Microsoft Linkedin Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.linkedin.com/.well-known/security.txt
description: >-
  LinkedIn runs its own vulnerability disclosure program on HackerOne, independent of the Microsoft
  MSRC program that covers the rest of the parent company. Both are recorded here because LinkedIn
  is a Microsoft subsidiary and the microsoft.com security.txt also resolves for this provider — but
  the LinkedIn-operated program is the correct route for LinkedIn API and platform findings.
programs:
  - name: LinkedIn Bug Bounty Program
    operator: LinkedIn Corporation
    platform: HackerOne
    url: https://hackerone.com/linkedin
    policy: https://hackerone.com/linkedin?view_policy=true
    discovered_via: https://www.linkedin.com/.well-known/security.txt
    primary: true
  - name: Microsoft Security Response Center (MSRC)
    operator: Microsoft (parent company)
    url: https://www.microsoft.com/en-us/msrc/bounty/
    policy: https://www.microsoft.com/en-us/msrc/cvd
    safe_harbor: https://www.microsoft.com/en-us/msrc/bounty-safe-harbor
    report: https://msrc.microsoft.com/report/vulnerability/new
    discovered_via: https://microsoft.com/.well-known/security.txt
    primary: false
policy:
  - https://hackerone.com/linkedin?view_policy=true
  - https://www.microsoft.com/en-us/msrc/cvd
  - https://www.microsoft.com/en-us/msrc/bounty-safe-harbor
contact:
  - https://hackerone.com/linkedin
  - https://www.linkedin.com/help/linkedin/answer/62924
  - https://msrc.microsoft.com/report/vulnerability/new
security_txt:
  url: https://www.linkedin.com/.well-known/security.txt
  status: 200
  file: well-known/microsoft-linkedin-security.txt
  canonical: https://www.linkedin.com/.well-known/security.txt
  conforms_to: draft-foudil-securitytxt-07 (self-declared)
  rfc9116_compliant: false
  rfc9116_gap: no Expires field, which RFC 9116 requires
  fields:
    contact:
      - https://hackerone.com/linkedin
      - https://www.linkedin.com/help/linkedin/answer/62924
    canonical: https://www.linkedin.com/.well-known/security.txt
    policy: https://hackerone.com/linkedin?view_policy=true
  note: >-
    Served only at the www.linkedin.com root. The API host api.linkedin.com and the developer host
    developer.linkedin.com both returned 404 for /.well-known/security.txt on 2026-08-13.
evidence:
  - source: https://www.linkedin.com/.well-known/security.txt
    status: 200
    kind: RFC 9116 security.txt (live probe, saved verbatim)
  - source: https://microsoft.com/.well-known/security.txt
    status: 200
    kind: parent-company security.txt (live probe)
  - source: https://hackerone.com/linkedin
    kind: bug bounty program named as Contact and Policy in LinkedIn's own security.txt