TD Bank Group
By The Toronto-Dominion Bank Vulnerability disclosure program on HackerOne td.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 19
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
TD does not currently operate a paid bug bounty program and makes no offer of reward or compensation in exchange for submitting a report.
- Safe harbor
-
Full
If you follow the requirements of this Policy (as defined below), we will consider your research activities to be authorized conduct.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
19 assets you may test.
Wildcard domains 19
- *.mbna.ca Critical No bounty
- *.mytdfinancing.com Critical No bounty
- *.tdadvisor.com Critical No bounty
- *.tdafdealer.com Critical No bounty
- *.tdassurance.com Critical No bounty
- *.tdautofinance.com Critical No bounty
- *.tdbank.ca Critical No bounty
- *.tdbank.com Critical No bounty
- *.tdbfg.com Critical No bounty
- *.tdcanadatrust.com Critical No bounty
- *.td.com Critical No bounty
- *.tdcommercialbanking.com Critical No bounty
- *.tdinsurance.com Critical No bounty
- *.tdpartnershipprograms.com Critical No bounty
- *.tdprimeservices.com Critical No bounty
- *.tdrcsmerchant.com Critical No bounty
- *.tdrewards.com Critical No bounty
- *.tdsprimebrokerage.com Critical No bounty
- *.tdwaterhouse.ca Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from TD Bank Group (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Be at least 18 years of age or the age of majority in your jurisdiction (age at which a person is consider an adult) or have your parent or guardian’s permission to participate in the Program.
-
Conduct research using only accounts that you own or with the express consent of the account holder.
-
Comply with all applicable laws and regulations in connection with your research and participation in this Program.
-
Do not engage in any activity that can harm TD, our customers, or our employees.
-
Do not initiate or facilitate any fraudulent transactions.
-
Do not disclose any information related to your findings to any third parties or to the public without the prior written permission of TD.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 31 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
*.tdfitloan.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
#Careers at TD
We're often looking for experienced security professionals to join our team, including Penetration Testers. To review our current opportunities, please visit our career site.
#Report a Vulnerability At TD, we are committed to maintaining the security of our systems and information. We appreciate the contribution that experts, researchers, and our customers make towards that goal. If you follow the requirements of this Policy (as defined below), we will consider your research activities to be authorized conduct.
If you believe you have identified a potential security vulnerability in a TD application, please submit a report to us in accordance with this Policy. If you have any questions or concerns about this Policy, please contact us at [email protected].
While we appreciate your assistance with reporting potential security vulnerabilities, please note that TD does not currently operate a paid bug bounty program and makes no offer of reward or compensation in exchange for submitting a report.
Thank you in advance for your participation. We appreciate your assistance.
#Guidelines This policy ("Policy") sets out terms and conditions of TD's Responsible Disclosure Program (the "Program"). In order to protect you and us, we have established the following requirements to participate in the Program:
- Be at least 18 years of age or the age of majority in your jurisdiction (age at which a person is consider an adult) or have your parent or guardian’s permission to participate in the Program.
- Conduct research using only accounts that you own or with the express consent of the account holder.
- Comply with all applicable laws and regulations in connection with your research and participation in this Program.
- Do not engage in any activity that can harm TD, our customers, or our employees.
- Do not initiate or facilitate any fraudulent transactions.
- If you acquire or access TD information or customer data, including personal identifiable information (name, address, email, etc.), as part of conducting research for the Program, immediately stop the activity, delete all copies of the data and report to us at [email protected].
- Do not disclose any information related to your findings to any third parties or to the public without the prior written permission of TD.
- Do not engage in out-of-scope testing, including of: the physical security of TD property; social engineering attacks on TD customers or employees (e.g., phishing emails or sites); denial of service or resource exhaustion attacks; or mass scanning tools that rely on high traffic volumes, which may result in your IP(s) being blocked.
#Submitting a Report TD welcomes reports relating to any publicly accessible systems such as web applications, mobile applications, or services owned, operated, and/or controlled by The Toronto-Dominion Bank (including TD Bank Group and TD Bank, America's Most Convenient Bank). Please note that this does not include systems owned, operated, and/or controlled by TD Ameritrade.
If you have questions about a specific domain or application that you would like to research, please contact [email protected]. TD is particularly interested in findings relating to the OWASP Top 10 and/or potential vulnerabilities that may have a demonstrable security impact. When reporting a potential vulnerability, please include a detailed description of your finding(s), including:
- The full URL.
- Clear and concise steps taken.
- Any tools used during discovery.
- Objects possibly involved (e.g. filters or entry fields).
- Evidence (e.g. screen captures welcome).
- Your assessment of risk (CVSS 3.1 preferred).
- The attack scenario, exploitability, and security impact of the vulnerability.
- Any proposed solution (not required). Please note that we do not request nor require executable copies of code.
#Legal Requirements By submitting a report, you confirm that you have read, understand, agree to, and complied with the Policy. In addition, you agree that: • TD may take all steps needed to validate and mitigate potential vulnerabilities; • TD may share or disclose the findings; • TD may collect, use, share or disclose any personal information you provide to TD as part of your report, in accordance with our Privacy Policy; and • You grant TD any rights to your report needed to do any of the above.
TD will make reasonable efforts to timely investigate and close potential issues that have a demonstrated security impact, but for the protection of our customers, we may choose to not disclose, discuss, or confirm security issues.
Thank you again for your participation.