The Church of Jesus Christ of Latter-Day Saints
Vulnerability disclosure program on security.txt churchofjesuschrist.org
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- https://www.churchofjesuschrist.org/informationsecurity
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
You will not receive any compensation for your time or materials.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Domains 2
- churchofjesuschrist.org
- lds.org
Rules
What the policy asks of you, and the bug types it won't reward, quoted from The Church of Jesus Christ of Latter-Day Saints's policy.
While testing
-
Collaborate with the Church to address vulnerabilities identified in your submissions.
-
Provide a detailed description of each step to reproduce the vulnerability.
-
Do not engage in disruptive testing like Denial of Service (“DoS”) or any action that could impact the confidentiality, integrity or availability of user data and information systems.
-
Do not engage in social engineering (e.g., phishing, vishing, smishing, etc.) of members or employees.
-
Do not perform exfiltration of any kind to other mediums.
-
Do not engage in any activity that may result in harm to the Church, its members, or its employees.
-
Do not store, share, compromise or destroy the Church’s data.
-
If Personally Identifiable Information (“PII”) is encountered, you must immediately halt your activity, purge related data from your system, and immediately contact the Church.
-
Abide by the Terms of Use for Church websites, including the Code of Conduct.
Not accepted
-
Theoretical vulnerabilities
-
Informational disclosure of non-sensitive data
-
Low impact session management issues
-
Self XSS (user defined payload)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.