Equifax Vulnerability Disclosure

generated: '2026-09-06'
method: searched
probe: false
source: https://www.equifax.com/about-equifax/security/
url: https://hackerone.com/equifax
program_name: Equifax-vdp
platform: HackerOne
type: vulnerability disclosure program (VDP)
bounty: not advertised as a paid bounty on the public program page
description: >-
  Equifax runs a Vulnerability Disclosure Program on HackerOne. It is linked from the
  footer of equifax.com itself — the "Report a Vulnerability" link on
  https://www.equifax.com/about-equifax/security/ resolves to https://hackerone.com/equifax/
  — so the program is first-party and discoverable from Equifax's own surface. The
  automated probe recorded nothing because Equifax serves no /.well-known/security.txt on
  any host (every path 404s; see well-known/equifax-well-known.yml); the disclosure route
  is published as an ordinary site link instead of an RFC 9116 document.
policy:
  - https://hackerone.com/equifax
contact:
  - https://hackerone.com/equifax
evidence:
  - source: https://www.equifax.com/about-equifax/security/
    status: 200
    kind: first-party page whose footer link "Report a Vulnerability" targets https://hackerone.com/equifax/
  - source: https://hackerone.com/equifax
    status: 200
    kind: >-
      HackerOne program page. og:title "Equifax-vdp - Vulnerability Disclosure Program |
      HackerOne"; description "The Equifax-vdp Vulnerability Disclosure Program enlists
      the help of the hacker community at HackerOne".
  - source: https://www.equifax.com/.well-known/security.txt
    status: 404
    kind: negative probe — no RFC 9116 document
  - source: https://bugcrowd.com/equifax
    status: 404
    kind: negative probe — no Bugcrowd program
gaps:
  - >-
    Publishing /.well-known/security.txt with `Policy: https://hackerone.com/equifax` on
    equifax.com, developer.equifax.com and api.equifax.com would make an existing program
    machine-discoverable at zero cost.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com