Northwestern Mutual - Public Bug Bounty
By Northwestern Mutual Life Insurance Company Bug bounty on Bugcrowd northwesternmutual.com
- Top reward
- $6,000
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $6,000
- for critical bugs, from $200.
- Report on Bugcrowd
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,000 from $4,000 |
| High |
|
$3,000 from $1,000 |
| Medium |
|
$1,000 from $500 |
| Low |
|
$300 from $200 |
- Safe harbor
-
Partial
We do not condone or grant permission to test third party assets without their permission.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $6,000
Scope
8 assets you may test, 25 excluded.
Web 6
- 216.20.176.0/20
- Anything Owned by Northwestern Mutual on the Public Internet Not Listed as Out of Scope
- Anything that Clearly Affects Northwestern Mutual But is Not Own by Northwestern Mutual
- https://*.nmfn.com
- https://*.nml.com
- https://northwesternmutual.com
Android apps 1
- https://play.google.com/store/apps/details?id=com.nm.nm&hl=en_US&gl=US
iOS apps 1
- https://apps.apple.com/us/app/northwestern-mutual/id1132579006
Out of scope (25)
- Emerald Publications
- 21fiveca.com
- Any Domain that Follows the Pattern */webforms/nmfnForms/*
- calculator.northwesternmutual.com
- gbpwealth.com
- mymhs.nmfn.com
- nmresearchlibrary.nml.com
- northwesternmutual.com/careers-apply
- northwesternmutual.com/financial/advisor/*
- northwesternmutual.com/financial-professionals/?name=*
- northwesternmutual.com/find-a-financial-advisor
- northwesternmutual.com/notice-of-disability-form
- northwesternmutual.com/notice-of-group-disability-form
- northwesternmutual.com/notice-of-long-term-care-form
- northwesternmutual.com/report-a-death
- nwm.com
- servicenmfn.awms.apps.northwesternmutual.com/webforms/nmfnForms/*
- service.nmfn.com/webforms/nmfnForms/*
- servicenmfnstage.awms.apps.northwesternmutual.com/webforms/nmfnForms/*
- servicenmfntest.awms.apps.northwesternmutual.com/webforms/nmfnForms/*
- servicestage.nmfn.com/webforms/nmfnForms/*
- servicetest.nmfn.com/webforms/nmfnForms/*
- sparks-financial.com
- theandersonfinancialgroupnm.com
- themint.org
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Northwestern Mutual - Public Bug Bounty (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
you must use your @bugcrowdninja email for any form field asking for an email
-
You must not be the author of the code identified as a vulnerability.
-
Your research activities must not negatively impact the Northwestern Mutual Life Insurance Company’s or LearnVest’s product or services in any way
-
If you inadvertently access proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, recorded or processed any further in any way.
-
Inadvertent access to this type of data must be disclosed within your submission with identifying information of the data source and remediation you have taken to secure the data.
-
We do not condone or grant permission to test third party assets without their permission.
Not accepted
-
Exploitation past proof of vulnerability
-
Volumetric Denial of Service attacks (DoS)/distributed denial of service (DDoS)
-
Vulnerabilities identified with automated tools (including web scanners) that do not include PoC code or a demonstrated exploit
-
Discovery of any in-use service whose running version includes known vulnerabilities without demonstrable security impact
-
Physical Testing
-
Social engineering of any kind
-
Leaked passwords or breached credentials (i.e. credential breach dumps)
-
References to Google Maps API Key
-
Discovery of @nm.com or @nmfn.com email addresses or phone numbers/contact information for these users
-
DNS Zone Domain Takeover of Non-Live Domains
-
Broken link type issues on pages older than 1 year on news.northwesternmutual.com
-
Rate limiting issues on news.northwesternmutual.com
-
Cache Poisoned Denial of Service (CPDoS) style attacks
-
Broken social media link type issues on northwesternmutual.com/office/*
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
events.nmfn.com (out of scope)
-
Scope removed
ftph1.northwesternmutual.com (out of scope)
-
Scope removed
u.nm.com (out of scope)
-
Scope removed
opportunities.northwesternmutual.com (out of scope)
-
Scope removed
northwesternmutual.starssmp.com (out of scope)
-
Scope removed
mynmcu.com (out of scope)
-
Scope removed
nwm.benselect.com (out of scope)
-
Scope removed
pugetsound.nmfn.com (out of scope)
-
Scope removed
eventscloud.com (out of scope)
-
Scope removed
wholelifeconversion.com (out of scope)
-
Scope removed
nwm.zenarate.com (out of scope)
-
Scope removed
cloud.em.northwesternmutual.com (out of scope)
-
Scope removed
northwesternmutualdigitalexplab.com (out of scope)
-
Scope removed
icapitalnetwork.com (out of scope)
-
Scope removed
metricssecure.northwesternmutual.com (out of scope)
-
Scope removed
ideas.northwesternmutual.com (out of scope)
-
Scope removed
nmis-stage.netxinvestor.com (out of scope)
-
Scope removed
nmcreative.space (out of scope)
-
Scope removed
metrics.northwesternmutual.com (out of scope)
-
Scope removed
northwesternmutual.aramarkcafe.com (out of scope)
-
Scope removed
opportunities.northwesternmutual.com.career.page (out of scope)
-
Scope removed
disabilityinsurancecoveragenow.com (out of scope)
-
Scope removed
clientwise.com (out of scope)
-
Scope removed
northwesternmutual.jobinfo.com (out of scope)
-
Scope removed
icims.com (out of scope)
-
Scope removed
m3.nml.com (out of scope)
-
Scope removed
iggateway.com (out of scope)
-
Scope removed
northwesternmutualinnercircle.com (out of scope)
-
Scope added
Any Domain that Follows the Pattern */webforms/nmfnForms/* (out of scope)
-
Scope added
servicestage.nmfn.com/webforms/nmfnForms/* (out of scope)
-
Scope added
service.nmfn.com/webforms/nmfnForms/* (out of scope)
-
Scope added
servicenmfntest.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (out of scope)
-
Scope added
servicenmfnstage.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (out of scope)
-
Scope added
servicenmfn.awms.apps.northwesternmutual.com/webforms/nmfnForms/* (out of scope)
-
Scope added
northwesternmutual.com/notice-of-group-disability-form/ (out of scope)
-
Scope added
Anything that Clearly Affects Northwestern Mutual But is Not Own by Northwestern Mutual
-
Scope added
216.20.176.0/20
-
Scope added
Anything Owned by Northwestern Mutual on the Public Internet Not Listed as Out of Scope
-
Scope added
servicetest.nmfn.com/webforms/nmfnForms/* (out of scope)
-
Scope added
nwm.com (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Welcome! Northwestern Mutual has been helping families and businesses achieve financial security for 160 years. Through a distinctive, whole-picture planning approach including both insurance and investments, we empower people to be financially confident. We combine the expertise of our financial professionals with a personalized digital experience and leading-edge technology to best serve our clients. Help us keep our digital experience secure. Rewards/Ratings: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Eligibility for Participation To be eligible for the Northwestern Mutual Bug Bounty Program, you must: Not be in violation of any national, state, or local laws or regulation. Not be an employee or spouse of an employee of the Northwestern Mutual Life Insurance Company or any of its affiliates or subsidiaries. Agree to the more detailed legal information under "Important Legal Terms".
Additional information
Important Legal Terms The parties to this Agreement are you and the Northwestern Mutual Life Insurance Company. By participating in the Program, investigating a potential vulnerability, or submitting a vulnerability, you acknowledge that you have not disclosed and agree that you will not disclose the vulnerability to anyone other than the Northwestern Mutual Life Insurance Company. Any disclosure would violate this Agreement unless approved in writing by an authorized employee of the Northwestern Mutual Life Insurance Company responsible for cybersecurity threat detection and mitigation. You agree that money damages may not be a sufficient remedy for a breach of this paragraph by you and that the Northwestern Mutual Life Insurance Company will be entitled to specific performance as a remedy to this breach and an injunction without the posting of a bond. Such remedy will not be deemed to be the exclusive remedy for any such breach but will be in addition to all other remedies available at law or equity to the Northwestern Mutual Life Insurance Company. By submitting information about a potential vulnerability, you are granting the Northwestern Mutual Life Insurance Company a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing vulnerabilities in products and services offered by the Northwestern Mutual Life Insurance Company. In the event of substantial duplicate submissions, the Northwestern Mutual Life Insurance Company may at its discretion provide a reward only for the earliest received submission. Eligibility for rewards, determination of the recipients for the rewards and the amount of rewards is at the discretion of the Northwestern Mutual Life Insurance Company. If issues reported to our bug bounty program affect a third party or another vendor, the Northwestern Mutual Life Insurance Company reserves the right to forward details of the issue along to the party without further discussion with the researcher. You are responsible for all taxes associated with and imposed on any reward you may receive from the Northwestern Mutual Life Insurance Company. If you inadvertently access proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, recorded or processed any further in any way. Inadvertent access to this type of data must be disclosed within your submission with identifying information of the data source and remediation you have taken to secure the data. Your research activities must not negatively impact the Northwestern Mutual Life Insurance Company’s or LearnVest’s product or services in any way or the online environment availability or performance of such products or services. These terms and conditions along with the specifications, requirements and restrictions set forth in the bug bounty brief constitute the entire Agreement of the parties. This Agreement is covered by California law. This agreement can only be amended by the Northwestern Mutual Life Insurance Company. If any part of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such portion, but only to the extent that such art of the Agreement is illegal or unenforceable. You must not be the author of the code identified as a vulnerability. You must not be an employee or spouse of an employee of the Northwestern Mutual Life Insurance Company or any of its affiliates or subsidiaries, including the Northwestern Mutual Wealth Management Company, NMIS, or LearnVest. THE NORTHWESTERN MUTUAL LIFE INSURANCE COMPANY ON BEHALF OF ITSELF AND AFFILIATES AND SUBSIDIARIES RESERVES THE SOLE RIGHT TO MODIFY THIS AGREEMENT WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY AND BY PARITICPATING YOU ACKNOWLEDGE AND AGREE YOU WILL ABIDE BY ALL APPLICABLE FEDERAL, STATE AND LOCAL LAWS. YOU MUST ALSO NOT DISRUPT AND SERVICE OR COMPROMISE ANY PERSON’S DATA.
🎯 In Scope - Public Facing Targets Owned by Northwestern Mutual (in scope)
These rewards only apply to assets that are owned by Northwestern Mutual and are not listed as Out of Scope. If a submission is determined to be owned or run by a third party, it will be re-classified to the Other Public Targets section of targets. As these contain production systems that may send information to real individuals, you must use your @bugcrowdninja email for any form field asking for an email, as well as to always adhere to the Out-of-Scope information below.
🐞 In Scope - Other Public Targets (Vulnerability Disclosure) (in scope)
If you find a public facing issue that clearly affects Northwestern Mutual, but is not in scope for the Public Bug Bounty (i.e. not owned by Northwestern Mutual), you may responsibly disclose the vulnerability under this group. Issues submitted to the main Public Bug Bounty group that are determined to not be owned by Northwestern Mutual will also be moved into this scoping group. We may consider giving a consolation bounty at these lower amounts for these bugs. The severity for these submissions will be based on the impact to Northwestern Mutual directly, which may differ from the normal VRT. There is a higher threshold for duplicate issues in this scope. Similar or variants of the same bugs will be considered duplicates. We may cap the quantity of these consolation rewards to one per new target. We do not condone or grant permission to test third party assets without their permission.
❌ Out of Scope - General (out of scope)
Out-of-Scope Activities Exploitation past proof of vulnerability Volumetric Denial of Service attacks (DoS)/distributed denial of service (DDoS) Vulnerabilities identified with automated tools (including web scanners) that do not include PoC code or a demonstrated exploit Discovery of any in-use service whose running version includes known vulnerabilities without demonstrable security impact Physical Testing Social engineering of any kind Any attack against Northwestern Mutual Life Insurance Company and its subsidiaries including Northwestern Mutual Wealth Management Company, Northwestern Mutual Investment Services (NMIS) and LearnVest that are not explicitly in scope Leaked passwords or breached credentials (i.e. credential breach dumps) Any financial data linked from https://vlunttrn.nmfn.com/data.html - This is publicly disclosed financial data for regulatory purposes. References to Google Maps API Key Discovery of @nm.com or @nmfn.com email addresses or phone numbers/contact information for these users - These are a sales force that are intended to be discoverable and contactable by the public Production Systems The following pages have forms that submit data to real systems and are out of scope for any Bugcrowd program. This includes the API calls they make as well. We are working on a way to include them in the program in the future.
❌ Temporary Rules (out of scope)
Temporary Out-of-Scope Submission Types The following types of submissions are not being accepted at this time. They may be accepted again in the future: DNS Zone Domain Takeover of Non-Live Domains Broken link type issues on pages older than 1 year on news.northwesternmutual.com Rate limiting issues on news.northwesternmutual.com Cache Poisoned Denial of Service (CPDoS) style attacks Broken social media link type issues on northwesternmutual.com/office/* Temporary Bounty Cap Broken social media link type issues are capped at $50 across the program Temporary Out-of-Scope Domains Submissions from the following domains are not being accepted at this time. They may be accepted again in the future:
❌ Out of Scope - Known Third Party (out of scope)
The following pages have been determined as third party and not owned by Northwestern Mutual. We will not be paying any type of bounties for these domains