Vulnerability Disclosure Policy

The Federal Deposit Insurance Corporation (“FDIC”) is committed to maintaining the security of our systems and protecting sensitive information from unauthorized disclosure.

We encourage security researchers to report potential vulnerabilities identified in FDIC systems. For reports submitted in compliance with this policy, the FDIC will endeavor to acknowledge receipt within three business days, to promptly validate submissions, implement corrective actions if appropriate, and inform researchers of the disposition of reported vulnerabilities.

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action related to your research.