Qbe Vulnerability Disclosure

generated: '2026-07-25'
method: searched
probe: true
name: QBE Responsible Disclosure Program
summary: >-
  QBE runs a global Responsible Disclosure Program with a safe-harbour statement, a named intake
  (QBE's Global Security Operations Centre at security@qbe.com) and a HackerOne presence. The
  HackerOne team handle `qbe` — "QBE Insurance", with a QBE profile image — resolves (HTTP 200,
  confirmed via HackerOne's public GraphQL `team(handle:"qbe")`), but exposes no public structured
  scopes and no submission state, so the HackerOne side is an invitation-only / private program
  rather than an open public bug bounty. QBE states it does not compensate for disclosure.
policy:
- https://www.qbe.com/responsible-disclosure-program
- https://www.qbe.com/au/responsible-disclosure-statement
- https://www.qbe.com/us/responsible-disclosure
- https://qbecanada.com/responsible-disclosure-statement/
- https://qbere.com/responsible-disclosure-statement/
- https://www.qbe.com/lmi/about-us/governance/responsible-disclosure-statement
contact:
- security@qbe.com
bounty:
  offered: false
  note: QBE's program text states QBE does not compensate for disclosure.
platforms:
- name: HackerOne
  url: https://hackerone.com/qbe
  handle: qbe
  team_name: QBE Insurance
  status: 200
  public_scopes: 0
  submission_state: null
  note: >-
    Verified live via POST https://hackerone.com/graphql {team(handle:"qbe"){handle name url
    profile_picture structured_scopes}} — returns the QBE Insurance team with a QBE profile picture and
    an empty structured_scopes edge list. A control handle that does not exist returns HTTP 404, so the
    200 is meaningful. Private/invite-only program.
safe_harbour: >-
  QBE states it will not take legal action against security researchers acting in good faith who follow
  the program guidelines. Researchers may only test services and products to which they have authorised
  access. Prohibited: degrading availability, accessing unauthorised accounts or data, modifying or
  destroying data, denial-of-service, automated vulnerability scanners, and data exfiltration.
evidence:
- source: https://hackerone.com/graphql
  kind: hackerone-team-lookup
  status: 200
  fetched: '2026-07-25'
- source: https://hackerone.com/qbe
  kind: bug-bounty-platform-page
  status: 200
  fetched: '2026-07-25'
- source: https://www.qbe.com/responsible-disclosure-program
  kind: responsible-disclosure-policy
  status: 403
  fetched: '2026-07-25'
  note: >-
    Content read via web search indexing of the page (contact address, no-compensation statement,
    prohibited-activity list). Direct anonymous fetch is blocked — every www.qbe.com URL returns a
    Cloudflare "Just a moment..." interstitial (HTTP 403) to curl and to browser-UA fetchers alike.
security_txt:
  present: false
  probed:
  - {url: 'https://www.qbe.com/.well-known/security.txt', status: 404}
  - {url: 'https://qbe.com/.well-known/security.txt', status: 404}
  - {url: 'https://www.qbe.com.au/.well-known/security.txt', status: 404}
  - {url: 'https://qbena.com/.well-known/security.txt', status: 404}
  - {url: 'https://connect.api-au.qbe.com/.well-known/security.txt', status: 404}
  - {url: 'https://gateway.api-au.qbe.com/.well-known/security.txt', status: 404}
  - {url: 'https://partnerportal-api.qbena.com/.well-known/security.txt', status: 404}
  note: >-
    QBE has a real disclosure program but publishes no RFC 9116 security.txt on any host probed — the
    machine-readable pointer to the program is missing even though the program itself exists.