Library of Congress
Vulnerability disclosure program on security.txt loc.gov
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 44
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
The Library does not offer any reward or bounty for reporting vulnerabilities.
- Response
-
Within 1 days
The Library IT security team will provide researchers an initial confirmation of receipt of reports within one business day.
- Safe harbor
-
Full
If researchers are in compliance with this policy, the Library will not recommend or pursue legal action related to the vulnerability research.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
44 assets you may test, 1 excluded.
Domains 22
- americaslibrary.gov
- asianpacificheritage.gov
- bibframe.org
- blackhistorymonth.gov
- ccb.gov
- classweb.org
- congress.gov
- copyright.gov
- crb.gov
- currencyreader.gov
- digitalpreservation.gov
- digitizationguidelines.gov
- hispanicheritagemonth.gov
- jewishheritagemonth.gov
- lcconline.info
- lctl.gov
- loc.gov
- nativeamericanheritagemonth.gov
- nlstalkingbooks.org
- read.gov
- section108.gov
- womenshistorymonth.gov
Wildcard domains 22
- *.americaslibrary.gov
- *.asianpacificheritage.gov
- *.bibframe.org
- *.blackhistorymonth.gov
- *.ccb.gov
- *.classweb.org
- *.congress.gov
- *.copyright.gov
- *.crb.gov
- *.currencyreader.gov
- *.digitalpreservation.gov
- *.digitizationguidelines.gov
- *.hispanicheritagemonth.gov
- *.jewishheritagemonth.gov
- *.lcconline.info
- *.lctl.gov
- *.loc.gov
- *.nativeamericanheritagemonth.gov
- *.nlstalkingbooks.org
- *.read.gov
- *.section108.gov
- *.womenshistorymonth.gov
Out of scope (1)
- bioguide.congress.gov
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Library of Congress's policy.
While testing
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
-
Researchers must not copy any data other than what is needed for inclusion in the report.
-
Researchers must not disclose any personally identifiable information to a non-Library source at any time.
-
Only use an exploit to confirm the existence of a vulnerability.
-
Researchers must not use an exploit to go beyond proving a vulnerability exists.
-
Researchers must not conduct any denial of service or other attack that degrades performance or user experience.
-
Coordinate with the Library of Congress for a period of at least 90 days before releasing details of the vulnerability to the general public.
Not accepted
-
User interface bugs or typos.
-
Network denial of service (DoS or DDoS) tests.
-
Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.