Vanguard

Vanguard Vulnerability Disclosure Program Guidelines

Introduction

Vanguard’s Global Enterprise Security team works diligently to protect Vanguard’s assets, services, products, customer information, contractor information, and employee information. Additionally, we recognize the valuable role the research community plays in submitting responsible disclosures that may improve our security posture, and we welcome the opportunity to partner with you.

Through the HackerOne platform, Vanguard accepts certain reports of potential security vulnerabilities that may provide an attacker with the ability to compromise the integrity, availability, or confidentiality of Vanguard’s products, services, or information technology infrastructure (the "Vanguard Program"). By participating in the Vanguard Program, you agree to abide by these Vanguard Vulnerability Disclosure Program Guidelines (“Guidelines”). If you do not agree to the Guidelines, do not participate in the Vanguard Program.

Relationship to HackerOne Terms

These Guidelines supplement, and do not replace, the HackerOne policies governing your use of the HackerOne platform, including but not limited to the HackerOne Terms of Service and the HackerOne Code of Conduct (collectively, the “HackerOne Terms”), which are incorporated by reference. In the event of any conflict between these Guidelines and the HackerOne Terms, the Guidelines will govern unless Vanguard expressly states otherwise in writing.

Authorization

Vanguard authorizes you to perform good-faith security research solely within the scope of the Vanguard Program and in accordance with these Guidelines and the HackerOne Terms. Any activity outside this authorization is prohibited.

Program Rules

By participating in the Vanguard Program, you agree:

• to act in good faith and avoid causing harm to Vanguard, Vanguard contractors, Vanguard crew, or Vanguard customers;
• to report confirmed vulnerabilities promptly and with sufficient detail for us to determine validity;
• not to exploit the vulnerability beyond what is necessary to demonstrate impact;
• to avoid compromising the privacy of our customers or employees, or disrupting the operation of our products, services, or information technology infrastructure;
• to comply with all applicable local, state, federal, and international laws and regulations, including but not limited to laws governing unauthorized access to computer systems, data protection, and privacy;
• not to store, use, disclose, share, compromise, or destroy Vanguard or customer data;
• if you encounter Personally Identifiable Information (PII), confidential information, or other non-public data, to immediately cease testing, permanently delete any such data in your possession, and promptly notify Vanguard;
• not to publicly disclose or share vulnerability details;
• not to retain any copies of non-public Vanguard information or share such information with any third party;
• not to create or login to Vanguard investor accounts to test and/or perform transactions;

Use of automated tools is prohibited unless expressly permitted by Vanguard or the HackerOne platform for the Vanguard Program. Excessive, indiscriminate, or disruptive automated scanning is strictly prohibited.

Violation of these Guidelines may result in ineligibility for the Vanguard Program and removal from HackerOne, and may also result in Vanguard taking further action, including bringing legal claims.

Acknowledgement; Expenses; Limited Non-Assertion

The Vanguard Program is a vulnerability disclosure program and does not offer monetary rewards or bug bounties for submissions. Vanguard is under no obligation to provide compensation for any vulnerability report. Vanguard may, in its discretion, choose to provide recognition or other non-monetary acknowledgment for eligible submissions. Any such acknowledgment does not create an entitlement or expectation of compensation for this or any future submission.

Subject to your full compliance with these Guidelines, the HackerOne Terms, all Vanguard policies, and all applicable laws, Vanguard will not initiate legal action against you solely for good-faith security research activities conducted within the scope of the Vanguard Program. This assurance does not apply to any activity that violates law, exceeds authorized scope, causes harm, or involves fraud, extortion, or other misconduct.

Vanguard Program Scope

The scope of the Vanguard Program may evolve. Assets currently identified as in-scope or out-of-scope may change. Currently, any vulnerability of a Vanguard product, system or asset falls within the Vanguard Program’s scope, while the systems or assets of third parties such as software-as-a-service (SaaS) solutions not operated by Vanguard are outside the scope of the Vanguard Program. If you have any questions about what is in scope, please contact Vanguard through the HackerOne platform.

Unacceptable Submissions

The following submissions are not accepted by Vanguard:

• Submissions that result in alteration, destruction, or theft of Vanguard data, or the interruption or degradation of Vanguard systems.
• Attacks which require internal network access, or are performed by Vanguard employees or contractors.
• Social engineering attempts.
• Any activity involving Vanguard physical locations, including physical attacks against assets (e.g., equipment within Vanguard facilities).
• Attacks requiring man-in-the-middle (MITM) or physical access to a user’s device.
• Testing that requires mass creation of accounts, rate limit testing intended to disrupt service, credential stuffing, or similar high-volume activity.
• User enumeration reports without material security impact.
• Activity that could lead to disruption of service (DoS), including cache poisoning.
• Previously known vulnerable libraries without a working proof of concept demonstrating impact.
• Missing best practices in SSL/TLS configuration, Content Security Policy, or email authentication (SPF/DKIM/DMARC), unless a concrete security impact is demonstrated.
• Cross-Site Request Forgery (CSRF) with no security impact (e.g., unauthenticated/logout/login CSRF).
• CSV injection, content spoofing/text injection issues, or missing cookie flags (HTTPOnly/Secure/SameSite) unless a concrete security impact is demonstrated.
• Clickjacking/Tabnabbing attacks without demonstrated impact.
• Banner exposure/version disclosure without demonstrated impact.
• Open redirects that are not chained into a more impactful vulnerability.
• Broken links in documentation.
• Additional missing security controls often considered best practice (e.g., certificate pinning) without demonstrated security impact.

Vanguard reserves the right to reject any submission in its discretion.

Vanguard employs third-party vendors, and some subdomains may be managed by third parties. Where a reported issue relates to systems operated by a third-party vendor, Vanguard may share relevant details with that vendor for purposes of investigation and remediation.

Crafting a Report; Vanguard Disclosure

To help streamline our intake process, please submit one vulnerability per report (unless chaining is necessary to demonstrate impact), and include the following information:

• Your IP address.
• A detailed description of the vulnerability.
• Detailed steps to reproduce.
• Proof of exploitability (e.g., screenshots or video).
• Perceived impact to another user or to Vanguard.
• Tools used or required.
• Proposed CVSS v3 vector and base score (without environmental or temporal modifiers).
• List of URLs and affected parameters.
• Other vulnerable URLs, additional payloads, and proof-of-concept code (if applicable).
• Browser, OS, or app version used during testing.
• Do not use URL shorteners in reports.
• Report findings in English.
• Store supporting evidence and attachments only within the report you submit; do not host files on external services.

Failure to adhere to these minimum requirements may delay processing.

Vanguard may consider whether a disclosure of the vulnerability provides a positive contribution to the security community when evaluating submissions.

Legal Notice

By submitting information through this Program, you grant Vanguard a worldwide, perpetual, irrevocable, non-exclusive, transferable, sublicensable, fully-paid and royalty-free license under any intellectual property rights you own or control to use, reproduce, modify, create derivative works from, and otherwise exploit the submitted information for security, remediation, and related purposes.

Vanguard may contact you regarding your participation in this Program or reports you submit through the Program. Any information you receive or generate relating to Vanguard or its service providers or agents in connection with this Program (collectively, “Vanguard Confidential Information”) must be kept strictly confidential, and Vanguard Confidential Information must not be disclosed to any third party without the express written permission of Vanguard.

Any activity that intentionally compromises the privacy of customers or employees, intentionally disrupts the operation of our products, services, or information technology infrastructure, or otherwise causes harm is prohibited, will result in permanent disqualification from the Vanguard Program, and may result in Vanguard taking action, including bringing legal claims. Vanguard further reserves all rights and remedies if you do not comply with these Guidelines or applicable laws.

Nothing in these Guidelines creates an obligation for Vanguard to remediate or respond to any reported vulnerability. Vanguard reserves the right to modify or terminate the Vanguard Program at any time, in its discretion, and without prior notice. By participating in the Vanguard Program, you agree to accept any modifications to these Guidelines or the Vanguard Program.

Sanctions and Export Controls

You represent that you are not subject to economic sanctions or export control restrictions that would prohibit participation in this Program, and that your participation complies with applicable sanctions and export control laws.

Governing Law

These Guidelines are governed by the laws of the Commonwealth of Pennsylvania, without regard to conflict-of-laws principles.