Our Vulnerability Disclosure Program aims to encompass all the technologies, products, and services that Comcast Xfinity and Comcast Business provides.
All endpoints called by these services and applications are in-scope. If you are unsure if something is owned or maintained by us, please let us know and we will make a best effort to determine if we can assist.
For submissions with demonstrated impact and POC, the Comcast VDP will reward up to $1,250 for all valid P1 submissions. All other severities are not eligible for rewards at this time.
- 3rd party endpoints
- Marketing/Analytics endpoints
- Server security misconfigurations with little impact (ex. Exposed instances with no sensitive data present)
- Reports involving test data and/or development environments will be reviewed on a case by case basis and assessed based on impact
The following submissions will not be accepted:
- Email spoofing issues (e.g., SPF, DKIM, DMARC)
- Automated scan reports or search engine results (ie, Shodan) without valid proof of concept
- Physical tampering of our hardware devices
- Load Testing (DoS, DDoS, wireless jamming, etc.)
Comcast provides Xfinity Internet, TV, wireless, home automation, and more to tens of millions of residential customers, in addition to Comcast Business services to enterprise and small business customers. With so many devices and services in homes and businesses, it has never been more important to ensure the security of those products while striving to deliver an experience that is simple, elegant and powerful. With this in mind, we remain committed to working with security researchers and alongside the security community, and will maintain trust, respect, and transparency that aligns with our commitment to security and privacy.
For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Scope and rewards
This program follows Bugcrowd’s standard disclosure terms.
For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email firstname.lastname@example.org. We will address your issue as soon as possible.
This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.