Hanr Block Vulnerability Disclosure

generated: '2026-09-14'
method: searched
source: https://www.hrblock.com/responsible-disclosure-policy/
provider: H&R Block
providerId: hanr-block
description: >-
  H&R Block runs a coordinated vulnerability disclosure program. It is published two ways:
  a Responsible Disclosure Policy page on hrblock.com, and a program on HackerOne under the
  handle hrblock-bbp, registered to the legal entity "H&R Block Tax Group, Inc.".
policy:
  url: https://www.hrblock.com/responsible-disclosure-policy/
  name: H&R Block Vulnerability Disclosure Policy
  effective: '2022-04-01'
  scope: >-
    All internet-accessible, public-facing systems or services of H&R Block are in scope of
    the VDP.
  anonymous_reports_accepted: true
  embargo_days: 90
  note: >-
    H&R Block asks researchers to withhold public disclosure for 90 calendar days after
    acknowledgement of receipt.
program:
  platform: HackerOne
  handle: hrblock-bbp
  team_name: H&R Block Tax Group, Inc. BBP
  url: https://hackerone.com/hrblock-bbp
  verified_via: >-
    Anonymous POST to https://hackerone.com/graphql for team(handle:"hrblock-bbp") returned
    handle "hrblock-bbp" and name "H&R Block Tax Group, Inc. BBP" (HTTP 200).
  pays_bounties: unknown
  bounty_note: >-
    The handle suffix "bbp" reads as bug bounty program, but submission_state,
    offers_bounties and launched_at all return null to an unauthenticated GraphQL query and
    the policy body is not exposed anonymously, so paid status is NOT asserted here.
security_txt:
  served: false
  note: >-
    No /.well-known/security.txt on any reachable hrblock.com host. On www.hrblock.com the
    path returns the Akamai 403 that every path returns from our network, so absence there
    is unconfirmed; on login.hrblock.com, identity.hrblock.com and account.hrblock.com it is
    a clean 404.
x-evidence:
  - url: https://hackerone.com/hrblock-bbp
    http_status: 200
    note: >-
      The page itself is a 2.2KB SPA shell to a direct fetch; program identity was confirmed
      through the anonymous GraphQL API rather than the HTML.
  - url: https://hackerone.com/graphql
    http_status: 200
    note: team(handle "hrblock-bbp") resolved to "H&R Block Tax Group, Inc. BBP"
  - url: https://bugcrowd.com/hrblock
    http_status: 404
    note: No Bugcrowd program under that handle.
  - url: https://www.hrblock.com/responsible-disclosure-policy/
    http_status: 403
    note: >-
      Akamai edge answers 403 to our network for every path on www.hrblock.com regardless of
      User-Agent. The page's existence, effective date, scope and 90-day embargo were read
      from the search index on 2026-09-14, not fetched directly. Flagged so a later run from
      an unblocked network can upgrade this to a direct fetch.
  - url: https://login.hrblock.com/.well-known/security.txt
    http_status: 404