Americorps Vulnerability Disclosure

generated: '2026-09-02'
method: searched
probe: true
source: https://www.americorps.gov/about/agency-overview/vulnerability-disclosure-policy
note: >-
  Found by search, not by the standard probe. probe-security-programs.py reported vdp=none on
  this repo because AmeriCorps serves no /.well-known/security.txt and does not use any of
  the conventional /security, /responsible-disclosure or /vulnerability-disclosure paths —
  its policy lives four segments deep at /about/agency-overview/vulnerability-disclosure-policy.
  The page was fetched with a browser User-Agent and returned HTTP 200 with the full policy
  text. (WebFetch received 403 from the same URL; the agency edge turns away non-browser
  agents, which is an edge policy, not an absent page.)
program:
  type: coordinated-disclosure
  bug_bounty: false
  framework: CISA Binding Operational Directive 20-01
  safe_harbor: true
policy:
  - https://www.americorps.gov/about/agency-overview/vulnerability-disclosure-policy
contact:
  - channel: email
    value: oithd@cns.gov
    detail: AmeriCorps OIT Help Desk — the address the policy names for vulnerability reports.
  - channel: phone
    value: '+1-202-606-6600'
    detail: AmeriCorps OIT Help Desk.
  - channel: web form
    value: Privacy and Security Incident Report
    detail: Form linked from the policy page as a third reporting route.
  - channel: email
    value: Unsafe@cns.gov
    detail: >-
      The registered .gov WHOIS security contact for every AmeriCorps domain, named on the
      policy page itself. This is the address that would appear in a security.txt if one were
      published.
authorization:
  detail: >-
    "If you make a good faith effort to comply with this policy during your security
    research, we will consider your research to be authorized, we will work with you to
    understand and resolve the issue quickly, and AmeriCorps will not recommend or pursue
    legal action related to your research. Should legal action be initiated by a third party
    against you for activities that were conducted in accordance with this policy, we will
    make this authorization known."
timelines:
  report_within: 1 hour of discovering a real or potential security issue, or as soon as possible
  public_disclosure_after: >-
    Researchers must give AmeriCorps a reasonable time to resolve before public disclosure —
    the policy states not more than 72 hours.
  note: >-
    Unusually tight on both ends compared with a typical commercial VDP: the reporter is
    asked to notify within an hour, and the pre-disclosure window is capped at 72 hours
    rather than the customary 90 days.
scope:
  statement: >-
    Applies to any internet-facing AmeriCorps service including web servers, mail gateways,
    utility servers and VPN gateways.
  domains:
    - americorps.gov
    - cncs.gov
    - cns.gov
    - autodiscover.cns.gov
    - egrants.cns.gov
    - inventory.cns.gov
    - owa.cns.gov
    - securetransfer.cns.gov
    - sts.cns.gov
    - vpn.cns.gov
    - webvpn.cns.gov
    - joinamericorps.gov
    - mentor.gov
    - mlkday.gov
    - nationalservice.gov
    - presidentialserviceawards.gov
    - serve.gov
    - vistacampus.gov
    - volunteeringinamerica.gov
  ip_ranges:
    - 152.180.8.128/26
    - 152.180.134.192/26
    - 204.124.228.0/22
    - 12.188.34.32/27
    - 216.109.83.64/27
    - 216.33.116.0/26
    - 209.67.159.0/26
  gap: >-
    data.americorps.gov — the host serving every API in this profile — is NOT named in the
    in-scope domain list, and its IP is not obviously inside the listed AmeriCorps ranges
    because the portal is operated by Socrata / Tyler Data & Insights on their FedRAMP
    platform. A researcher reading the policy literally cannot tell whether testing the open
    data API is authorized. This is the one concrete improvement available to AmeriCorps
    here: name data.americorps.gov (in or out of scope) explicitly.
rules_of_engagement:
  authorized_methods:
    - Network scanning with approved tools (Nessus, AngryIP)
    - Log review via Splunk or another approved tool
    - Approved network management tools
    - Observation of a vulnerability
    - Third-party report review
  prohibited_methods:
    - Network denial of service (DoS/DDoS) or any test that impairs access or damages data
    - Physical testing, social engineering, phishing, vishing, other non-technical testing
    - Using an exploit beyond confirming a vulnerability exists
    - Exfiltrating data, establishing persistent access, or pivoting to other systems
    - Submitting a high volume of low-quality reports
  on_sensitive_data: >-
    Stop testing immediately, notify AmeriCorps, and do not disclose the data to anyone else.
evidence:
  - source: https://www.americorps.gov/about/agency-overview/vulnerability-disclosure-policy
    kind: disclosure page
    status: 200
    keywords:
      - vulnerability
      - security research
      - authorization
      - safe harbor
      - report a security
  - source: https://www.americorps.gov/.well-known/security.txt
    kind: security.txt (live probe)
    status: 404
    detail: Not served. The policy exists but is not machine-discoverable via RFC 9116.
recommendation: >-
  Publish the existing policy as an RFC 9116 /.well-known/security.txt on americorps.gov (and
  ideally on data.americorps.gov) with Contact and Policy fields. Every value it needs —
  Unsafe@cns.gov and the policy URL — is already published on the page; only the
  machine-readable pointer is missing.