Question 1

What kind of security program does DEF CON run?

Accepted Answer

DEF CON runs a public security policy (rewards not stated), with safe harbor not stated.

Question 2

Does DEF CON have a bug bounty program?

Accepted Answer

DEF CON publishes a security policy for reporting vulnerabilities. The data does not state whether it pays rewards, so check the policy itself.

Question 3

How do I report a vulnerability to DEF CON?

Accepted Answer

Read DEF CON's published policy first and stay inside its scope. The listed security contact is info@defcon.org. Include clear reproduction steps, impact and a proof of concept.

Question 4

Does DEF CON offer safe harbor to security researchers?

Accepted Answer

The data does not state DEF CON's safe harbor position. Look for "safe harbor" or "authorisation" wording in its policy before testing.

Question 5

Which sites does DEF CON's security policy cover?

Accepted Answer

One DEF CON policy covers 4 entries in the public database, including defcon.org, infocon.org, media.defcon.org. Report issues on any of them through the same channel — and check each is in scope first.

Question 6

Is DEF CON's security policy still active?

Accepted Answer

Its policy page was reachable when the disclose.io data was snapshotted (November 2026). Policies change, so always read the current version.

Question 7

How do I write a report DEF CON will accept?

Accepted Answer

Lead with impact, give exact steps to reproduce, attach a minimal proof of concept and suggest a fix. Our guide on writing reports triagers love walks through each part.

DEF CON vulnerability disclosure.