Experian Vulnerability Disclosure

generated: '2026-09-13'
method: searched
source: https://hackerone.com/experian/policy_versions
program:
  published: true
  name: Experian Vulnerability Disclosure Program
  platform: HackerOne
  url: https://hackerone.com/experian
  policy_url: https://hackerone.com/experian/policy_versions
  type: vulnerability disclosure program (VDP)
  bounty: false
  bounty_note: The published policy is a disclosure program, not a paid bug bounty; no reward table
    is stated in the policy text.
  visibility: private
  visibility_note: 'The policy states plainly: "As this is a private program, please do not discuss
    this program or any vulnerabilities (even resolved ones) outside of the program without express
    written consent from the organization." The POLICY is public and readable at the URL above; the
    program itself is invitation-based.'
  scope_summary: Experian Inc., its affiliates and subsidiaries, including web applications hosted on
    Experian sites. Out of scope items named in the policy include DNS/subdomain takeover and domain
    squatting, and any activity affecting Experian personnel or third parties.
  response_targets:
  - metric: time to first response (from report submit)
    target: 5 days
  - metric: time to triage (from report submit)
    target: 5 days
  safe_harbor: true
  safe_harbor_note: The policy authorizes vulnerability discovery activity conducted within its
    terms, limits activity exclusively to detection, and requires researchers to hold discovered
    information in strict confidence.
security_txt:
  published: false
  note: No /.well-known/security.txt is served on any Experian host probed — experian.com,
    www.experian.com, www.experianplc.com, developer.experian.com, api.experianaperture.io,
    docs.experianaperture.io, us-api.experian.com or ws.ondemand.qas.com. See
    well-known/experian-well-known.yml for the full probe record. A company running a HackerOne VDP
    and not pointing at it from an RFC 9116 file is leaving the machine-readable half undone.
secondary_channel:
  name: ResponsibleDisclosure.com
  url: https://experian.responsibledisclosure.com/
  status: unreachable from this probe (connection failed, curl exit 6 / DNS)
  note: Referenced in third-party sources as an Experian disclosure channel; recorded as a lead, not
    as a verified surface.