University of Mississippi Medical Center
Vulnerability disclosure program on security.txt umc.edu
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Full
UMMC will not pursue legal action against individuals who: identify vulnerabilities without malicious intent, and follow this policy's guidelines and act in good faith.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 3 excluded.
Domains 1
- umc.edu
Products and areas 4
- mobile applications
- other publicly-accessible digital services that are owned or operated by UMMC
- UMMC's network
- web applications
Out of scope (3)
- applications outside UMMC's direct control
- services managed by external entities
- third-party systems
Rules
What the policy asks of you, and the bug types it won't reward, quoted from University of Mississippi Medical Center's policy.
While testing
-
Exploit or delete data, disrupt operations, or access systems you are not authorized to test.
-
Share or publish the vulnerability before UMMC has had a reasonable opportunity to address it.
Not accepted
-
Known issues already published or previously reported and remediated.
-
Issues requiring no privileged access, or trivial in nature (for example, expired certificates with no exploit path).
-
Social engineering, phishing, physical security bypasses, or issues related to non-UMMC operations without UMMC involvement.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.