US Department of Energy VDP
By Department of Energy Vulnerability disclosure program on Self-hosted energy.gov
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- doe.responsibledisclosure.com
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Request monetary compensation for time, materials, expenses, and effort (e.g., a bounty) or a property interest of any type or kind for any security vulnerabilities that they may discover.
- Response
-
Within 3 days
The Department will acknowledge Reporter receipt of each vulnerability within three business days of submission.
- Safe harbor
-
Full
The Department will not recommend or pursue legal action against anyone for a security-reporting activity that the Department concludes represents a good-faith effort to follow the Attachment and will deem that activity authorized.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 3 excluded.
Domains 1
- doe.gov
Out of scope (3)
- National Security Systems (NSS)
- Non-Public Facing or non-Internet-accessible websites, systems, and digital services
- Websites, systems, and digital services owned by Third Party Service Providers
Rules
What the policy asks of you, and the bug types it won't reward, quoted from US Department of Energy VDP's policy.
While testing
-
No security testing is authorized on industrial control systems (ICS) managed by DOE, but reports of information security concerns on ICS are accepted and will be elevated for remediation as required.
-
Denial of Service testing.
-
Physical or social engineering (e.g., phishing).
-
Methods that disrupt system operation or result in the modification or destruction of data.
-
Exploitation of a vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
-
Any other activity that would not reasonably be considered prudent given the terms, conditions, and intent of this Attachment.
-
Conduct data exfiltration.
-
Intentionally compromise the privacy, safety, intellectual property (IP), or other commercial or financial interests of any DOE employee, contractor, or DOE-associated entity.
-
Intentionally compromise any Controlled Unclassified Information (CUI), including PII and IP, or Official Use Only (OUO) information.
-
Retain or transmit any information, including PII or IP, belonging to the Department.
Not accepted
-
Denial of Service testing.
-
Physical or social engineering (e.g., phishing).
-
Methods that disrupt system operation or result in the modification or destruction of data.
-
Any other activity that would not reasonably be considered prudent given the terms, conditions, and intent of this Attachment.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.