Prudential Financial

Cybersecurity is of the upmost importance to Prudential, and we value the contributions of the security community at large. The responsible disclosure of potential issues helps Prudential ensure the security and privacy of our customers and information.

This Vulnerability Disclosure Policy (“Policy”) outlines considerations and commitments for the disclosure of potential security vulnerabilities to Prudential in a responsible manner, clear guidelines for conducting vulnerability discovery activities for legitimate security researchers, and how to submit discovered vulnerabilities to Prudential. This Policy describes what systems and types of research are covered under this Policy and how to send us vulnerability reports. We encourage you to contact us to report potential vulnerabilities in our systems in accordance with the following protocols.

Please note that this Policy should not be construed as encouragement or permission to perform any of the following activities:

• Pivoting into the network by using a vulnerability;
• Exploiting the service providers we use;
• Hack, penetrate, or otherwise attempt to gain unauthorized access to Prudential’s applications, systems, or data in violation of applicable law;
• Download, copy, disclose, or use any proprietary or confidential Prudential information, including personally identifiable information (“PII”) (defined below); and
• Adversely impact Prudential or the operation of Prudential applications or systems.

If you encounter PII, submit a report to be triaged and reviewed. Do not proceed with access and immediately purge any local information, if applicable. You agree to provide Prudential a reasonable amount of time to resolve the vulnerability.

No payments under this Policy are permitted or will be considered by Prudential.

Prudential looks forward to working with the security community to find vulnerabilities to keep our business and customers safe.

TABLE OF CONTENTS I. Program Terms       1. Safe Harbor       2. Program Eligibility       3. Program Rules       4. Disclosure Policy       5. Legal       6. Indemnification

II. Submission Process       1. Response Times       2. Test Plan       3. Scope Exclusions

III. FAQ's

#I. Program Terms

1. Safe Harbor

Any activities conducted in a manner consistent with this Policy and within the Policy’s scope will be considered authorized conduct by Prudential, including under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c). If legal action is initiated by a third party against you in connection with activities conducted under this Policy, we will make it known that your actions were conducted in compliance with this Policy. Prudential expressly reserves all rights not otherwise granted herein, including all legal rights in the event of noncompliance with this Policy. You shall comply with all applicable federal, state, and local laws and regulations in connection with your security research activities or other participation in this program.

2. Program Eligibility

• You agree and adhere to the Program Rules and Legal terms as stated in this Policy.
• You are the first to submit a sufficiently reproducible report for a vulnerability to be eligible for the report to be accepted and Triaged.
• You are available to supply additional information, as needed by our team, to reproduce and triage the issue.
• Out-of-scope vulnerability reports or reports that are technically reproducible but pose a very low security impact are likely to be closed as Informative.
• Prudential employees and third-party assets employees are not eligible for participation in this program.
• Any domain not listed in the targets section is out of scope. This includes any/all subdomains not listed.
• Prudential abides by all local, state, and federal laws, including the Office of Foreign Assets Control (“OFAC”) sanctions lists. You must not be a resident of, or make your submission from, a country against which the United States has issued export sanctions or other trade restrictions. You must not be a sanctioned individual, affiliated with a sanctioned entity, country, or individual, nor on any watch lists.
• You hereby assign to Prudential all rights, title, and interest (including all intellectual property rights), in the contents of all vulnerability reports that you submit to Prudential. By participating in the vulnerability disclosure program, you represent that you have the right to assign all such right, title and interest to us and that your participation in the vulnerability and disclosure program, and assignment of such right, title and interest will not breach any agreement you may have with a third party (e.g., your employer).

3. Program Rules

Do:

• Read and abide by this Policy.
• Perform testing using only accounts that are your own personal/test accounts or an account that you have explicit permission from the account holder to utilize.
• Exercise caution when testing to avoid negative impact to customers and the services they depend on.
• STOP testing if you are unsure about the impact it may have on our systems. If you think you may cause, or have caused, damage with testing a vulnerability, report your initial finding(s) and request authorization to continue testing.

Do Not:

• Do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
• Do not brute force credentials or guess credentials to gain access to systems.
• Do not degrade our sites or services (e.g., denial-of-service attacks) while looking for vulnerabilities with large-scale vulnerability scanners, scrapers, or automated tools that produce excessive amounts of traffic.
• Do not participate in denial-of-service attacks.
• Do not install software or firmware of any kind on Prudential systems.
• Do not upload shells or create a backdoor of any kind.
• Do not engage in any form of social engineering of Prudential employees, customers, or vendors.
• Do not engage or target any Prudential employee, customer, or vendor during your testing.
• Do not change passwords of any account that is not yours or that you do not have explicit permission to change. If ever prompted to change a password of an account you did not register yourself or an account that was not provided to you, stop, and report the finding immediately.
• Do not do anything that would be considered a privacy violation, cause destruction of data, or interrupt or degrade our service.
• Do not access, use, or interact with accounts you do not own or without the explicit permission of the account holder.
• Do not attempt to access, extract, download, or otherwise exfiltrate data that you believe may have PII or other sensitive data other than your own. If sensitive information--such as PII, credentials, etc.--is encountered as part of a vulnerability, it must not be saved, stored, transferred, accessed, or otherwise processed after initial discovery. All copies of sensitive information must be returned to Prudential and may not be retained.
• Do not try to exploit the service providers we use or receive useful reports from. Prohibited actions include but are not limited to brute forcing login credentials of domain registrars, DNS hosting companies, email providers and/or others. Prudential does not authorize you to perform any actions to any non-Prudential owned property/systems/services/data.

Examples of PII include, but are not limited to, any of the following information associated with an individual, or Prudential employee or customer:

• Name.
• Home or other physical address.
• Email address.
• Telephone number.
• Medical or health information
• Social Security number.
• Passport number.
• Driver's license number.
• Bank account number.
• Credit or debit card number.
• Personal characteristics, including photographic image, fingerprints, handwriting or other unique biometric data.

Any of the above-listed data elements on its own would constitute PII for purposes of this Policy, and such list is not exhaustive.

4. Disclosure Policy

• You agree that you shall not, without the prior written consent of Prudential in each instance (i) use in advertising, publicity or otherwise the name of Prudential or its affiliates or any trade name, trademark, trade device, service mark, symbol or any abbreviation, contraction or simulation thereof owned by Prudential or its affiliates, or (ii) represent, directly or indirectly, any service or work provided by you as approved or endorsed by Prudential or its affiliates.
• You agree that any and all information acquired or accessed by you as part of this exercise is confidential to Prudential and you shall hold any such confidential information in strict confidence and shall not copy, reproduce, sell, assign, license, market, transfer, otherwise dispose of, give, disclose such information to third parties, or use such information for any purposes other than for the performance of your work.
• You acknowledge and agree that any and all information you encounter is owned by Prudential or its third-party providers, clients, or customers. You have no rights, title, or ownership to any information that you may encounter.
• Please review HackerOne's disclosure guidelines located here https://www.hackerone.com/disclosure-guidelines for general best practices. This Policy supersedes any conflicting HackerOne policies.
• If you encounter PII, submit a report to be triaged and reviewed. Do not proceed with access and immediately purge any local information, if applicable.
• Any unauthorized public disclosure will be grounds for a program ban. Actions that are not consistent with this Policy are not covered by our Safe Harbor provision and may make you legally liable.
• You agree to provide Prudential a reasonable amount of time to resolve the vulnerability.

5. Legal

Prudential reserves the right to modify the terms and conditions of this program, and your participation in the Program constitutes acceptance of all terms. Please check this site regularly as we routinely update our program terms and eligibility, which are effective upon posting. You can subscribe at https://docs.hackerone.com/hackers/manage-notifications.html#program-notifications to receive email notifications when this Policy is updated.

6. Indemnification

You agree to defend, indemnify, and hold Prudential, its subsidiaries, affiliates and the officers, directors, agents, joint ventures, employees and suppliers of Prudential, its subsidiaries, or our affiliates, harmless from any claim or demand (including attorneys’ fees) made or incurred by any third party due to or arising out of your Submissions, your breach of these Program Terms and/or your improper use of this Policy.

#II. Submission Process

1. Response Times

2. Test Plan

If possible, please perform the following to make the triage experience smoother and quicker:

No credentials are required or provided for this program. If you self-register for any accounts, please register using your HackerOne email alias [email protected]; (If this is not possible, you may create a second account using the + alias method (e.g., [email protected]). In such cases, please report the registered email address in your submission.

In the case you are creating an account that is not tied to an email, you should create the username with the prefix hackerone and the suffix of your HackerOne username. For example, the following would be a valid test account hackerone-<your_hackerone_username>.

Where applicable, please add the header X-HackerOne-Research: [H1 username] to requests.

While submitting a report, please share the time frame of the testing and all IP addresses used during testing along with all Prudential endpoint hostnames/IPs that were tested.

3. Scope Exclusions

• Prudential reserves the right to add to and subtract from the Exclusions list depending on the evaluated severity of reported vulnerabilities and risk acceptance.
• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (“CSRF”) on unauthenticated forms or forms with no sensitive actions.
• POST Based Open Redirects.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (“CSV”) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (“DoS”).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Any activity that could lead to DoS, including but not limited to, inundating support services with invalid requests.
• Brute force attacks against unauthenticated endpoints.
• Social engineering attacks, including phishing.
• Missing HttpOnly or Secure flags on cookies.
• Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.).
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g., stack traces, application, or server errors).
• Tab nabbing.
• Issues that require unlikely user interaction by the victim.

#III. FAQ's

1. Can I get Prudential swag? Prudential does not currently offer swag.

2. Can Prudential provide me with a pre-configured test account? This program does not provide credentials or any special access.

3. What is required when submitting a report? Please see the link here and follow the provided instructions: https://docs.hackerone.com/hackers/submitting-reports.html.

4. How do I make my report great? Please see the link here and follow the provided guidance: https://docs.hackerone.com/hackers/quality-reports.html.

5. What causes a report to be closed as Informative, Duplicate, N/A, or Spam? Please see the link here for more information: https://docs.hackerone.com/hackers/report-states.html.

6. What is an example of an accepted vulnerability? Valid and accepted vulnerabilities would be the type of report that identifies a unique security impact on this program’s specific scope. The report must also meet any submission criteria outlined in the Policy, such as test plan instructions and a working proof of concept.

Thank you for helping keep Prudential and our users safe!