Novo Nordisk
Vulnerability disclosure program on security.txt novonordisk.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 5 days
we will acknowledge receiving your report within five business days and keep you informed on the status of your report.
- Safe harbor
-
Full
Novo Nordisk will not engage in legal action against individuals who in good faith submit vulnerability reports in accordance with our Coordinated Vulnerability Disclosure (CVD) Policy.
- Hall of fame
-
Yes
if a vulnerability is verified by our global security response team, we will attribute recognition to the researcher reporting it, if requested.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 3 excluded.
Domains 1
- novonordisk.com
Products and areas 1
- all products, software, and hardware, available under the Novo Nordisk brand names made available to the general public
Out of scope (3)
- Acquisitions as integration efforts may not be complete.
- products and/or services in active use for medical treatment, patient care, diagnostics, or monitoring purposes
- Vulnerabilities affecting End of Life products or services that are no longer supported.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Novo Nordisk's policy. "We" in these lines means the program, not this site.
While testing
-
Engage in testing our products and/or research without harming Novo Nordisk or our customers.
-
avoid testing against products and/or services in active use for medical treatment, patient care, diagnostics, or monitoring purposes.
-
testing should not be conducted on active products used for medical treatment, and products subjected to security testing should not subsequently be used for medical treatment or in a clinical setting.
-
Do not include sensitive information (for example sample information, Personal Health Information (PHI), PII, etc.) in any documents submitted to Novo Nordisk.
-
Comply with all laws and regulations in the course of your testing activities.
-
Please inform us of your disclosure plans, if any, prior to public disclosure.
Not accepted
-
Vulnerabilities affecting End of Life products or services that are no longer supported.
-
Attacks that require the use of phishing or other types of social engineering.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.