Linkedin Ads Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.linkedin.com/.well-known/security.txt
note: >-
  LinkedIn runs its own disclosure program on HackerOne and advertises it from an
  RFC 9116 security.txt served on its member host. A prior pass recorded only the
  Microsoft MSRC program (LinkedIn is a Microsoft subsidiary); MSRC is retained
  below as the parent-company escalation path, but LinkedIn's own program is the
  primary and is what the security.txt names.
policy:
  - https://hackerone.com/linkedin?view_policy=true
contact:
  - https://hackerone.com/linkedin
  - https://www.linkedin.com/help/linkedin/answer/62924
canonical: https://www.linkedin.com/.well-known/security.txt
security_txt:
  served: true
  host: www.linkedin.com
  file: well-known/linkedin-ads-security.txt
  conforms_to: IETF draft-foudil-securitytxt-07 (pre-RFC 9116 draft, as stated in the file)
  fields: [Contact, Canonical, Policy]
  missing_fields: [Expires, Encryption, Preferred-Languages]
bug_bounty:
  platform: HackerOne
  url: https://hackerone.com/linkedin
parent_company:
  name: Microsoft Security Response Center
  policy:
    - https://www.microsoft.com/en-us/msrc/bounty-safe-harbor
    - https://www.microsoft.com/en-us/msrc/bounty/
    - https://www.microsoft.com/en-us/msrc/cvd
  contact:
    - https://msrc.microsoft.com/report/vulnerability/new
  source: https://microsoft.com/.well-known/security.txt
evidence:
  - source: https://www.linkedin.com/.well-known/security.txt
    kind: security.txt (live probe)
    http_status: 200
  - source: https://microsoft.com/.well-known/security.txt
    kind: security.txt (live probe, parent company)
    http_status: 200
  - source: https://api.linkedin.com/.well-known/security.txt
    kind: security.txt
    http_status: 404
    note: The API host itself serves no security.txt.
x-evidence:
  fetched: '2026-08-13'