[{"id":3766013,"new_policy":"M\u0026T Bank is committed to ensuring the security of our customers by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how you should submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems in accordance with the guidelines below.\n**Note**: *This is a Responsible Disclosure Program, which addresses technical vulnerabilities that could be exploited. For all customer service needs, please [contact us](https://www3.mtb.com/homepage/explore-the-m-and-t-bank-help-center/mandt-bank-phone-numbers-by-department/telephone-directory). If you are reporting fraud or phishing, please call us at 1-800-724-2440*.\n\n# Program Terms\n* Your report is subject to [HackerOne’s Vulnerability Disclosure Guidelines](https://www.hackerone.com/terms/disclosure-guidelines).\n* Social engineering (e.g., phishing, vishing, smishing, tabnabbing) for the purposes of validating a vulnerability is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. You must only interact with accounts you own or with the explicit permission of the account holder.\n* Comply with applicable federal, state, local, and international laws in connection with your participation in this Responsible Disclosure Program.\n* M\u0026T reserves the right to modify the terms of this policy or terminate the program at any time.\n\n# Researcher Responsibilities\nBy submitting a report to M\u0026T you agree to adhere to the following guidelines:\n* You are at least 18 years old;\n* You are not located in or a resident of a country under United States sanctions, nor a person on, or working on behalf of a party identified on, any restricted party list maintained by the United States government;\n* You consent to your information being stored and transferred to the United States and acknowledge that you have read and accepted the terms of this policy and [HackerOne’s Vulnerability Disclosure Guidelines](https://www.hackerone.com/terms/disclosure-guidelines);\n* You agree not to disclose vulnerability details to anyone other than M\u0026T without first obtaining M\u0026T’s written permission;\n* You agree that your research will be conducted for testing and research purposes only, and that you will not attempt to gain access to customer or user accounts or M\u0026T’s confidential information;\n* Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **you must stop your test, notify us immediately, and not disclose this data to anyone else**;\n* You understand that nothing in this agreement, including submission of a report, shall be deemed to constitute the grant to you of any license or other right to any M\u0026T or third-party product, service, patent, trademark, trade secret, or any other intellectual property; and\n* By submitting a report to M\u0026T Bank, you grant to M\u0026T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.\n\n# Reporting Guidelines\n## Reporting a Vulnerability\nInformation submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M\u0026T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their [coordinated vulnerability disclosure process](https://www.cisa.gov/coordinated-vulnerability-disclosure-process). We will not share your name or contact information without express permission.\n\n## Create a Clear Report\nIn order to help us triage and prioritize submissions, we recommend that your reports:\n* Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\n* Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\n* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.\n* Describe the location the vulnerability was discovered and clearly describe the potential impact of the exploitation.\n* Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).\n* Be in English, if possible.\n\n# Scope\nThe program scope includes any public-facing system owned, operated, or controlled by M\u0026T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.\n\n# Out of Scope Vulnerabilities\n* Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\n* Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\nWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\n* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Large scale automated attacks using penetration testing software is prohibited.\n* Denial of Service attacks are prohibited.\n* Physical attacks are prohibited.\n* Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\n \n# Out of Scope Vulnerabilities\nWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\n\n* Clickjacking on pages with no sensitive actions\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Any activity that could lead to the disruption of our service (DoS).\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.\n* Rate limiting or brute-force issues on non-authentication endpoints.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Tabnabbing.\n* Open redirect - unless an additional security impact can be demonstrated.\n* Issues that require unlikely user interaction.\n\n**In addition to the out-of-scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.** \n\nAdditionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.\n\nThough we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system out of scope that you think merits testing, please contact us to discuss it first. We may  amend the scope of this policy over time.\n\n# Disclosure Policy\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Reporting a Vulnerability\nInformation submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M\u0026T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their [coordinated vulnerability disclosure process](https://www.cisa.gov/coordinated-vulnerability-disclosure-process). We will not share your name or contact information without express permission.\n\n# Response Targets\nM\u0026T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | 1 day |\n| Time to Triage | 2 days |\n| Time to Resolution | Depends on severity \u0026 complexity |\n\nTo the best of our ability, we will keep you informed about our progress throughout the process.\n\n# Authorization and Safe Harbor\nSecurity research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.\nM\u0026T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.\n\n# Questions\nPlease contact us with questions regarding this policy at support@hackerone.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M\u0026T Bank and our users safe!!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":"Hello and welcome, to M\u0026T Bank's Responsible Disclosure program. ","platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2025-11-12T17:14:19.306Z"},{"id":3749667,"new_policy":"This is a Responsible Disclosure Program for security issues. For all customer service needs, please [contact us]( https://www3.mtb.com/homepage/explore-the-m-and-t-bank-help-center/mandt-bank-phone-numbers-by-department/telephone-directory).\n\nM\u0026T Bank is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems.\n\nThis policy describes **what systems and types of research** are covered hereunder, **how to send us** vulnerability reports, and **how long** we ask security researchers to wait before publicly disclosing vulnerabilities.\n\n# Authorization and Safe Harbor\nSecurity research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. .\n\n# Guidelines\nOnce you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **you must stop your test, notify us immediately, and not disclose this data to anyone else.**\n\n# Scope and Program Rules\nThe program scope includes any public-facing system owned, operated, or controlled by M\u0026T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.\n\n* Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\n* Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\nWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\n* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Large scale automated attacks using penetration testing software is prohibited.\n* Denial of Service attacks are prohibited.\n* Physical attacks are prohibited.\n* Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\n \n# Out of Scope Vulnerabilities\nWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\n\n* Clickjacking on pages with no sensitive actions\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Any activity that could lead to the disruption of our service (DoS).\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.\n* Rate limiting or brute-force issues on non-authentication endpoints.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Tabnabbing.\n* Open redirect - unless an additional security impact can be demonstrated.\n* Issues that require unlikely user interaction.\n\n**In addition to the out-of-scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.** \n\nAdditionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.\n\nThough we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time. \n\nM\u0026T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.\n\n# Disclosure Policy\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Reporting a Vulnerability\nInformation submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M\u0026T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their [coordinated vulnerability disclosure process](https://www.cisa.gov/coordinated-vulnerability-disclosure-process). We will not share your name or contact information without express permission.\n\n# Response Targets\nM\u0026T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | 1 day |\n| Time to Triage | 2 days |\n| Time to Resolution | Depends on severity \u0026 complexity |\n\nTo the best of our ability, we will keep you informed about our progress throughout the process.\n\nBy submitting a report to M\u0026T Bank, you grant to M\u0026T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.\n\n# What we would like to see from you\nIn order to help us triage and prioritize submissions, we recommend that your reports:\n\n* Describe the location the vulnerability was discovered and the potential impact of exploitation. \n* Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).\n* Be in English, if possible.\n\n# Questions\nPlease contact us with questions regarding this policy at support@hackerone.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M\u0026T Bank and our users safe!!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":"Hello and welcome, to M\u0026T Bank's Responsible Disclosure program. ","platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2025-02-06T14:53:32.101Z"},{"id":3709094,"new_policy":"This is a Responsible Disclosure Program for security issues. For all customer service needs, please [contact us]( https://www3.mtb.com/homepage/explore-the-m-and-t-bank-help-center/mandt-bank-phone-numbers-by-department/telephone-directory).\n\nM\u0026T Bank is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems.\n\nThis policy describes **what systems and types of research** are covered hereunder, **how to send us** vulnerability reports, and **how long** we ask security researchers to wait before publicly disclosing vulnerabilities.\n\n# Authorization and Safe Harbor\nSecurity research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. .\n\n# Guidelines\nOnce you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **you must stop your test, notify us immediately, and not disclose this data to anyone else.**\n\n# Scope and Program Rules\nThe program scope includes any public-facing system owned, operated, or controlled by M\u0026T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.\n\n* Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\n* Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\nWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\n* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Large scale automated attacks using penetration testing software is prohibited.\n* Denial of Service attacks are prohibited.\n* Physical attacks are prohibited.\n* Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\n \n# Out of Scope Vulnerabilities\nWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\n\n* Clickjacking on pages with no sensitive actions\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Any activity that could lead to the disruption of our service (DoS).\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.\n* Rate limiting or brute-force issues on non-authentication endpoints.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Tabnabbing.\n* Open redirect - unless an additional security impact can be demonstrated.\n* Issues that require unlikely user interaction.\n\n**In addition to the out-of-scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.** \n\nAdditionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.\n\nThough we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time. \n\nM\u0026T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.\n\n# Disclosure Policy\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Reporting a Vulnerability\nInformation submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M\u0026T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their [coordinated vulnerability disclosure process](https://www.cisa.gov/coordinated-vulnerability-disclosure-process). We will not share your name or contact information without express permission.\n\n# Response Targets\nM\u0026T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | 1 day |\n| Time to Triage | 2 days |\n| Time to Resolution | Depends on severity \u0026 complexity |\n\nTo the best of our ability, we will keep you informed about our progress throughout the process.\n\nBy submitting a report to M\u0026T Bank, you grant to M\u0026T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.\n\n# What we would like to see from you\nIn order to help us triage and prioritize submissions, we recommend that your reports:\n\n* Describe the location the vulnerability was discovered and the potential impact of exploitation. \n* Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).\n* Be in English, if possible.\n\n# Questions\nPlease contact us with questions regarding this policy at support@hackerone.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M\u0026T Bank and our users safe!!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2023-12-11T15:27:54.469Z"},{"id":3660168,"new_policy":"This is a Responsible Disclosure Program for security issues. For all customer service needs, please [contact us]( https://www3.mtb.com/homepage/explore-the-m-and-t-bank-help-center/mandt-bank-phone-numbers-by-department/telephone-directory).\n\nM\u0026T Bank is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems.\n\nThis policy describes **what systems and types of research** are covered hereunder, **how to send us** vulnerability reports, and **how long** we ask security researchers to wait before publicly disclosing vulnerabilities.\n\n# Authorization and Safe Harbor\nSecurity research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. .\n\n# Guidelines\nOnce you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **you must stop your test, notify us immediately, and not disclose this data to anyone else.**\n\n# Scope and Program Rules\nThe program scope includes any public-facing system owned, operated, or controlled by M\u0026T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.\n\n* Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.\n* Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.\nWhen duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).\n* Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Large scale automated attacks using penetration testing software is prohibited.\n* Denial of Service attacks are prohibited.\n* Physical attacks are prohibited.\n* Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\n \n# Out of Scope Vulnerabilities\nWhen reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\n\n* Clickjacking on pages with no sensitive actions\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Any activity that could lead to the disruption of our service (DoS).\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.\n* Rate limiting or brute-force issues on non-authentication endpoints.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Tabnabbing.\n* Open redirect - unless an additional security impact can be demonstrated.\n* Issues that require unlikely user interaction.\n\n**In addition to the out-of-scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.** \n\nAdditionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.\n\nThough we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time. \n\nM\u0026T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.\n\n# Disclosure Policy\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Reporting a Vulnerability\nInformation submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M\u0026T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their [coordinated vulnerability disclosure process](https://www.cisa.gov/coordinated-vulnerability-disclosure-process). We will not share your name or contact information without express permission.\n\n# Response Targets\nM\u0026T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | 1 day |\n| Time to Triage | 2 days |\n| Time to Resolution | Depends on severity \u0026 complexity |\n\nTo the best of our ability, we will keep you informed about our progress throughout the process.\n\nBy submitting a report to M\u0026T Bank, you grant to M\u0026T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.\n\n# What we would like to see from you\nIn order to help us triage and prioritize submissions, we recommend that your reports:\n\n* Describe the location the vulnerability was discovered and the potential impact of exploitation. \n* Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).\n* Be in English, if possible.\n\n# Questions\nPlease contact us with questions regarding this policy at support@hackerone.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M\u0026T Bank and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-10-18T21:00:24.052Z"}]