Federal Retirement Thrift Investment Board

Vulnerability disclosure program on Self-hosted frtib.gov

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No FRTIB will not compensate a Reporter and/or Finder for any issues found and analyzed to be actual weaknesses for the Agency.
Response: Within 3 days Within three business days, FRTIB will acknowledge receipt of the vulnerability report.
Safe harbor: Full If security research and vulnerability disclosure activities are conducted in accordance with the restrictions and guidelines set forth in this policy, FRTIB will not initiate or recommend legal action related to such activities.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

55 assets you may test, 3 excluded.

Out of scope (3)

Any services not expressly listed as in-scope, such as connected services, are excluded from this policy and are not authorized for vulnerability testing.
testing those services is NOT IN SCOPE
vulnerabilities that are discovered in non-Federal systems that belong to FRTIB vendors fall outside of this policy’s scope

What the policy asks of you, and the bug types it won't reward, quoted from Federal Retirement Thrift Investment Board's policy.

There is no harm and/or no apparent attempt to exploit the discovered vulnerability, beyond what is necessary to prove that a vulnerability exists
No FRTIB information may be exfiltrated, under any conditions.
Any testing activities conducted will not compromise the privacy and/or safety of FRTIB personnel (i.e., contractors and federal employees) as well as the Thrift Saving Plan’s participants and beneficiaries.
security researchers must comply with all applicable Federal, State, and local laws in connection with any security research activities
The Researcher must share the information with FRTIB first
If, during research, data and information is accessed, the research must cease, and the researcher must report to FRTIB immediately

Network denial of service (DoS) or distributed denial of service (DDoS)
Penetration Testing of physical security controls
Social engineering (e.g., phishing, vishing, etc.), or any other non-technical vulnerability testing

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake