Ameriprise Financial Vulnerability Disclosure

generated: '2026-09-02'
method: probed
source: live probes of security.txt, HackerOne, Bugcrowd and the provider's own security pages
provider: Ameriprise Financial
providerId: ameriprise-financial
program_present: false
description: >-
  Ameriprise Financial publishes NO coordinated vulnerability disclosure policy,
  no RFC 9116 security.txt, no safe-harbour statement for security researchers,
  and no public bug-bounty program. This file records a verified absence.
  DELIBERATELY NO `type: Security` POINTER IS EMITTED for this artifact — the
  `security_disclosure` check reads that pointer as an assertion that the
  provider operates a disclosure program, and Ameriprise does not.
  The closest published surface is a CONSUMER account-fraud channel
  (https://www.ameriprise.com/privacy-security-fraud/fraud-reporting, HTTP 200):
  telephone lines for lost cards and unauthorized account activity, plus a
  phishing-forwarding mailbox (anti.fraud@ampf.com). That is a fraud desk for
  clients, not an intake for a researcher reporting a vulnerability in an
  Ameriprise system, so it is recorded here rather than pointed at as a policy.
  A prior `type: Security` pointer at
  https://www.ameriprise.com/privacy-security/ was ALSO confirmed dead (HTTP 404)
  and has been removed from apis.yml.
evidence:
  - url: https://www.ameriprise.com/.well-known/security.txt
    status: 404
  - url: https://ameriprise.com/.well-known/security.txt
    status: 404
  - url: https://www.ameriprise.com/security.txt
    status: 404
  - url: https://www.ameripriseadvisors.com/.well-known/security.txt
    status: 404
  - url: https://hackerone.com/ameriprise
    status: 404
  - url: https://bugcrowd.com/ameriprise
    status: 404
  - url: https://trust.ameriprise.com
    status: 'DNS does not resolve'
  - url: https://www.ameriprise.com/privacy-security/
    status: 404
    note: pointer previously carried in apis.yml as type Security; confirmed dead, removed
  - url: https://www.ameriprise.com/privacy-security-fraud/fraud-reporting
    status: 200
    note: consumer fraud desk, not a researcher disclosure channel
  - url: https://www.ameriprise.com/privacy-security-fraud/how-we-protect-information
    status: 200
    note: consumer-facing security posture page, no disclosure policy or safe harbour
remedy: >-
  Publishing an RFC 9116 /.well-known/security.txt with a Contact and Policy URL,
  plus a short safe-harbour statement, would close this gap without any developer
  program existing — it is independent of whether Ameriprise ever ships an API.
maintainers:
  - FN: API Evangelist
    email: info@apievangelist.com