Dun And Bradstreet Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.dnb.com/content/dam/web/company/about/content/ibrp/DnB_Tier-1-CP-21-Incident-and-Breach-Response-Policy-Statement.pdf
description: >-
  Security reporting posture for Dun & Bradstreet. D&B publishes a security
  policy page and a corporate Incident and Breach Response Policy Statement
  carrying a reporting mailbox, but it operates NO coordinated vulnerability
  disclosure program and NO bug bounty. The distinction matters and is
  recorded explicitly below, because the top search result for "D&B
  responsible disclosure" is a HackerOne page that D&B does not run.

policy:
  - https://www.dnb.com/en-us/utilities/our-security.html
  - https://www.dnb.com/content/dam/web/company/about/content/ibrp/DnB_Tier-1-CP-21-Incident-and-Breach-Response-Policy-Statement.pdf

contact:
  - incident@dnb.com

security_policy_page:
  url: https://www.dnb.com/en-us/utilities/our-security.html
  http_status: 200
  public: true
  covers: [SOC 2 Type 2, ISO/IEC 27001:2022, PCI, SIG]

incident_reporting:
  mailbox: incident@dnb.com
  policy_document: Corporate Policy No. 21 — Incident and Breach Response Policy Statement
  policy_version: '1.2'
  date_established: '2024-02-20'
  last_updated: '2026-04-23'
  url: https://www.dnb.com/content/dam/web/company/about/content/ibrp/DnB_Tier-1-CP-21-Incident-and-Breach-Response-Policy-Statement.pdf
  http_status: 200
  scope: >-
    Data, compliance and security incidents. The policy is written for D&B
    team members ("all team members promptly report every event that they
    suspect to be — or could lead to — an Incident") rather than for external
    security researchers, but the mailbox is published in a public document
    and is the only reporting address D&B names.
  related_policy: >-
    https://www.dnb.com/content/dam/english/economic-and-industry-insight/tier-1-cp-7-speak-up-and-non-retaliation-policy-statement.pdf

bug_bounty:
  operates: false
  platform: null

third_party_pages:
  - url: https://hackerone.com/dun_bradstreet
    http_status: 200
    operated_by_provider: false
    verdict: NOT a D&B program — do not credit
    evidence: >-
      The page carries HackerOne's class="spec-external-unclaimed" marker and
      the description "This community-curated security page documents any
      known process for reporting a security vulnerability to Dun &
      Bradstreet". It is an unclaimed external directory entry, not a program
      D&B runs. hackerone.com/dun_bradstreet.json returns 404, which is what
      an unclaimed page does.
    note: >-
      This is the single most likely false positive on this provider. Any
      future run that finds this URL must re-check the unclaimed marker before
      recording it.

evidence:
  - source: https://www.dnb.com/en-us/utilities/our-security.html
    kind: security-policy-page
    http_status: 200
  - source: https://www.dnb.com/content/dam/web/company/about/content/ibrp/DnB_Tier-1-CP-21-Incident-and-Breach-Response-Policy-Statement.pdf
    kind: corporate-policy-pdf
    http_status: 200
    extracted: 'mailto:incident@dnb.com'
  - source: https://www.dnb.com/.well-known/security.txt
    kind: security.txt
    http_status: 404
  - source: https://plus.dnb.com/.well-known/security.txt
    kind: security.txt
    http_status: 404
  - source: https://hackerone.com/dun_bradstreet
    kind: third-party-unclaimed
    http_status: 200

absences:
  - No RFC 9116 security.txt on any D&B host.
  - No coordinated vulnerability disclosure policy addressed to researchers.
  - No bug bounty program.
  - No security@ alias published; incident@ is an incident mailbox, not a VDP intake.
  - No published safe-harbour statement.