Capital One · Vulnerability Disclosure

Capital One Vulnerability Disclosure

Vulnerability disclosure

Capital One runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

Auto FinanceAuthorizationsBankingCredit CardsCredit OffersDevExchangeFinancial-ServicesFDXOpen BankingAuthenticationPaymentsRewardsUnited StatesFortune 500

Program: Hackerone security.txt present

Disclosure Policy

Policy

https://www.capitalone.com/digital/responsible-disclosure/

Security Contact

Contact

responsibledisclosure@capitalone.com

Source

Vulnerability Disclosure

generated: '2026-07-23'
method: searched
probe: true
source: https://www.capitalone.com/security.txt
policy:
- https://www.capitalone.com/digital/responsible-disclosure/
contact:
- responsibledisclosure@capitalone.com
program:
  type: responsible-disclosure
  platform: HackerOne
  submission: https://hackerone.com/555d8c87-becd-4083-9a2e-82cb78c7016c/embedded_submissions/new
  managed: true
  note: >-
    Capital One runs a HackerOne-managed responsible-disclosure / vulnerability
    reporting program. Reports are submitted through a HackerOne embedded
    submission form linked from the responsible-disclosure page; the program is
    not listed publicly at hackerone.com/capital_one.
preferred_languages:
- EN
security_txt_expires: '2025-12-14T05:00:00.000Z'
evidence:
- source: https://www.capitalone.com/security.txt
  kind: security.txt
  fields: [Policy, Contact, Expires, Preferred-Languages]
- source: https://www.capitalone.com/digital/responsible-disclosure/
  kind: disclosure-page
  keywords: [responsible disclosure, hackerone, vulnerability, scope, reward]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/capital-one-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.