Federal Mediation And Conciliation Service Vulnerability Disclosure

generated: '2026-09-09'
method: searched
probe: true
source: https://www.fmcs.gov/vulnerability-disclosure-policy/
policy: [https://www.fmcs.gov/vulnerability-disclosure-policy/]
contact: [security@fmcs.gov]
policy_dated: '2021-02-26'
coordinated_disclosure_window_days: 90
bug_bounty: false
safe_harbour: true
summary: >-
  FMCS publishes a complete CISA BOD 20-01-style vulnerability disclosure policy as an HTML page. It names
  security@fmcs.gov as the reporting address, states that FMCS will treat good-faith research as
  authorised and will not pursue or recommend legal action for authorised research, offers to document
  that authorisation on request if a third party sues, requires reporters to stop and notify on
  encountering sensitive data, and asks researchers to hold public disclosure for 90 days after the
  initial report. Reporters waive any claim to compensation — there is no bug bounty.
security_txt:
  served: false
  probed:
    - {url: 'https://www.fmcs.gov/.well-known/security.txt', status: 404, checked: '2026-09-09'}
    - {url: 'https://fmcs.gov/.well-known/security.txt', status: 404, checked: '2026-09-09'}
    - {url: 'https://arbitration.fmcs.gov/.well-known/security.txt', status: 404, checked: '2026-09-09'}
  note: >-
    The gap worth reporting to FMCS. The policy exists and is good; the RFC 9116 pointer to it does not,
    on any host, so a scanner looking for the policy at the standard location concludes there is none. A
    single static file at /.well-known/security.txt naming the existing Policy and Contact URLs would close
    it. No SecurityTxt pointer is wired in apis.yml.
evidence:
  - source: https://www.fmcs.gov/vulnerability-disclosure-policy/
    kind: disclosure page
    status: 200
    checked: '2026-09-09'
    keywords:
      - vulnerability disclosure policy
      - security research
      - 'security@fmcs.gov'
      - authorization
      - 90 days