolaco and the Intigriti 'tccc' program belong to The Coca-Cola Company, a different listed entity, not CCEP). bugcrowd.com/engagements/cocacolaep and /ccep 404; cocacolaep.responsibledisclosure.com and ccep.responsibledisclosure.com have no DNS record.”

“No vulnerability disclosure channel found. www.haleon.com is Akamai-protected: /.well-known/security.txt, /security.txt and /robots.txt return 403 'Access Denied' HTML, and /, /security, /responsible-disclosure, /vulnerability-disclosure-policy return a 1.8 KB 'Challenge Validation' interstitial to curl and WebFetch. Wayback raw snapshot of /.well-known/security.txt (2026-02-01) is the Haleon '404' page (text/html), so no security.txt existed then. The Wayback copy (2025-06-24) of the governance 'Codes, policies and standards' page mentions no vulnerability reporting or security researcher route; the Haleon contact route resolves to haleon.support general enquiries. HackerOne GraphQL: haleon, haleon_vdp, haleonplc all 'Team does not exist'. bugcrowd.com/engagements/haleon 404; haleon.responsibledisclosure.com has no DNS record.”

“No disclosure channel found on any surface. HackerOne GraphQL: handles reckitt, reckitt_vdp, reckittbenckiser, reckitt_benckiser, rb all return 'Team does not exist'. Bugcrowd /engagements/reckitt and /engagements/reckitt-vdp both 404. Synack reckitt.responsibledisclosure.com does not resolve (curl: Could not resolve host). security.txt: reckitt.com and www.reckitt.com at /.well-known/security.txt and /security.txt all 404 text/html. Sitemap (reckitt.com/sitemap-0.xml, 102 KB) contains no security/disclosure/vulnerability page; the only cyber pages are news items. https://www.reckitt.com/news/cyber-security-and-privacy-policy/ describes internal controls only ('taking a defence-in-depth approach to help protect information from unauthorised access, misuse, disclosure, alteration or destruction') and offers no researcher contact; /contact-us/ lists only media and IR addresses (media&[email protected], named IR staff), no security mailbox.”

“HackerOne GraphQL handle 'sse' returns submission_state:null, state:null, policy:null = unclaimed community stub, does NOT count (trap a); sse_vdp, sseplc, sse_plc, scottish_and_southern all 'Team does not exist'. Bugcrowd /engagements/sse and /engagements/sse-vdp 404. Synack sse.responsibledisclosure.com does not resolve. security.txt: sse.com and www.sse.com at /.well-known/security.txt and /security.txt all 404; group brands www.ssen.co.uk, www.ssen-transmission.co.uk, www.sserenewables.com, www.ssethermal.com, www.sseairtricity.com, www.sseenergysolutions.co.uk also 404 at /.well-known/security.txt. sse.com/xmlsitemap (668 KB) has no vulnerability/disclosure/PSIRT page (every 'secur' hit is energy-security news); guessed paths /vulnerability-disclosure, /responsible-disclosure, /security, /vulnerability-disclosure-policy all 'Error 404 | SSE'; homepage, /contact-us/, /about-us/ and /sitemap/ contain no 'vulnerab', 'responsible disclosure', 'hackerone' or 'bugcrowd' text.”

“HackerOne GraphQL team 'tesco': submission_state:"open", state:"public_mode" = real program. Company-authored policy text, '# Safe Harbor' section: "Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy." That is promissory non-pursuit plus 'authorised conduct', with no Computer Misuse Act / DMCA / Terms-of-Service carve-out anywhere in the text = L3. Disclosure clause is a restriction, not an inbound deadline: "Please do not discuss any vulnerabilities (even resolved ones) outside of the program without express consent from the organisation." Response targets are SLAs only (First Response 2 days, Time to Triage 2 days). Secondary own-site channel: https://www.tescoplc.com/contacts 'Security' block: "If you have any concerns or information about possible vulnerabilities on any of our websites, please contact: [email protected]" (no policy text). security.txt: www.tesco.com and tescoplc.com are Akamai-WAF blocked to curl (403 'Access Denied' on every UA for tesco.com; tescoplc.com 404 with a curl UA); a Wayback raw snapshot https://web.archive.org/web/20260201073357id_/https://www.tesco.com/.well-known/security.txt is text/plain with 'Contact: https://hackerone.com/tesco/reports/new' and 'Policy: https://hackerone.com/tesco', so a security.txt existed on www.tesco.com as of 2026-02-01 but its live state could not be verified today; securityTxtUrl left null rather than claim an unverified live file. tescoplc.com security.txt 404 (live, curl UA, and Wayback CDX shows only 404 captures).”

“The page is a JS SPA (YesWeHack-hosted VDP tooling, 'ywh-button' CSS); the policy prose was read from its content API https://vdp.prudentialcorporation-asia.com/api/v2/content.json (200 application/json). Title: 'Prudential VULNERABILITY DISCLOSURE PROCESS'. Scope + non-pursuit: "Any person or organisation that interacts with Prudential's products, services and technology platforms are encouraged to report any identified vulnerabilities and errors through this process. As long as you comply with this process, we will not take legal action against you or revoke your access to our systems, platforms and applications. Prudential reserves all its other rights." How to submit: "The preferred method for contacting Prudential regarding vulnerabilities and errors is by using the form on this page." (a FORM block is embedded on the page). Promissory non-pursuit = L3; no explicit authorisation to test, no Computer Misuse Act / Criminal Code / DMCA / ToS carve-out; the researcher must instead promise "You will not breach any applicable laws in connection with your report" (a constraint). Disclosure clause is restrictive, not an inbound deadline: "You agree not to disclose to any third party any information related to your report, nor the fact that a vulnerability has been reported to Prudential." Page also lists a 'Hall of Fame' (lofiboy, Dillon Bong Zi Hang, Osama Ansari) and 9 languages. HackerOne 'prudential' is a null-submission_state stub (does not count); prudential_vdp, prudentialplc, prudential_plc, pru not found. Bugcrowd /engagements/prudential 404; Synack prudential.responsibledisclosure.com no DNS; security.txt 404 on prudentialplc.com and www.prudentialplc.com both paths.”

“HackerOne GraphQL team 'vodafone': submission_state:"open", state:"public_mode" = real program. The company-authored policy text contains scope guidance and reporting rules but NO legal commitment of any kind: the only 'Vodafone Commitments' are "We treat all submitted reports confidentially and will not share the researcher personal details with third parties without authorisation, except when required by legal obligations." and "We will resolve all submitted reports as quickly as possible." There is no 'we will not take legal action', no authorisation statement, no Computer Misuse Act / DMCA / ToS carve-out. The policy even withholds permission for third-party-hosted assets: "Please note that in this situation, no permission to test has been granted by Vodafone or any of its subsidiaries." Disclosure clause is a restriction: "All vulnerabilities are strictly confidential, therefore public disclosure of your findings via a blog post, social media, or any other type of medium is not allowed." Own-site corroboration: https://www.vodafone.com/sustainable-business/maintaining-trust/security-and-resilience/cyber-security has a 'Report a vulnerability' / 'Vulnerability disclosure policy guidelines' section whose 'report a vulnerability' CTA links to the HackerOne embedded form https://hackerone.com/42d238f6-efe2-4e62-b641-e914510dd9ab/embedded_submissions/new; its 'Vodafone responsibilities' list is the same two confidentiality/resolution commitments plus "Vodafone do not operate a bug bounty or hall of fame programme." and its finder rule "Do not share information about the vulnerability with others until it has been resolved in accordance with the Vodafone Responsible Disclosure policy timeframes" names no timeframe and restricts the researcher, so cvdTimeline stays false. security.txt: vodafone.com and www.vodafone.com 404 on both paths. Bugcrowd /engagements/vodafone 404; Synack vodafone.responsibledisclosure.com no DNS.”

“HackerOne GraphQL team 'experian': submission_state:"open", state:"public_mode" = real program; https://www.experian.com/responsible-disclosure and https://www.experian.com/vulnerability-disclosure both 301 to https://hackerone.com/experian, so the company points its own domain at this program. Company-authored '# Experian Vulnerability Disclosure Program Policy', '# Safe Harbor' section: "Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy." = promissory non-pursuit + 'authorized conduct' = L3. No CFAA / Computer Misuse Act / DMCA carve-out; the '# Legal' section is the opposite, a constraint: "You must comply with Experian's Terms of Use, security industry best practices, and all applicable Federal, State, and local laws" and "Experian does not authorize, permit, or otherwise allow... any person... to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities." so tosCarveout false. Disclosure clause is restrictive ("please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express written consent from the organization"); response targets are SLAs (first response 5 days, triage 5 days). Note: the policy text still says "As this is a private program" although GraphQL state is public_mode and submissions are open. security.txt: experianplc.com, www.experianplc.com, experian.com, www.experian.com 404 on both paths; www.experian.co.uk /.well-known/security.txt 403 (WAF) and no Wayback capture, /security.txt 404. Bugcrowd /engagements/experian 404; Synack experian.responsibledisclosure.com resolves but serves only a Cloudflare 'error code: 1001' (409) / TLS handshake failure, no program page.”

“No vulnerability-reporting channel found. NOTE entity change since June: https://www.ashtead-group.com/ now 301-redirects to https://ir.sunbeltrentals.com/ (page title 'Sunbelt Rentals Holdings, Inc. (SUNB)'); the old domain returns 404 for /.well-known/security.txt and /security.txt. Successor domains also have nothing: ir.sunbeltrentals.com and www.sunbeltrentals.com return 404 HTML for both security.txt paths; www.sunbeltrentals.co.uk/.well-known/security.txt returns a 401 HTML login redirect (not a security.txt). The sunbeltrentals.com sitemap (728 URLs) has no security/vulnerability/disclosure page; /legal/ and /legal/website-terms-and-conditions/ contain no vulnerability-reporting language. HackerOne: no team for ashtead, ashtead-group, ashteadgroup, sunbelt, sunbeltrentals, sunbelt-rentals (GraphQL 'Team does not exist'). Bugcrowd /engagements/ 404 for ashtead, ashtead-group, ashteadgroup, ashtead-vdp, sunbelt, sunbelt-rentals, sunbeltrentals and -vdp variants (probe validated against live controls tesla/unilever-vdp/natwest-vdp = 200). Synack ashtead / ashtead-group / sunbeltrentals.responsibledisclosure.com do not resolve (control bp.responsibledisclosure.com resolves).”

“No vulnerability-reporting channel found. www.3i.com/.well-known/security.txt and /security.txt both returned 404 on first fetch (the site's WAF then 403'd all further requests from the audit IP, including the XML sitemap at /xmlsitemap and WebFetch). Homepage footer links only to /site-tools/contacts/, /site-tools/privacy-policy/, /site-tools/terms-and-conditions/, /site-tools/cookies/, /site-tools/accessibility-statement/ and an investor 'Share fraudsters' page; no security or disclosure link. Wayback raw snapshots of the Contacts page (2025-12-18) and Terms and conditions page (2026-02-01) contain no mention of vulnerabilities, responsible disclosure, security researchers or a security contact (the only fraud content is investor share-fraud and 'Crypto currency fraud' warnings). HackerOne: no team for 3i, 3igroup, 3i-group. Bugcrowd /engagements/ 404 for 3i, 3i-group, 3i-vdp, 3igroup, 3igroup-vdp. Synack 3i.responsibledisclosure.com NXDOMAIN. Sitemap could not be read (WAF 403), so own-site coverage rests on footer links + Wayback; the common-path probes were WAF-403 and are inconclusive.”

“No vulnerability-reporting channel found. www.imperialbrandsplc.com/.well-known/security.txt and /security.txt both return the site's HTML '404 - Imperial Brands' page (a bare curl gets a WAF 403; browser headers get the 404). The sitemap.xml (204 URLs) contains no security, vulnerability, disclosure or cyber page; the only candidates, /contacts and /legal-information, contain no vulnerability-reporting language and no security contact address. Eight common disclosure paths (/security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /security-disclosure, /cyber-security, /legal/responsible-disclosure, /report-a-vulnerability) all 404. HackerOne: no team for imperialbrands, imperial-brands, imperial_brands, imperialbrandsplc. Bugcrowd /engagements/ 404 for imperialbrands, imperial-brands, their -vdp variants and imperial-tobacco. Synack imperialbrands / imperial-brands.responsibledisclosure.com do not resolve.”

“No vulnerability-reporting channel found. www.fresnilloplc.com/.well-known/security.txt and /security.txt both return an HTML 'Error | Fresnillo' 404 page (apex fresnilloplc.com does not answer on HTTPS). The sitemap.xml (105 URLs) has no security, vulnerability, disclosure or cyber page. The Contacts pages list only [email protected], [email protected], an investor-relations agency address and a photographer credit; no security contact and no vulnerability-reporting language. Eight common disclosure paths all 404. HackerOne: no team for fresnillo, fresnilloplc. Bugcrowd /engagements/ 404 for fresnillo, fresnillo-vdp, fresnilloplc, penoles. Synack fresnillo.responsibledisclosure.com NXDOMAIN.”

“Policy page live and covers 'BT, EE, Plusnet and Openreach (collectively, BT Group)'. Promissory non-pursuit: 'To the extent compatible with its legal obligations, BT will not take civil action against or seek prosecution of security researchers who report any security vulnerability on a BT service or system, where the researcher has acted in good faith and in accordance with this disclosure policy.' The Computer Misuse Act is a CONSTRAINT, not a carve-out: 'It does not give you permission to act in any manner that is inconsistent with the law, or which might cause BT to be in breach of any of its legal obligations, including but not limited to: The Computer Misuse Act 1990', and the policy also says 'These terms and conditions are intended to provide guidance and does not provide indemnity or protection in respect of the compliance of such disclosures with the law'. No testing authorization. Under the rubric a fix SLA plus a researcher restriction is not an L5 signal; the level is unaffected either way (L5 requires L4). security.txt at /.well-known/ is text/plain with 'Contact: mailto:[email protected]' and 'Policy: https://www.bt.com/about/contact-bt/responsible-disclosure' but is EXPIRED ('Expires: 2025-07-25T23:00:00.000Z'; ee.co.uk serves the same expired file, openreach.com serves the same file with Expires 2027-07-25). Root /security.txt redirects to an AEM path returning 403. No paid bounty ('It is not currently possible for us to offer a paid bug bounty programme'); Hall of Fame exists. HackerOne 'bt' and 'ee' are unclaimed stubs (submission_state null).”

“Page live (title 'IHG's Responsible Disclosure | Submit Your Findings'; bare curl gets an Akamai 403, browser headers get 200). Scope + how to submit: 'Should you identify a potential vulnerability in any product, system, or asset belonging to IHG, we encourage you to contact us.' and 'Email your findings to: [email protected] as soon as possible'. No legal commitment of any kind, and the guidelines restrict rather than authorize: 'Do not engage in social engineering, penetration testing, denial of service, or physical security testing', 'Do not participate in any activity that violates laws or regulations', 'Do not share information about the potential vulnerability with others'. No bounty: 'IHG does not have a bug bounty program, but we appreciate you sharing potential vulnerabilities with us'. Only commitment: 'IHG will work to triage and resolve confirmed weaknesses and vulnerabilities based on complexity and severity.' No safe harbor, no non-pursuit language, no disclosure timeline. No security.txt: ihg.com and ihgplc.com return HTML 404 on both paths. HackerOne 'ihg' is an unclaimed stub (submission_state null).”

“No vulnerability-reporting channel found 2026-09-17. HackerOne handle 'avivaplc' exists but is an unclaimed stub: GraphQL returns {"handle":"avivaplc","submission_state":null,"state":null,"policy":null}; 'aviva', 'aviva_vdp', 'aviva-vdp' return 'Team does not exist'. security.txt is 404 (text/html) at both /.well-known/security.txt and /security.txt on www.aviva.com and www.aviva.co.uk (also 404 on avivainvestors.com, aviva.ie, aviva.ca). Both sitemaps (aviva.com sitemap.xml 1.7 MB; aviva.co.uk 1,284 URLs) contain no security/vulnerability/responsible-disclosure page; the only security-adjacent content is consumer fraud guidance (aviva.co.uk/help-and-support/protect-yourself-from-fraud/) and the www.aviva.com/legal/ page, which contains no vulnerability, researcher or disclosure language. Direct probes /security/, /responsible-disclosure/, /vulnerability-disclosure/, /vulnerability-disclosure-policy/ all 404 on both hosts. No Bugcrowd /engagements/ page (aviva, aviva-vdp, avivaplc all 404; positive control /engagements/tesla and /engagements/natwest-vdp returned 200; no Aviva entry in the 278-row public engagements.json listing). No Synack aviva.responsibledisclosure.com (DNS does not resolve). Not listed on YesWeHack or Intigriti public program lists. No _security DNS TXT record.”

“No vulnerability-reporting channel found 2026-09-17. security.txt: www.nextplc.co.uk returns 404 text/html at both /.well-known/security.txt and /security.txt; www.next.co.uk returns 404 at both; apex nextplc.co.uk does not answer on HTTPS. The full www.nextplc.co.uk sitemap is 67 URLs (about-next, corporate-responsibility, investors, media, contact-us) with no security or disclosure page; /security, /responsible-disclosure, /vulnerability-disclosure all 404 on nextplc.co.uk and next.co.uk. www.nextplc.co.uk/contact-us, the corporate-governance/policies page, www.next.co.uk/privacy and www.next.co.uk/terms contain no vulnerability, security-researcher, bug-bounty or security@ language. The Next help centre (zendesk.next.co.uk) article search for 'vulnerability' and 'responsible disclosure' returns only unrelated customer articles (Textile Donations, Data Privacy, Complaints Process); the closest is the consumer article 'Tips on how to protect yourself from online fraud'. HackerOne: next, nextplc, next_plc, next-plc, nextretail, next_vdp all 'Team does not exist'. Bugcrowd /engagements/ next, nextplc, next-vdp, next-plc all 404 (positive controls 200); only 'Nextup.ai' matches 'next' in the public listing (unrelated). No Synack subdomain, no YesWeHack/Intigriti listing, no _security DNS TXT.”

“No vulnerability-reporting channel found 2026-09-17. HackerOne handle 'legalandgeneral' exists but is an unclaimed stub: GraphQL returns {"handle":"legalandgeneral","submission_state":null,"state":null,"policy":null}; legal-and-general, legal_and_general, landg, lgim, legalgeneral return 'Team does not exist'. L&G does publish a customer-facing page at www.legalandgeneral.com/security/, but it is a data-security and phishing statement, not a disclosure policy: 'We are committed to ensuring that your information is secure, using the latest secure server software that encrypts (turns into code) all the information you provide us' and, for phishing, 'If you are concerned you may have already disclosed personal or security information please call us as soon as possible on 0800 096 6959'. It contains no vulnerability-reporting route, scope, researcher language or legal commitment; the same holds for /adviser/security-information/, /employer/security-information/ and /log-in/shared-pages/footer-links/security/. security.txt is 404 text/html at /.well-known/security.txt and /security.txt on www.legalandgeneral.com, group.legalandgeneral.com and lgim.com. Sitemaps (1,411 URLs on www, 1,771 on group) hold no vulnerability/disclosure page. Bugcrowd /engagements/ legalandgeneral, legal-and-general, landg, legalandgeneral-vdp all 404 (positive controls 200). No Synack subdomain, no YesWeHack/Intigriti listing, no _security DNS TXT.”

“No group-level vulnerability-reporting channel found 2026-09-17. security.txt is 404 text/html at both https://www.halma.com/.well-known/security.txt and https://www.halma.com/security.txt. The full halma.com sitemap (448 URLs) contains no security, vulnerability, cyber or disclosure page; the only keyword hits are /sustainability/data-and-disclosures (ESG data) and its health-and-safety policy. /security, /responsible-disclosure, /vulnerability-disclosure, /vulnerability-disclosure-policy, /cyber-security and /site-services/security all 404. The contact page www.halma.com/site-services/contact-us contains no security, cyber or vulnerability wording. HackerOne: halma, halma_vdp, halmaplc all 'Team does not exist'. Bugcrowd /engagements/ halma and halma-vdp 404 (positive controls 200), no entry in the public listing. No Synack subdomain, no YesWeHack/Intigriti listing, no _security DNS TXT. Note: Halma is a holding group of ~50 operating companies; individual subsidiaries' product-security pages were not graded (parent canonical policy only, per the subsidiary-drift rule).”

“the live www.abf.co.uk sits behind an Akamai bot challenge (every path returns a 'Challenge Validation' HTML page or 403 to curl and WebFetch, including /.well-known/security.txt and /security.txt, which therefore are NOT security.txt files), so the site was read through the Wayback Machine. Wayback CDX shows /.well-known/security.txt captured eight times between 2025-05-03 and 2026-01-05, every capture 404 text/html; root /security.txt has never been captured. A CDX sweep of all 200-status HTML URLs on abf.co.uk since 2025 (456 URLs) contains no security, vulnerability, cyber, disclosure or bug-bounty page; the only matches are /privacy-notice. Archived copies of /t-cs ('Terms and conditions - ABF') and /contact ('Contacts - ABF') were fetched with full body text and contain no vulnerability, researcher, hacking, cyber or security@ language. HackerOne handle 'associatedbritishfoods' exists but is an unclaimed stub: GraphQL returns {"handle":"associatedbritishfoods","submission_state":null,"state":null,"policy":null}; abf, associated-british-foods, abfoods, primark, primark_vdp return 'Team does not exist'. Bugcrowd /engagements/ abf, associatedbritishfoods, associated-british-foods, primark, primark-vdp all 404 (positive controls 200). No Synack subdomain, no YesWeHack/Intigriti listing, no _security DNS TXT. Subsidiary note: primark.com security.txt paths return 403 (WAF) and twinings.co.uk returns 404; neither was graded (parent only).”

“No vulnerability-reporting channel found 2026-09-17. Airtel Africa publishes two security marketing pages, neither of which offers a reporting route. www.airtel.africa/online-security: 'Airtel Africa has a strong commitment to data privacy and information security... We encourage our customers to safeguard their personal information online' (consumer fraud advice only). www.airtel.africa/data-security cites '5,526 external penetration tests as of 31 March 2026' and '0 successful breaches of our security platforms' but gives no contact, scope or policy for outside researchers. security.txt is 404 text/html at both https://www.airtel.africa/.well-known/security.txt and https://www.airtel.africa/security.txt; OpCo hosts airtel.com.ng and airtelkenya.com return 200 text/html at those paths (SPA/HTML shell, no Contact: line, not a security.txt). The full airtel.africa sitemap (63 URLs) has no disclosure page. HackerOne: airtel, airtelafrica, airtel-africa, airtel_africa, bhartiairtel all 'Team does not exist'. Bugcrowd /engagements/ airtel, airtelafrica, airtel-africa, airtel-africa-vdp all 404 (positive controls 200). No Synack subdomain, no YesWeHack/Intigriti listing, no _security DNS TXT.”

“HackerOne handle 'cocacolahbc' exists (name 'Coca-Cola HBC AG') but GraphQL returns submission_state:null, state:null = unclaimed community stub, does not count. The only security document on the site, the 'Information Security Statement' (page + PDF), is a governance statement with an internal-only reporting line: 'A robust escalation process is in place for employees to report incidents, vulnerabilities, or suspicious activities.' and 'We actively monitor and collect information about technical vulnerabilities affecting our information systems in a timely manner.' It gives no contact, scope or process for outside researchers. Sitemap (482 URLs) has no vulnerability/responsible-disclosure page; contact page lists only general, privacy (OneTrust) and EthicsPoint Speak Up channels.”

“No vulnerability-reporting channel found for the parent. www.informa.com/.well-known/security.txt and /security.txt return HTTP 404; privacy.informa.com/security.txt returns 200 text/html (SPA shell, not a security.txt). Sitemap (776 URLs) contains no security/vulnerability/responsible-disclosure page; the only 'secure' hit, /about-us/allsecure/, is an events health-and-safety standard: 'Informa AllSecure is a set of standards that indicates an Informa event is following enhanced hygiene and safety measures.' No HackerOne team, no Bugcrowd engagement, no Synack portal.”

“No vulnerability-reporting channel found. www.rentokil-initial.com/.well-known/security.txt and /security.txt return HTTP 404 HTML ('Page not found - Rentokil Initial plc'); apex rentokil-initial.com returns a 403 HTML WAF page. Corporate sitemap (108 URLs) lists Responsible Delivery policies (code of conduct, modern slavery, supplier speak-up, general terms) but nothing on security, vulnerabilities or disclosure, and neither the homepage nor the policies index links to one. Brand domains rentokil.com, rentokil.co.uk and initial.com sit behind a Cloudflare 'Just a moment...' challenge (403 HTML) so could not be read live; Wayback raw snapshot of rentokil.com/.well-known/security.txt (2026-02-01) is a 404 error page. No HackerOne team, Bugcrowd engagement or Synack portal.”

“No vulnerability-reporting channel found for the trust or its manager Baillie Gifford. scottishmortgageit.com redirects every path, including /.well-known/security.txt, to the HTML page www.scottishmortgage.com/en/rest-of-world/existing-shareholders (200 text/html = not a security.txt); www.scottishmortgage.com and www.bailliegifford.com both return HTTP 404 HTML for /.well-known/security.txt and /security.txt. Scottish Mortgage sitemap (258 URLs) and Baillie Gifford sitemap (2,689 URLs) contain no security/vulnerability-disclosure page; the closest page, Baillie Gifford 'Fraudulent activity', concerns investor scam warnings and contains no vulnerability-reporting language. No HackerOne team, Bugcrowd engagement or Synack portal.”

“No vulnerability-reporting channel found. www.segro.com/.well-known/security.txt and /security.txt return HTTP 404 (apex segro.com does not answer on HTTPS). Sitemap (2,126 URLs) has no security/vulnerability/responsible-disclosure page (only /privacy-policy and property/investor contact pages); homepage and /contact carry no security-reporting link or vulnerability language. No HackerOne team, Bugcrowd engagement or Synack portal.”

“No vulnerability-reporting channel found. www.endeavourmining.com/.well-known/security.txt and /security.txt return HTTP 404 HTML (apex does not answer on HTTPS). Sitemap (384 URLs) has no security/vulnerability page; the one 'disclosure' URL, /disclosure-portal/, is the investor/regulatory 'Disclosure portal', and /speak-up/ is the ethics whistleblowing line; neither is a security-vulnerability channel. Homepage and contact page carry no vulnerability-reporting language. No HackerOne team, Bugcrowd engagement or Synack portal.”

“The only security prose on the group site is the ESG policies page: 'Within each business responsibility for information and cyber security is allocated to a Chief Information Security Officer or equivalent Head of Cyber Security. The Group Information Security Policy sets out how Admiral Group protects the confidentiality, integrity and availability of its information and assets' (no reporting channel, only mailto:[email protected] for data rights). Consumer site www.admiral.com: security.txt 404 at both paths; sitemap (849 URLs) has no vulnerability/disclosure page; /your-privacy-and-security is a GDPR privacy notice with no vulnerability-reporting text. Wayback CDX shows admiralgroup.co.uk/.well-known/security.txt 404 on every capture Oct 2025 to Jan 2026. HackerOne: admiral, admiralgroup, admiral_group, admiral-group, admiralinsurance, admiral_vdp, admiral-insurance, admiralgroupplc, admiral_insurance, elephant, confused all 'Team does not exist'. Bugcrowd /engagements/admiral, admiralgroup, admiral-group, admiral-vdp, admiralgroup-vdp all 404 (tesla positive control 200). Synack admiral/admiralgroup.responsibledisclosure.com do not resolve (bp control 302).”

“www.diplomaplc.com/.well-known/security.txt and /security.txt both 404 (apex diplomaplc.com redirects any path to the HTML homepage, a 200 that is not a security.txt). Full sitemap (63 URLs) has no security/disclosure page; /security/, /responsible-disclosure/, /vulnerability-disclosure/ 404. HackerOne diploma, diplomaplc, diploma_plc, diplomaplc_vdp, diploma-plc: 'Team does not exist'. Bugcrowd /engagements/diploma, diplomaplc, diploma-plc 404. Synack diploma/diplomaplc.responsibledisclosure.com do not resolve.”

“the sitemap now carries a 'Product Security at Smith+Nephew' page (https://www.smith-nephew.com/en/resources/product-security, also /en-us/) describing 'a Secure by Design approach', 'Verify security through testing and independent assessment', 'Monitor and respond to emerging threats over time' and SOC 2 / HITRUST attestations, but it publishes NO vulnerability-reporting channel: no email, no form, no PSIRT, no words 'vulnerability', 'disclosure' or 'report' anywhere in the page HTML. A security posture page without an intake is not a VDP. /.well-known/security.txt and /security.txt both 404 (www and apex); Wayback shows 404 on every capture since 2024. Path probes /en/resources/product-security/vulnerability-disclosure, /en/resources/vulnerability-disclosure, /vulnerability-disclosure, /responsible-disclosure, /psirt, /security all 302 to Error-404.html. HackerOne smith-nephew, smithnephew, smith_nephew, smithandnephew, smith-and-nephew, smith_and_nephew, smithnephew_vdp, sn: 'Team does not exist'. Bugcrowd /engagements/smith-nephew, smithnephew, smithandnephew, smith-and-nephew, smithnephew-vdp 404. Synack smith-nephew/smithnephew.responsibledisclosure.com do not resolve.”

“HackerOne handle 'unitedutilities' EXISTS but GraphQL returns submission_state:null, state:null, policy:null, i.e. an unclaimed community stub, which does not count. /security.txt at root is 404 text/html. /.well-known/security.txt returns a Cloudflare 403 'Attention Required' challenge page (text/html) under every UA tried; the block is path-wide (a random /.well-known/zzz.txt also 403), so it is a WAF rule, not a security.txt. Wayback CDX has no content capture for it (only a 2023 301). Full sitemap (3,102 URLs) grepped for secur/vulnerab/disclos/cyber: only customer-vulnerability, TCFD and supplier pages; the supplier 'Commercial Information Security Policy' page has no vulnerability-reporting text. Path probes /security/, /responsible-disclosure/, /vulnerability-disclosure/, /vulnerability-disclosure-policy/, /report-a-vulnerability/, /corporate/vulnerability-disclosure/ all 404. Other HackerOne slugs (united_utilities, united-utilities, uu, unitedutilities_vdp, uuplc, united_utilities_vdp): 'Team does not exist'. Bugcrowd /engagements/unitedutilities, united-utilities, united-utilities-vdp, unitedutilities-vdp, uu 404. Synack unitedutilities.responsibledisclosure.com does not resolve.”

“Live security.txt (200, text/plain; charset=UTF-8, Last-Modified 16 Sep 2026) reads in full: 'Contact: mailto:[email protected] / Preferred-Languages: en / Canonical: https://schroders.com/.well-known/security.txt / Hiring: https://schroders.referrals.selectminds.com/careers/'. No Policy: line, no Expires:. Note the Canonical field points at the apex /.well-known/ path, which actually 302s to the HTML homepage (/en/global/individual/); the file is served at https://www.schroders.com/security.txt, and www /.well-known/security.txt 301s there. No disclosure policy anywhere on the site: en/global and en-gb/uk sitemaps (2.9 MB) grepped for secur/vulnerab/disclos/cyber return only investment insights and regulatory disclosures; footer pages are contact-us, important-information, privacy, scam-protection, raising-concerns, cookies; /footer/security/, /footer/responsible-disclosure/, /footer/vulnerability-disclosure/ and root variants 404; scam-protection page has no vulnerability-reporting text. HackerOne handle 'schroders' exists but is an unclaimed stub (submission_state null, policy null); schroders_vdp, schroder, schrodersplc, schroders-vdp, cazenove do not exist. Bugcrowd /engagements/schroders, schroders-vdp, schroders-mbb 404. Synack schroders.responsibledisclosure.com does not resolve.”

“www.intertek.com/.well-known/security.txt and /security.txt both 404 (text/html); Wayback CDX shows 404 on every capture Oct 2025 to Feb 2026, and 404 on canada./cdn. subdomains too. No robots.txt or sitemap.xml at root (both 404). Path probes /security/, /security-policy/, /responsible-disclosure/, /vulnerability-disclosure/, /vulnerability-disclosure-policy/, /trust/ all return the generic 404 template (same 795-byte body as /nonexistent-zzz/). /legal/ and /privacy-policy/ contain no vulnerability-reporting text; the only security links are to Intertek's own SOLD services (/iot/cybersecurity/, /life-safety-security/), and Wayback's /iot/cybersecurity/advisory/vulnerability/ is a commercial vulnerability-assessment offering, not an intake for reports about Intertek. HackerOne intertek, intertek_vdp, intertekgroup, intertek-group, intertek_group, intertekplc: 'Team does not exist'. Bugcrowd /engagements/intertek, intertek-vdp, intertek-group 404. Synack intertek.responsibledisclosure.com does not resolve.”

“No vulnerability-reporting channel found. HackerOne handle 'severntrent' is an unclaimed stub: GraphQL returns submission_state:null, state:null, policy:null. security.txt at /.well-known/ and root on severntrent.com and stwater.co.uk returns 403 text/html, and the body is the site's own AEM error template (digitalData page type '500-error-page'), not a WAF challenge (the homepage returns 200 to the same client), so no security.txt is served. Sitemaps (678 URLs severntrent.com, 2,212 URLs stwater.co.uk) contain no security, vulnerability or disclosure page; only legal/privacy/disclaimer pages plus a 2020 Group Security Policy PDF. The legal disclaimer page has zero mentions of vulnerability, researcher or responsible disclosure.”

“No vulnerability-reporting channel found. HackerOne handle 'bunzl' ('Bunzl plc') is an unclaimed stub: GraphQL returns submission_state:null, state:null, policy:null. www.bunzl.com returns 404 for both /.well-known/security.txt and /security.txt (apex bunzl.com does not answer on HTTPS). Homepage links only /legal-notice/ and /privacy-policy/; the legal notice has zero mentions of vulnerability, researcher or responsible disclosure. The sitemap referenced in robots.txt (/xmlsitemap) returns HTTP 500, so page discovery relied on direct path probes and homepage links.”

“No vulnerability-reporting channel found. M&G's own 'Website Security' page describes defences only ('Our website is protected by firewalls, intrusion detection and Distributed Denial of Services (DDoS) security measures that safeguard against malicious attack') and gives no way to report a vulnerability; the 'Security and financial crime' section covers fraud alerts, scams and identity verification only. No HackerOne team exists (mandg, m-g, mandgplc, mg all NOT_FOUND). security.txt is 404 on www.mandg.com and group.mandg.com; mandg.co.uk, pru.co.uk and mandgplc.com redirect the security.txt paths to HTML landing pages (not a security.txt). Sitemaps (global site, customer, private-investor GB) list no vulnerability or disclosure page.”

“No vulnerability-reporting channel found. Corporate rename note: thephoenixgroup.com now redirects to standardlifeplc.com (formerly Phoenix Group Holdings). HackerOne handle 'standardlife' is an unclaimed stub: GraphQL returns submission_state:null, state:null, policy:null; phoenixgroup / phoenix-group / phoenix_group do not exist. TRAP HIT: standardlifeplc.com/security.txt, standardlife.co.uk/security.txt and phoenixlife.co.uk/security.txt all return HTTP 200 but text/html with title 'Error page | Standard Life plc' / 'Error 404' (soft-404), and /.well-known/security.txt is a hard 404, so there is no security.txt. Every guessed policy path on both sites is the same soft-404 error page. Sitemaps (630 URLs plc, 1,393 URLs standardlife.co.uk) contain no vulnerability or disclosure page; the only security content is consumer scam guidance (/help/protecting-yourself), which has zero mentions of vulnerability, researcher or responsible disclosure.”

“Centrica's Security page is a Bugcrowd-hosted embedded submission form (form id 633e3991-d6b9-48bb-b5ad-c4f47d0b8c87) carrying 'Centrica's Vulnerability Disclosure Policy'. Scope: 'This policy applies to any digital assets owned, operated, or maintained by Centrica, including public facing websites.' How to submit: 'Centrica recommends that security researchers share the details of any suspected vulnerabilities across any asset owned, controlled, or operated by Centrica (or that would reasonably impact the security of Centrica and our users) using the web form below. The Centrica Security team will acknowledge receipt of each vulnerability report, conduct a thorough investigation, and then take appropriate action for resolution.' No legal commitment anywhere in the text: no non-pursuit promise, no authorization, no Computer Misuse Act / DMCA / terms carve-out, no safe harbor wording, no disclose.io reference. Disclosure language restricts the researcher rather than committing Centrica: 'refraining from publicly disclosing unverified vulnerabilities until our team has had time to validate and address reported issues' (not an L5 signal). Not a public Bugcrowd /engagements/ program (centrica, centrica-vdp, centrica-mbb, britishgas all 404), so there is no Bugcrowd brief, engagement state or safeHarborStatus badge to read. FETCH CAVEAT: all of www.centrica.com returns a Cloudflare 403 block page ('Attention Required!') to curl from this client, so the page itself was read from the Wayback raw snapshot of 2026-04-24 (latest capture), which shows the Bugcrowd embed; the policy prose was read LIVE today from the Bugcrowd form endpoint, which accepted a centrica.com Referer (without one it answers 'Missing Referrer header... approved domain'), so the embed is still configured. Subsidiary note (not graded): British Gas runs a separate Bugcrowd embedded form (4c3b197a-1a2b-4542-b1bf-a407c8d2b43d) at britishgas.co.uk/legal-compliance/responsible-disclosure.html, also with no legal commitment, and publishes a /.well-known/security.txt that is text/plain but has NO Contact: line (a comment plus a bare URL), so it does not qualify; centricabusinesssolutions.com/security.txt follows the same pattern.”

“No vulnerability-reporting channel found. No HackerOne team exists (smiths, smithsgroup, smiths-group, smiths_group, smithsdetection all NOT_FOUND). security.txt is 404 at both paths on smiths.com and on the division sites smithsdetection.com, johncrane.com, flextekgroup.com and smithsinterconnect.com. The 949-URL sitemap contains no security, vulnerability, PSIRT or disclosure page (every 'security' hit is a Smiths Detection product press release); the 'Our policies', contact and legal-notice pages have zero mentions of vulnerability, researcher or responsible disclosure.”

“No channel for reporting vulnerabilities in Beazley's own systems. https://www.beazley.com/.well-known/security.txt and /security.txt both return HTTP 200 text/html after redirecting to https://www.beazley.com/en-us/404-error-page/ (soft-404 HTML, no Contact: line, so not a security.txt). /en-gb/security, /en-gb/responsible-disclosure, /en-gb/vulnerability-disclosure(-policy), /en-gb/report-a-vulnerability all redirect to the same 404-error-page. The 9,839-URL sitemap.xml contains no vulnerability-disclosure, responsible-disclosure or bug-bounty page (only cyber-insurance product content such as /cyber-customer-centre/report-a-cyber-incident/, which is for policyholders, not researchers). https://www.beazley.com/en-gb/legal-information/ (200) has no mention of vulnerabilities or security researchers. HackerOne GraphQL team(handle: beazley | beazley_vdp | beazleygroup | beazleyplc) = 'Team does not exist'. Bugcrowd /engagements/beazley, beazley-vdp, beazley-vdp-pro, beazley-mbb all 404 (positive control /engagements/tesla = 200), and Beazley is absent from the 278-entry public engagements.json listing. beazley.responsibledisclosure.com does not resolve. Subsidiary beazley.security also has no security.txt (404 both paths).”

“Live RFC 9116 security.txt (HTTP 200, text/plain) reads in full: 'Acknowledgments: Thank you for staying vigilant Sage Security Team / Canonical: https://www.sage.com/.well-known/security.txt / Contact: mailto:[email protected] / Contact: mailto:[email protected] / Expires: 2040-12-02T00:00:00Z / Policy: https://www.sage.com/en-gb/trust-security/'. Root /security.txt is a Cloudflare 403. The Policy: target is a general Trust & Security marketing hub, not a disclosure policy: live fetch is blocked by Cloudflare (403 'Attention Required' to both curl and WebFetch), and the Wayback snapshots (trust-security/ 2025-10-11, trust-security/security/ 2026-05-06) contain no scope, no submission rules, no safe-harbor or legal language and no mention of vulnerability reporting. HackerOne: team(handle:sage) returns submission_state:null, state:null, policy:null = unclaimed stub, does not count; sage_vdp, sagegroup, sage-group, sagesoftware, sageintacct, sage_group = NOT_FOUND. Bugcrowd /engagements/sage, sage-vdp, sagegroup = 404. No Synack host.”

“www.imiplc.com blocks direct curl from this network with a Cloudflare 403 'Sorry, you have been blocked' page on every path including the homepage, so the 403 is an IP block and not evidence about security.txt; fetched instead via WebFetch (different egress), which returned a hard HTTP 404 for https://www.imiplc.com/.well-known/security.txt, https://www.imiplc.com/security.txt and https://www.imiplc.com/en/responsible-disclosure/. Wayback CDX agrees: security.txt captured 404 on www (2023-06-14) and on climatecontrol., lifescience. and processautomation.imiplc.com. The site's own sitemap (https://www.imiplc.com/en/sitemap/) lists no security, vulnerability or disclosure page; the only cyber item is the 2025 press release /en/news-insights/cyber-security-incident/. https://www.imiplc.com/en/sustainability/reports-policies/ lists ten ESG/tax/modern-slavery documents and no information-security or disclosure policy. HackerOne GraphQL team(handle: imi | imiplc | imi_plc | imi_vdp) = 'Team does not exist'. Bugcrowd /engagements/imi, imi-vdp, imiplc = 404. No Synack host.”

“security.txt is HTTP 404 text/html at /.well-known/security.txt and /security.txt on marksandspencer.com, www.marksandspencer.com and corporate.marksandspencer.com; the Wayback raw copy is the M&S 'Error Page' HTML. corporate.marksandspencer.com/responsible-disclosure, /vulnerability-disclosure and /security are 404, and the 105-URL corporate sitemap.xml has no disclosure page: the only security-adjacent entries are /about-us/corporate-governance/policies and /cyber-update, and neither page (both fetched, 200) contains the words vulnerability, researcher, responsible disclosure or bug bounty, nor any security reporting address. www.marksandspencer.com/c/responsible-disclosure and /c/vulnerability-disclosure are 404; /c/help/security redirects to the generic 'My account and M&S policies' help hub with no disclosure content. HackerOne GraphQL team(handle: marksandspencer | marks-and-spencer | marks_and_spencer | marksandspencer_vdp | mands | m_and_s | ms | mns | marksspencer) = 'Team does not exist', and https://hackerone.com/marksandspencer is a hard 404. Bugcrowd /engagements/marksandspencer, marks-and-spencer, marksandspencer-vdp, marksandspencer-vdp-pro, mands, mands-vdp, m-and-s, marks-spencer all 404 (positive control /engagements/tesla = 200) and M&S is absent from the 278-entry public engagements listing, so no public Bugcrowd program was found despite the batch note. No Synack host. Sixteen months after the April 2025 ransomware incident M&S still publishes no route for reporting vulnerabilities.”

“The policy page is live (HTTP 200) and unchanged in substance: a real VDP with scope, exclusions, rules and an email channel, but no legal commitment of any kind. Scope: 'This policy applies only to Pearson products and services which have a security.txt file in their root.' Submission: 'please email [email protected]', with 'We will aim respond to your email within 24 hours' (a response SLA, not a disclosure deadline). 'Currently, we do not offer a paid bug bounty programme.' The only legal language is a threat and a constraint, not a safe harbor: 'Such research into Pearson Platforms and Services that does not comply with this policy may be considered malicious activity towards Pearson and legal action may be taken as necessary.' and, under Legalities, 'It does not give you permission to act in any manner that is inconsistent with legal and regulatory compliance... including but not limited to: The Computer Misuse Act (1990)... The Copyright, Designs and Patents Act (1988)'. The CMA is cited as a law researchers must not break, so cfaaCarveout is false. There is no promise not to pursue compliant researchers, and testing is throttled rather than authorized: 'You must stop your investigations after you have found the first security issue and request permission to continue testing.' Disclosure is restricted, not time-boxed: 'You must allow us a reasonable amount of time to resolve the security issue before publicly disclosing it' and researchers shall not 'Disclose any vulnerabilities... with anyone other than your dedicated Pearson Security contact', so no cvdTimeline. Worth noting for the page: the policy scopes itself to properties with a security.txt in their root, yet https://www.pearson.com/security.txt and /.well-known/security.txt are HTTP 404, plc.pearson.com is 404 on both, and pearsonplc.com redirects to the plc.pearson.com homepage HTML, so by its own wording the flagship domains are out of scope. HackerOne: team(handle:pearsonplc) = submission_state:null (unclaimed stub, does not count); pearson, pearson_vdp, pearson-vdp, pearsoneducation, pearson_education = NOT_FOUND. Bugcrowd /engagements/pearson, pearson-vdp = 404. No Synack host.”

“HackerOne GraphQL team(handle: games-workshop | gamesworkshop | games_workshop | gamesworkshop_vdp | warhammer | gw) = 'Team does not exist'. Bugcrowd /engagements/games-workshop, gamesworkshop, games-workshop-vdp, gamesworkshop-vdp, games-workshop-vdp-pro, warhammer all 404 (positive control /engagements/tesla = 200) and Games Workshop is absent from the 278-entry public engagements listing, so no public Bugcrowd program was found despite the batch note. No Synack host.”

“No channel found. HackerOne handle 'sainsburys' exists but GraphQL returns {"handle":"sainsburys","name":"Sainsbury's","submission_state":null,"state":null} = unclaimed community stub, does not count. security.txt: about.sainsburys.co.uk/.well-known/security.txt and /security.txt both 302 to https://corporate.sainsburys.co.uk/ (200 text/html homepage, trap c); corporate.sainsburys.co.uk/.well-known/security.txt 404; www.sainsburys.co.uk, sainsburys.co.uk, argos.co.uk, nectar.com, sainsburysbank.co.uk all 403 (WAF) with HTML bodies; Wayback raw snapshot of www.sainsburys.co.uk/.well-known/security.txt is an archived 'Error 404 - File Not Found' page, and a reader-proxy fetch of the live path also returns the 404 page. corporate.sainsburys.co.uk sitemap.xml (426 URLs) has no security/disclosure/vulnerability page; direct probes of /security, /responsible-disclosure, /vulnerability-disclosure on corporate 404 and on www 503. No Bugcrowd /engagements/ (sainsburys, sainsburys-vdp, argos all 404). sainsburys.responsibledisclosure.com does not resolve (positive control bp.responsibledisclosure.com = 302).”

“No channel found. HackerOne handle 'weirgroup' exists but GraphQL returns {"handle":"weirgroup","name":"The Weir Group","submission_state":null,"state":null} = unclaimed community stub, does not count ('weir', 'weir_group', 'weir-group', 'theweirgroup' not found). https://www.global.weir/.well-known/security.txt and /security.txt both 404 (text/html). www.global.weir/sitemap.xml (3,864 URLs) contains no security / responsible-disclosure / vulnerability page; the only security-adjacent URLs are /suppliers/baseline-security-assessment/ (supplier questionnaire) and a 2025 'q3-trading-update-and-cybersecurity-incident' news item, neither of which gives a reporting route (grep for 'vulnerab' on both pages returned nothing). Direct probes /security, /responsible-disclosure, /vulnerability-disclosure all 404. No Bugcrowd /engagements/ (weir, weirgroup, weir-group = 404). weir/weirgroup.responsibledisclosure.com do not resolve.”

“No channel found. HackerOne: 'ig' resolves to an unrelated team named '#iG' (submission_state null); iggroup, ig_group, ig-group, iggroup_vdp, tastytrade, tastyworks not found. security.txt 404 (text/html) at both paths on www.iggroup.com and www.ig.com (iggroup.com apex does not answer; www.ig.com/uk/ and tastytrade.com also 404). www.iggroup.com/sitemap.xml (43 URLs) has no security page; www.ig.com/uk sitemaps (34,535 URLs) contain no responsible-disclosure / security-reporting page (the only 'vulnerability' hit is https://www.ig.com/uk/client-vulnerability, which is the vulnerable-customers policy, not security). Direct probes of /security, /responsible-disclosure, /vulnerability-disclosure on both hosts 404. iggroup.com contact page lists only [email protected] / regional helpdesks and IR/press contacts, no security mailbox. No Bugcrowd /engagements/ (iggroup, ig-group, ig, tastytrade = 404). ig/iggroup.responsibledisclosure.com do not resolve.”

“Bugcrowd brief read via the changelog JSON (https://bugcrowd.com/engagements/entain-public-mbb-og/changelog/5dc33ba8-650a-409f-81b7-06081b37fd7d.json): brief name 'Entain Public Managed Bug Bounty Engagement 2024'; data.engagement.state = "in_progress" (statusLabel 'In progress', pausedReason null, startsAt 2024-11-12, participation 'open', engagementConfiguration.participation 'open', Bug Bounty pay_for_success, changelog publishedAt 2025-04-22); data.brief.safeHarborStatus = {status:"full", label:"Safe harbor", description:"This engagement is fully committed to providing safe harbor for good-faith security research."}. Company-authored brief prose (targetsOverview): 'Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith.' Testing authorized on 12 in-scope targets (Ladbrokes, Coral, bwin, partypoker, partycasino, Gala): 'Testing is only authorized on the targets listed as In-Scope.' No inbound CVD deadline; disclosure is permission-gated: 'Before disclosing an issue publicly we require that you first request permission from us... Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected.' (restricts the researcher, so cvdTimeline false). No company-hosted policy on entaingroup.com (/responsible-disclosure, /security, /vulnerability-disclosure, /bug-bounty 404; sitemap.xml 404); no security.txt on entaingroup.com (404 both paths), bwin.com 404, ladbrokes.com/coral.co.uk 403 HTML. HackerOne: entain, entaingroup, entain_vdp, entain-group, gvc, gvcholdings, ladbrokes, coral, bwin all not found. entain.responsibledisclosure.com does not resolve.”

“Page still live with the same text (www.investec.com serves a Cloudflare 'Just a moment' 403 challenge to curl and WebFetch, so the live page was read through a reader proxy, title 'Responsible disclosure', and cross-checked against the Wayback raw snapshot of 2025-08-13, which carries identical policy text). Full policy: 'At Investec we take security very seriously and value contributions from the security community... We require that security researchers: Make every effort to avoid impacting the confidentiality, integrity or availability of Investec systems and data. Keep the details of any vulnerabilities confidential between Investec and yourself, until we have had 90 days to resolve the reported vulnerability. Only exploit a vulnerability to the extent necessary to confirm that the vulnerability exists... Only utilise the specified contact email address for communication regarding the reported vulnerability. No security.txt (404 text/html both paths on www.investec.com; investec.co.uk redirects to the challenge). HackerOne investec / investec_vdp / investecbank not found; Bugcrowd /engagements/investec and investec-vdp 404; investec.responsibledisclosure.com does not resolve.”

“https://www.melroseplc.net/.well-known/security.txt returns HTTP 200, content-type text/plain; charset=utf-8, 136 bytes: 'Canonical: /.well-known/security.txt' 'Contact: mailto:[email protected]' 'Expires: 2030-01-01T10:10:00Z' 'Preferred-Languages: en'. No Policy: field, and the contact is the web agency's hosting-alerts mailbox (Sampson May), not a Melrose security team; no policy document anywhere. Root /security.txt 404. The subsidiary www.gknaerospace.com/.well-known/security.txt carries the identical agency contact (noted, not graded: parent policy rule). melroseplc.net HTML pages answer 403 to curl (WAF); reader-proxy reads of the homepage and /contact-us/ show no security or disclosure link or mailbox. HackerOne melrose / melroseindustries / melrose_industries / gkn / gknaerospace / gkn_aerospace / gkn-aerospace not found; Bugcrowd /engagements/ melrose, gkn, gknaerospace, gkn-aerospace 404; melrose/gkn/gknaerospace.responsibledisclosure.com do not resolve.”

“Root /security.txt (200, text/plain) reads: "# St. James's Place Wealth Management - reporting security vulnerabilities to St. James's Place... # Please report any security vulnerabilities to us via the contact method below. # Please do not include any sensitive information in your initial message, we'll provide a secure communication method in our reply to you. Contact: mailto:[email protected] Contact: mailto:[email protected]". No Policy: line, no Expires: line; /.well-known/security.txt is 404 (root-only placement). No policy document exists anywhere on sjp.co.uk: the sitemap's only 'security' hits are /site-services/security-policy (a cookie notice, 'SJP Approved 02/04/2026') and /individuals/help-centre/online-security (customer fraud advice, no researcher content). No scope, no authorization, no legal language.”

“No vulnerability-reporting channel found. www.spiraxgroup.com sitemap (https://www.spiraxgroup.com/en/sitemap?sitemap=en, 111 URLs) contains no security, disclosure or vulnerability page; the only policy/contact pages are /en/privacy-policy, /en/contact-us and shareholder contacts. /security and /security.txt are 404 on spiraxgroup.com; the operating-brand site www.spiraxsarco.com also 404s both security.txt locations. No HackerOne team, no Bugcrowd engagement, no Synack host.”

“No vulnerability-disclosure channel. The only security-reporting page on the site is https://www.babcockinternational.com/who-we-are/suppliers/supply-chain-responsibility/supplier-security-incident-management/, which is a supplier obligation, not a researcher channel: "Babcock expects any supplier that experiences a security incident (including near misses) to notify them... Incidents should be reported via the Supplier Incident Phone Number – (+44) 20 8963 7030". /terms/ only prohibits "unauthorised access to any part or component of our website" (a constraint, not a carve-out). Full sitemap (987 URLs; 248 non-news) has no responsible-disclosure, vulnerability, PSIRT or bug-bounty page; both security.txt locations 404.”

“No vulnerability-reporting channel. The full policies-and-disclosures index at https://www.icgam.com/who-we-are/leadership-governance/policies-disclosures/ lists 19 policies (privacy, cookies, website terms of use, complaints, tax strategy, code of conduct, modern slavery, etc.) and none concern security research or vulnerability reporting; /website-terms-of-use/ has no vulnerability, researcher or security-contact text. Sitemap (1,170 URLs) has no security/disclosure page; both security.txt locations 404.”

“No vulnerability-reporting channel on the parent. lionfinancegroup.uk is a catch-all SPA: every probed path (/responsible-disclosure, /security, /bug-bounty, /vdp, a random slug) returns 200 with the same ~5.99 KB shell, so those 200s are soft-404s, and /.well-known/security.txt and /security.txt return text/html (not a security.txt). Sitemap (1,011 URLs) has no security, disclosure or vulnerability page; only dividend policy and investor contacts match. Subsidiary check (bankofgeorgia.ge, the main operating bank): same catch-all behaviour, security.txt is HTML at both locations, sitemap (704 URLs) has no bug-bounty/security page; not graded per the parent-canonical rule, noted only.”

“Policy page still live (200) and unchanged in substance: "If you have identified a vulnerability in any of our online assets, you must disclose that to Kingfisher in accordance with this Responsible Disclosure Policy using the submission form below." Submission is an embedded Bugcrowd Elements external form (iframe https://bugcrowd.com/da068b9a-e5f5-44fb-8a0f-6dfb315267aa/external/report; React props show disabled:false and submittedFromUrl:https://www.kingfisher.com/responsible-disclosure when fetched with the Kingfisher referrer, so the form is live; no public bugcrowd.com/engagements/ brief exists, so no Bugcrowd safe-harbor badge to read). Scope is broad ("any Kingfisher online business asset"), with a do-not list (no DoS, no accessing others' data, no third-party testing). NO safe harbor: the only legal language is the opposite, "Kingfisher reserves all of its rights to take action against security researchers who do not comply with this Responsible Disclosure Policy", plus a researcher-restricting clause "Disclose, or otherwise share, any details of any Kingfisher security vulnerability with anyone other than Kingfisher" (not a CVD timeline). No authorization-to-test, no CMA/DMCA/ToS carve-out, no non-pursuit promise; rewards "at its sole discretion". Governed by "the laws of England". No security.txt (both locations 404).”

“No vulnerability-disclosure channel found. security.txt: https://www.landsec.com/.well-known/security.txt and /security.txt both return HTTP 200 with Content-Type text/html (Next.js SPA shell, no Contact: line) = not a security.txt; Wayback raw snapshot (20251122) is a 404. Every probed VDP path (/security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /bug-bounty, /psirt, /en-gb/security etc.) returns the site's soft-404 page titled 'Not Found'. /privacy-policy, /contact-us and /legal contain no 'vulnerab' text and no security mailbox. robots.txt exposes no sitemap. HackerOne: handle 'landsecurities' exists but GraphQL returns submission_state:null, state:null, policy:null = unclaimed community stub, does NOT count; 'landsec' and 'land_securities' do not exist. Bugcrowd /engagements/landsec and /engagements/land-securities = 404. Synack landsec.responsibledisclosure.com does not resolve.”

“Wayback snapshot (20260103) also 404. https://www.computacenter.com/en/security is a marketing page ('Securing your business, your data, and your people... We help you design, deploy, and manage the right security solutions'), not a disclosure policy. The 357 KB sitemap.xml contains no responsible-disclosure/vulnerability/PSIRT URL; /en/information/legal, /en/information/contact-us and the fraud-and-scam-awareness page contain no 'vulnerab' text and no security mailbox. HackerOne 'computacenter' and 'computacenter_vdp' do not exist. Bugcrowd /engagements/computacenter = 404. Synack computacenter.responsibledisclosure.com does not resolve.”

“howdens.com /.well-known/security.txt and /security.txt both 404; Wayback snapshot (20260105) 404. Corporate site howdenjoinerygroupplc.com returns HTTP 200 text/html (soft-404 page) for both security.txt paths = not a security.txt. Every direct VDP path probe on www.howdens.com (/security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /bug-bounty, /psirt) 404s. sitemap.xml (index) and editorial-home1.xml child list only contact-us, privacy-policy, terms pages; /privacy-policy and /terms-and-conditions contain no 'vulnerab' text and no security mailbox; the group-plc sitemap has no security/disclosure URL. HackerOne 'howdens', 'howdens_joinery', 'howdensjoinery' do not exist. Bugcrowd /engagements/howdens and /engagements/howdens-joinery = 404. Synack howdens.responsibledisclosure.com does not resolve.”

“croda.com /.well-known/security.txt and /security.txt both 404 (HTML); Wayback snapshot (20230613) 404. robots.txt points to https://www.croda.com/websitemap.xml (386 KB): no URL matching security/vulnerability/disclosure/PSIRT, only privacy-policy, contact-us, contact-ir, media enquiries. All 15 direct VDP path probes 404. /en-gb/privacy-policy and /en-gb/contact-us contain no 'vulnerab' text and no security mailbox. HackerOne 'croda' and 'croda_international' do not exist. Bugcrowd /engagements/croda = 404. Synack croda.responsibledisclosure.com does not resolve.”

“londonmetric.com /.well-known/security.txt and /security.txt both 404 (HTML); Wayback snapshot (20260117) 404. sitemap.xml (65 KB) has no security/vulnerability/disclosure URL (only 'responsible-business-framework-and-policies' under sustainability, which is ESG, plus press releases). All 15 direct VDP path probes 404. /contacts and /privacy-policy contain no 'vulnerab' text and no security mailbox; /legal is 404. HackerOne 'londonmetric' and 'londonmetric_property' do not exist. Bugcrowd /engagements/londonmetric = 404. Synack londonmetric.responsibledisclosure.com and londonmetricproperty.responsibledisclosure.com do not resolve.”

“aberdeenplc.com /.well-known/security.txt and /security.txt both 404 (Next.js HTML); the legacy abrdn.com domain redirects to www.aberdeeninvestments.com, which also 404s on security.txt; Wayback snapshots for aberdeenplc.com (20250701), abrdn.com (20241101) and aberdeeninvestments.com (20250803) are all 404. The only 'security' URL in the sitemap, https://www.aberdeenplc.com/en-gb/security ('Security | Aberdeen plc'), is a customer fraud-awareness page: 'With scams and fraudulent activity increasing in sophistication... The information below explains more about how to get help, what you can do to protect yourself, and some of the types of fraud and scams you should be aware of.' Its only mailbox is 'please send it to [email protected]' for suspicious messages impersonating Aberdeen, i.e. a phishing-report inbox, not a vulnerability-disclosure channel; the word 'vulnerable' appears only in consumer advice ('leave you vulnerable to being targeted by cyber criminals'). No responsible-disclosure/PSIRT URL in the 143 KB sitemap; /en-gb/contact-us has no 'vulnerab' text and no security mailbox. HackerOne 'aberdeen', 'aberdeenplc', 'aberdeen_group', 'abrdn', 'standardlifeaberdeen', 'standard_life', 'aberdeen_vdp', 'interactiveinvestor', 'interactive_investor' do not exist. Bugcrowd /engagements/aberdeen, /aberdeen-group, /abrdn, /aberdeenplc = 404. Synack aberdeen/abrdn/aberdeenplc.responsibledisclosure.com do not resolve.”

“No security.txt: https://www.metlen.com/.well-known/security.txt and /security.txt both return HTTP 404 (HTML 'Error 404' page); apex metlen.com redirects to the homepage; mytilineos.gr / mytilineos.com redirect to metlen.com; Wayback raw snapshot 404. No disclosure page: 14 path probes (/security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /bug-bounty, /cyber-security...) all 404; the site's own /sitemap/ page and homepage footer link only contact-us, privacy-policy, IR/media contacts (no security/disclosure/vulnerability link). HackerOne handles metlen and mytilineos: 'Team does not exist'. Bugcrowd /engagements/metlen and /engagements/mytilineos: 404. Synack metlen/mytilineos.responsibledisclosure.com: no DNS (positive control bp.responsibledisclosure.com returned 302).”

“https://www.tritaxbigbox.co.uk/.well-known/security.txt and /security.txt: HTTP 404 (Wayback raw snapshot also 404). Sitemap https://www.tritaxbigbox.co.uk/sitemap.xml (222 URLs) contains no security/disclosure/vulnerability/cyber URL (only /privacy-policy/ matched the legal grep); privacy policy text contains no vulnerability-reporting language. 14 direct path probes all 404. HackerOne tritax / tritaxbigbox: 'Team does not exist'. Bugcrowd /engagements/tritax and /engagements/tritaxbigbox: 404. Synack tritax/tritaxbigbox.responsibledisclosure.com: no DNS.”

“https://www.britishland.com/.well-known/security.txt and /security.txt: HTTP 404 (Wayback raw snapshot 404). Sitemap https://www.britishland.com/xmlsitemap/ (394 URLs): the only 'secur' matches are debt-investor pages ('secured-debentures', 'unsecured-covenants'); no disclosure/vulnerability/cyber page. /legal/, /contact/ and /terms-of-use/ contain no vulnerability-reporting or security-researcher language. 14 direct path probes all 404. HackerOne britishland / british_land: 'Team does not exist'. Bugcrowd /engagements/britishland and /engagements/british-land: 404. Synack britishland.responsibledisclosure.com: no DNS.”

“Corporate site: https://www.jdplc.com/.well-known/security.txt returns HTTP 403 (nginx 'Forbidden' HTML, not text/plain) and /security.txt returns a WordPress 'Page not found' 404; Wayback raw snapshot 404. WordPress page sitemap (https://www.jdplc.com/wp-sitemap-posts-page-1.xml) lists contact-us, investor/governance/media contacts and /about-the-website/privacy-policy/ but no security or disclosure page; privacy policy and contact-us contain no vulnerability-reporting language; 14 direct path probes all 404. Retail brand jdsports.co.uk: /.well-known/security.txt and /security.txt return 403 (WAF, empty body) on www and 404 on the apex; Wayback raw snapshot 404; /page/security/ and /page/responsible-disclosure/ 403 live and 404 in Wayback. HackerOne jdsports / jd_sports / jdplc / jdsportsfashion: 'Team does not exist'. Bugcrowd /engagements/jdsports, jd-sports, jdplc, jd: 404. Synack jdsports/jdplc.responsibledisclosure.com: no DNS. Residual risk: www.jdsports.co.uk fully WAF-blocks curl, so a security.txt there cannot be ruled out from this pass (Wayback has no snapshot of one).”

“com). https://www.burberry.com/.well-known/security.txt is live, HTTP 200, Content-Type text/plain, full text: 'Contact: [email protected] / Bounties: Burberry do not currently operate a Bug Bounty program and do not permit unauthorized testing. / Reports: However, if you do identify a potential security issue, we welcome your feedback. / Hiring: https://burberrycareers.com/search/?q=security / #v1.0'. No Policy: field. www.burberry.com/security.txt returns the Next.js HTML shell (not a security.txt); /security and /responsible-disclosure on burberry.com redirect to the homepage. Corporate site www.burberryplc.com returns Akamai 'Access Denied' 403 for both security.txt paths and a 'Challenge Validation' 200 for every path probe (catch-all, not real pages); Wayback raw snapshot 404. HackerOne 'burberry' exists but submission_state:null, state:null, policy:null = unclaimed stub, does not count. Bugcrowd /engagements/burberry: 404. Synack burberry.responsibledisclosure.com: no DNS.”

“Bugcrowd engagement iag-transform-vdp-pro, the IAG Transform Vulnerability Disclosure Engagement ("IAG Transform is the central transformation platform of International Airlines Group (IAG)"), is open and scoped to group systems including subdomains of iaggbs.com and iairgroup.com. It carries Bugcrowd's full "Safe harbor" tier and its policy states that research under the policy is "Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions". British Airways, a subsidiary, also runs an open HackerOne disclosure program with no legal commitment. No published disclosure deadline.”

“Live site is behind a Cloudflare JS challenge (every path incl. /.well-known/security.txt, /security.txt, /security, /responsible-disclosure, /sitemap.xml, /robots.txt returns 403 'Just a moment...'), so the site was read via the Wayback raw snapshot of the homepage (captured 2026-08-30): its full link set is About us, Corporate governance, Dividend information, Share buyback, Events, Materials, NAV, Reports, Portfolio, Press releases, Team, Privacy notice, Registered office, Registrar, Terms of use; there is no security, vulnerability, or responsible-disclosure page and zero occurrences of 'vulnerab' or 'responsible disclos' in the page. Wayback raw fetch of both security.txt locations returns 404 (WordPress 404 page). HackerOne slugs pershingsquare / pershing_square / pershingsquareholdings: 'Team does not exist'. Bugcrowd /engagements/pershingsquare and /pershing-square: 404; neither Bugcrowd public index (bounty 278 rows, VDP 220 rows, positive controls Tesla/HSBC/Unilever/NatWest present) lists Pershing. Synack pershingsquare.responsibledisclosure.com and pershingsquareholdings.responsibledisclosure.com: no DNS (control bp.responsibledisclosure.com resolves). Note pershingsquare.com is an unrelated restaurant; pershingsquarecapital.com does not resolve.”

“/.well-known/security.txt and /security.txt on persimmonhomes.com and www return 404 HTML. The full HTML sitemap (https://www.persimmonhomes.com/sitemap, 1.05 MB) contains no page whose URL mentions security, disclosure, vulnerability or cyber outside of news headlines ('...secures planning permission'); the only policy pages are privacy-policy, tax-evasion-policy, policy-on-publication-of-reviews and terms-conditions. The corporate section (/corporate/...) lists Code of Ethics, Modern Slavery, Tax Strategy, Gender Pay Gap and Corporate Governance pages, none about vulnerability reporting. /corporate/contact-us/ publishes feedback@, legalenquiries@, plc.gdprinfo@, pressoffice@, safetyconcerns@ (building safety), stakeholder@ and sustainability@ addresses, no security or infosec contact. The Managing Risk page only says 'we have simultaneously continued to invest in maintaining and improving our cyber security posture' with no reporting route. Direct probes /security /responsible-disclosure /vulnerability-disclosure /vulnerability-disclosure-policy /security-policy /report-a-vulnerability /bug-bounty /disclosure: all 404. HackerOne persimmon / persimmonhomes / persimmon_vdp: 'Team does not exist'. Bugcrowd /engagements/persimmon, /persimmon-homes, /persimmonhomes: 404; not in either Bugcrowd public index. Synack persimmon.responsibledisclosure.com and persimmonhomes.responsibledisclosure.com: no DNS. Subsidiary charleschurch.com probed too: 404 on all disclosure paths.”

“If you discover a site vulnerability or are a customer who is concerned your account has been compromised, please notify us via [email protected]. We encourage you to encrypt sensitive information.' Submission requirements are stated ('A detailed summary of the issue, including a list of steps for how we can reproduce it. Correct contact information'). The only legal language is a constraint, not a commitment: 'We appreciate these types of research activities, but will not tolerate any actions that put our users at risk: Do not attempt to access, modify, destroy, or disclose our users' information. Do not attempt to deface or degrade our services. Do not violate applicable law.' No promise not to pursue legal action, no authorisation to test, no Computer Misuse Act / DMCA / ToS carve-out. Disclosure clause restricts the researcher only: 'We ask you do not publicly disclose your submission until Whitbread has evaluated the impact' (not an inbound CVD deadline). 'Please be aware that we do not operate bug bounty programme at this time and therefore do not offer rewards by default.' Page also newly carries a UK Cyber Resilience Pledge section (not disclosure-relevant). No security.txt: /.well-known/security.txt and /security.txt on whitbread.co.uk and www return 404 HTML; premierinn.com (subsidiary) also 404 on both plus /security and /responsible-disclosure. HackerOne whitbread / whitbread_vdp / premierinn / premier_inn: 'Team does not exist'. Bugcrowd /engagements/whitbread, /premier-inn, /premierinn: 404; not in either Bugcrowd public index. Synack whitbread.responsibledisclosure.com and premierinn.responsibledisclosure.com: no DNS.”

“convatecgroup.com is a catch-all: every unknown path (/.well-known/security.txt, /security.txt, /security, /responsible-disclosure, /vulnerability-disclosure, /report-a-vulnerability, /bug-bounty...) 302s to the homepage and returns the HTML 'Convatec Group: Forever caring' page (text/html, no Contact: line), which is NOT a security.txt. The group page sitemap (https://www.convatecgroup.com/en-us/sitemap-Page.xml, 43 KB) lists governance, documents-and-disclosures (regulatory), contact-us, legal-notice, myconvatec-terms-of-service and privacy-policy, and no security, PSIRT, vulnerability or disclosure page; legal-notice, contact-us and about-us/governance contain no 'vulnerab', 'security researcher' or 'responsible disclos' text and no security mailbox. The product site convatec.com returns real 404s ('404 - Page Not Found - Convatec') for /.well-known/security.txt, /security.txt, /security, /product-security, /cybersecurity, /psirt, /en-us/product-security, /vulnerability-disclosure and /responsible-disclosure, and its en-gb and en-us page sitemaps list only contact-us, legal-notice and privacy pages, no product-security or PSIRT page (notable for a medical-device maker). HackerOne convatec / convatec_vdp / convatecgroup: 'Team does not exist'. Bugcrowd /engagements/convatec and /convatec-group: 404; not in either Bugcrowd public index. Synack convatec.responsibledisclosure.com: no DNS.”

“We welcome working with you to resolve the issue promptly.' Disclosure Policy: 'Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue. Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.' Exclusions list (DoS, brute forcing, social engineering, third parties, plus a long non-qualifying-bug list) and 'Please send your reports to our Customer Security team: [email protected]'. 'This program does not currently offer rewards, but we do offer: our sincere thanks and gratitude; a place on our hall of fame; and... discretionary awards of online vouchers.' It is scope + how-to-submit only: there is no promise not to take legal action, no authorisation language, no Computer Misuse Act / DMCA / Terms carve-out, and the disclosure clause restricts the researcher rather than committing Autotrader to a deadline. The plc site's cyber-security page (https://plc.autotrader.co.uk/esg/our-governance-compliance/cyber-security/) describes NIST CSF governance and pen-testing but has no reporting route and does not link the hall-of-fame page. No security.txt: /.well-known/security.txt and /security.txt 404 on plc.autotrader.co.uk, autotrader.co.uk and www. HackerOne: autotrader_uk EXISTS but submission_state:null / state:null / policy:null, i.e. an unclaimed community stub, does not count; autotrader / auto_trader / autotrader_vdp / autotraderuk: 'Team does not exist'. Bugcrowd /engagements/autotrader, /auto-trader, /autotrader-uk, /auto-trader-uk: 404; not in either Bugcrowd public index. Synack autotrader.responsibledisclosure.com: no DNS.”

“/.well-known/security.txt and /security.txt on barrattredrow.co.uk and www return 404 HTML (the legacy www.barrattdevelopments.co.uk redirects both paths to the barrattredrow.co.uk homepage, HTML, not a security.txt). The corporate sitemap (48 KB) has no security, disclosure, vulnerability or cyber page; the Policies and documents page (https://www.barrattredrow.co.uk/about-us/policies-and-documents) lists Tax Strategy, Modern Slavery, Whistleblowing, Ethics, Anti-Bribery, Share Dealing, Health and Safety, Diversity, Climate, Sustainability, Timber, Water, Human Rights and Environmental policies, no vulnerability-disclosure or information-security policy. /contact-us routes only customer care, sales, legal, land, careers and press enquiries; no security mailbox anywhere on the page. Direct probes /security /responsible-disclosure /vulnerability-disclosure /vulnerability-disclosure-policy /security-policy /report-a-vulnerability /bug-bounty /disclosure: 404 on barrattredrow.co.uk; also 404 on the brand sites barratthomes.co.uk, redrow.co.uk and davidwilsonhomes.co.uk (incl. both security.txt locations), whose sitemaps list only privacy notices and terms. HackerOne barratt / barrattredrow / barratt_redrow / barratthomes / barrattdevelopments / redrow: 'Team does not exist'. Bugcrowd /engagements/barratt, /barratt-redrow, /barrattredrow, /barratt-developments, /redrow: 404; not in either Bugcrowd public index. Synack barratt / barrattredrow / redrow / barratthomes.responsibledisclosure.com: no DNS.”

“The listed domain dccplc.com no longer resolves (NS delegated to gcd-dns.com, no A record; last Wayback capture 2025-07-11 was a parked ad page). The corporate site dcc.ie now 301s to www.dccenergy.com (company renamed DCC Energy plc in 2026, per /news-and-insights/news/2026/dcc-energy-plc-new-name-reflects-strategic-focus). Full dccenergy.com sitemap (53 URLs) contains no security, disclosure or PSIRT page; contact-us and business-conduct pages carry no security contact; terms-of-use only says 'We do not guarantee that the Website will be secure or free from bugs or viruses.' HackerOne handle 'dccplc' exists but GraphQL returns submission_state:null, state:null, policy:null (unclaimed community stub, does not count). No Bugcrowd /engagements/ brief, no Synack subdomain, no security.txt at either path on dccenergy.com (404 HTML).”

“If you believe you have discovered a security vulnerability on a Hiscox website, please contact us via email: [email protected].' The identical sentence appears on https://www.hiscox.co.uk/contact-us. It is a contact line only: no scope, no submission guidance, no safe-harbor or legal language anywhere on the page, so L1. The Group 'Information security statement' PDF (May 2022) on /about-hiscox/group-policies-and-disclosures describes the ISMS and contains no disclosure policy. No security.txt on hiscoxgroup.com, hiscox.co.uk or hiscox.com (hiscox.com is behind a Cloudflare challenge; Wayback 2023 snapshot of its /.well-known/security.txt is a 404). No HackerOne, Bugcrowd or Synack program.”

“Full sitemap.xml read (all non-article pages: about-us, corporate-governance, contact-us, privacy-policy, terms-of-use, legal-regulatory-information, fca-share-fraud-warning, accessibility, faqs); none is a security or disclosure page and none mentions vulnerability reporting. The only published contact is the investor line: 'Email: [email protected]... Tel: 01382 938 320' (contact-us), which is not a security channel. Privacy policy speaks only of internal measures ('We will take reasonable technical and organisational security measures to safeguard your personal information'). No security.txt (both paths return the Next.js 404 HTML shell). No HackerOne team, no Bugcrowd /engagements/ brief, no Synack subdomain. Note: the trust is externally managed by Towers Watson Investment Management (WTW); graded on the company's own surface, not the manager's.”

“That FIRST page is the team record for 'Capital Group... Security Intelligence Response Team... Host organization Capital Group, Country: United States', i.e. the Los Angeles asset manager Capital Group, unrelated to Polar Capital LLP or the trust; contact should be null. On the trust's own site every footer/nav page was read (Contact-Information, Protect-Against-Fraud, Terms-and-Conditions, Privacy-Notice, Complaints-Policy, Consumer-Duty, Web-Accessibility): no security or disclosure page, no security contact. The only technical-adjacent mailbox is the privacy one: 'Email: [email protected] Contact:... Polar Capital Group Chief Legal and Compliance Officer', a GDPR contact, not a vulnerability channel. The manager site polarcapital.co.uk geo-redirects to www.polarcapitalfunds.com, which also has no /security, /responsible-disclosure or security.txt (all 404 HTML). No sitemap.xml on either domain (404). No HackerOne team, no Bugcrowd /engagements/ brief, no Synack subdomain. No security.txt at either path (404 HTML with trailing-slash redirect).”