[ DB ] — Program directory · U
U.S. Securities and Exchange Commission vulnerability disclosure.
Plain answers on whether U.S. Securities and Exchange Commission pays, how much legal protection it gives researchers, and where to send a report.
What kind of security program does U.S. Securities and Exchange Commission run?
U.S. Securities and Exchange Commission runs a vulnerability disclosure program with no cash bounty, with full safe harbor.
At a glance
- Pays bounties
- No
- Swag
- No
- Hall of fame
- Not stated
- Safe harbor
- Full
- Security contact
- security@sec.gov
- security.txt
- Not stated
- PGP key
- Not stated
- Public disclosure
- Not stated
- Disclosure timeline
- Not stated
- Preferred languages
- Not stated
- Policy page
- Live at last check
One policy covers 3 listed sites and brands
SEC · Securities and Exchange Commission
Type: vulnerability disclosure program. Data from the disclose.io open database (CC0), snapshot November 2026. Policies change — always read U.S. Securities and Exchange Commission's own policy and scope before testing.
[ FAQ ] — U.S. Securities and Exchange Commission: questions researchers ask
Does U.S. Securities and Exchange Commission have a bug bounty program?
+
Not a paid one. U.S. Securities and Exchange Commission has a public vulnerability disclosure policy that welcomes reports without a cash bounty.
How do I report a vulnerability to U.S. Securities and Exchange Commission?
+
Read U.S. Securities and Exchange Commission's published policy first and stay inside its scope. The listed security contact is security@sec.gov. Include clear reproduction steps, impact and a proof of concept.
Does U.S. Securities and Exchange Commission offer safe harbor to security researchers?
+
Yes, full safe harbor. U.S. Securities and Exchange Commission commits not to take legal action against good-faith research that follows its policy, covering both anti-hacking and anti-circumvention laws.
Does U.S. Securities and Exchange Commission give swag or hall of fame credit?
+
U.S. Securities and Exchange Commission does not offer swag.
Which sites does U.S. Securities and Exchange Commission's security policy cover?
+
One U.S. Securities and Exchange Commission policy covers 3 entries in the public database, including SEC, Securities and Exchange Commission. Report issues on any of them through the same channel — and check each is in scope first.
Is U.S. Securities and Exchange Commission's security policy still active?
+
Its policy page was reachable when the disclose.io data was snapshotted (November 2026). Policies change, so always read the current version.
How do I write a report U.S. Securities and Exchange Commission will accept?
+
Lead with impact, give exact steps to reproduce, attach a minimal proof of concept and suggest a fix. Our guide on writing reports triagers love walks through each part.
Before you report
Hack with AutoVAPT.ai behind you.
BugsBounty researchers are vetted and get autonomous AI pentesting for recon and exploit proof. Registration is by approval.