Ogilvy Vulnerability Disclosure

generated: '2026-08-12'
method: searched
probe: true
source: https://www.ogilvy.com/responsible-disclosure-policy
policy:
  - https://www.ogilvy.com/responsible-disclosure-policy
  - https://www.ogilvy.com/uk/responsible-disclosure-policy
  - https://www.ogilvy.com/ap/responsible-disclosure-policy
  - https://www.ogilvy.com/sg/responsible-disclosure-policy
  - https://www.ogilvy.com/ae/responsible-disclosure-policy
  - https://www.wpp.com/en/privacy-policy/responsible-disclosure-policy
contact:
  - mailto:enquiries@wpp.com
program:
  name: Ogilvy Responsible Disclosure Policy
  type: self-hosted
  platform: null
  rewards: false
  reward_range: null
  reward_note: >-
    Quoted verbatim from the policy: "We do not offer a bug bounty program or
    monetary rewards for responsible disclosures."
  safe_harbor: partial
  safe_harbor_note: >-
    The policy sets out researcher obligations and a good-faith framing
    consistent with common vulnerability-disclosure practice, but publishes no
    explicit legal safe-harbour / no-litigation clause.
  hall_of_fame: false
  first_reporter_only: null
  inherited_from_parent: true
  parent_note: >-
    The reporting address is WPP's group-level enquiries@wpp.com, and WPP
    publishes the same policy at wpp.com. Ogilvy serves it under its own domain
    for the global site and for the UK, APAC, Singapore and UAE regional sites,
    so it is a first-party published page even though the intake is WPP's.
sla:
  acknowledgement: 5 working days
  triage: 10 working days
  status_update: >-
    "We aim to keep you informed of our progress" and to notify on completion of
    remediation; no fixed cadence is published.
  disclosure_window: null
scope:
  in:
    - Ogilvy websites, domains, IP addresses and pages
    - >-
      Findings demonstrable with a benign, non-destructive proof of concept,
      reported with the website/domain/IP/page and steps to reproduce
  out:
    - breaking any applicable law or regulation
    - accessing unnecessary, excessive or significant amounts of data
    - modifying data
    - disrupting services or systems
    - using high-intensity invasive or destructive scanning tools
    - non-exploitable vulnerabilities
    - reports that services do not fully align with "best practice"
    - TLS configuration weaknesses
    - social engineering or phishing of staff
    - physical attacks on staff or infrastructure
    - demanding financial compensation in order to disclose
researcher_obligations:
  - >-
    "Securely delete all data retrieved during your research as soon as it is no
    longer required or within 1 month of the vulnerability being resolved,
    whichever occurs first."
evidence:
  - source: https://www.ogilvy.com/responsible-disclosure-policy
    kind: disclosure-policy
    http_status: 200
    note: >-
      Served from Ogilvy's own Drupal site on the apex marketing domain. Not
      linked from the site navigation or listed in /sitemap.xml — reachable only
      by direct URL or search engine.
  - source: https://www.ogilvy.com/uk/responsible-disclosure-policy
    kind: disclosure-policy
    http_status: 200
  - source: https://www.ogilvy.com/ap/responsible-disclosure-policy
    kind: disclosure-policy
    http_status: 200
  - source: https://www.ogilvy.com/sg/responsible-disclosure-policy
    kind: disclosure-policy
    http_status: 200
  - source: https://www.ogilvy.com/ae/responsible-disclosure-policy
    kind: disclosure-policy
    http_status: 200
  - source: https://www.wpp.com/en/privacy-policy/responsible-disclosure-policy
    kind: parent-disclosure-policy
    http_status: 200
  - source: https://www.ogilvy.com/.well-known/security.txt
    kind: security-txt
    http_status: 404
    note: >-
      The policy is NOT advertised via RFC 9116. A security.txt with a Policy:
      and Contact: line pointing at this page would make it machine-discoverable
      at zero cost — this is the single cheapest security-posture improvement
      available to Ogilvy.
last_updated_published: null
x-evidence:
  fetched: '2026-08-12'
  discovery: >-
    Not found by crawl — /sitemap.xml carries 1,535 URLs and none of them is the
    disclosure policy. Found by web search, then confirmed by direct probe of the
    global and four regional paths.