cablej / hack-your-government

A list of governments with Vulnerability Disclosure Policies

Can you hack your government?

Vulnerability disclosure policies and bug bounty programs are becoming standard across industry and government. Beginning with the U.S. Department of Defense, several government agencies worldwide have implemented vulnerability disclosure programs.

This is a list of government agencies that have bug bounty programs or vulnerability disclosure policies. Please submit a pull request if any government agencies are missing from this list.

Note: This list is not an invitation to hack any of the listed organizations. Ensure that you comply with all listed terms of an organization's vulnerability disclosure policy.

Organization	Type	Rewards	Link	Notes
U.S. Department of Defense	VDP	None	https://hackerone.com/deptofdefense	Safe Harbor
U.S. Department of Defense	Bug Bounty	Varies		Private, time-limited challenges
GSA Technology Transformation Services	Bug Bounty	$150-$5,000	https://hackerone.com/gsa_bbp	Safe Harbor
Iowa Secretary of State	VDP	N/A	https://sos.iowa.gov/pdf/IOWA_SOS_VDP_Policy.pdf	Safe Harbor
Ohio Secretary of State	VDP	N/A	https://www.ohiosos.gov/vulnerability-disclosure-policy/	Safe Harbor
State of Delaware	VDP		https://delaware.gov/help/responsible-disclosure.shtml	Partial Safe Harbor
Washington D.C.	VDP	N/A	https://octo.dc.gov/sites/default/files/dc/sites/octo/publication/attachments/Responsible%20Disclosure%20Policy%20.pdf
Minnesota Secretary of State	VDP	N/A	https://sos.mn.gov/about-the-office/about-the-office/vulnerability-disclosure-program/
Idaho Secretary of State	VDP	N/A	https://sos.idaho.gov/vulnerability-disclosure-policy/
South Carolina Election Commission	VDP	N/A	https://scvotes.gov/resources/vulnerability-disclosure-program/
State of New Jersey	VDP	N/A	https://www.cyber.nj.gov/report/vulnerability-disclosure/vulnerability-disclosure-policy
City of Los Angeles	VDP	N/A	https://hackerone.com/city_of_los_angeles_vdp
Netherlands NCSC	VDP	Up to €300	https://www.ncsc.nl/security
Netherlands Central Government	VDP	N/A	https://www.government.nl/topics/cybercrime/fighting-cybercrime-in-the-netherlands/responsible-disclosure
Government of Jersey	VDP	N/A	https://www.gov.je/Pages/DisclosurePolicy.aspx
United Kingdom NCSC	VDP	None	https://hackerone.com/ncsc_uk
Administrative Conference of the United States	VDP	N/A	https://www.acus.gov/vulnerability-disclosure-policy
African Development Foundation	VDP	N/A	https://www.usadf.gov/vulnerability-disclosure-policy
American Battle Monuments Commission	VDP	N/A	https://www.abmc.gov/vulnerability-disclosure-policy
Armed Forces Retirement Home	VDP	N/A	https://www.afrh.gov/vulnerability-disclosure-policy
Barry Goldwater Scholarship and Excellence in Education Foundation	VDP	N/A	https://goldwaterscholarship.gov/vulnerability-disclosure-policy/
Board of Governors of the Federal Reserve	VDP	N/A	https://www.federalreserve.gov/vulnerability-disclosure-policy
Chemical Safety Board	VDP	N/A	https://www.csb.gov/vulnerability-disclosure-policy/
Commission of Fine Arts	VDP	N/A	https://www.cfa.gov/vulnerability-disclosure-policy
Commodity Futures Trading Commission	VDP	N/A	https://www.cftc.gov/vulnerability-disclosure-policy
Consumer Financial Protection Bureau	VDP	N/A	https://www.cfpb.gov/vulnerability-disclosure-policy
Consumer Product Safety Commission	VDP	N/A	https://www.cpsc.gov/vulnerability-disclosure-policy
Corporation for National and Community Service	VDP	N/A	https://americorps.gov/about/agency-overview/vulnerability-disclosure-policy
Council of the Inspectors General on Integrity and Efficiency	VDP	N/A	https://www.ignet.gov/vulnerability-disclosure-policy
Court Services and Offender Supervision Agency	VDP	N/A	https://www.csosa.gov/vulnerability-disclosure-policy
Defense Nuclear Facilities Safety Board	VDP	N/A	https://www.dnfsb.gov/vulnerability-disclosure-policy
Denali Commission	VDP	N/A	https://www.denali.gov/vulnerability-disclosure-policy
Department of Commerce	VDP	N/A	https://www.doc.gov/vulnerability-disclosure-policy
Department of Education	VDP	N/A	https://www.ed.gov/vulnerability-disclosure-policy
Department of Energy	VDP	N/A	https://doe.responsibledisclosure.com/hc/en-us
Department of Health and Human Services	VDP	N/A	https://www.hhs.gov/vulnerability-disclosure-policy
Department of Homeland Security	VDP	N/A	https://www.dhs.gov/vulnerability-disclosure-policy
Department of Housing and Urban Development	VDP	N/A	https://www.hud.gov/vulnerability-disclosure-policy
Department of Justice	VDP	N/A	https://www.justice.gov/vulnerability-disclosure-policy
Department of Labor	VDP	N/A	https://www.dol.gov/vulnerability-disclosure-policy
Department of State	VDP	N/A	https://www.state.gov/vulnerability-disclosure-policy/
Department of the Interior	VDP	N/A	https://www.doi.gov/vulnerability-disclosure-policy
Department of the Treasury	VDP	N/A	https://www.treasury.gov/vulnerability-disclosure-policy
Department of Transportation	VDP	N/A	https://www.dot.gov/vulnerability-disclosure-policy
Department of Veterans Affairs	VDP	N/A	https://www.va.gov/vulnerability-disclosure-policy
Election Assistance Commission	VDP	N/A	https://www.eac.gov/vulnerability-disclosure-policy
Environmental Protection Agency	VDP	N/A	https://www.epa.gov/vulnerability-disclosure-policy
Equal Employment Opportunity Commission	VDP	N/A	https://www.eeoc.gov/vulnerability-disclosure-policy
Export-Import Bank of the United States	VDP	N/A	https://www.exim.gov/vulnerability-disclosure-policy
Farm Credit Administration	VDP	N/A	https://www.fca.gov/vulnerability-disclosure-policy
Farm Credit System Insurance Corporation	VDP	N/A	https://www.fcsic.gov/vulnerability-disclosure-policy
Federal Communications Commission	VDP	N/A	https://www.fcc.gov/vulnerability-disclosure-policy
Federal Deposit Insurance Corporation	VDP	N/A	https://www.fdic.gov/policies/vulnerability/
Federal Energy Regulatory Commission	VDP	N/A	https://www.ferc.gov/vulnerability-disclosure-policy
Federal Housing Finance Agency	VDP	N/A	https://www.fhfa.gov/vulnerability-disclosure-policy
Federal Labor Relations Authority	VDP	N/A	https://www.flra.gov/vulnerability-disclosure-policy
Federal Maritime Commission	VDP	N/A	https://www.fmc.gov/vulnerability-disclosure-policy/
Federal Mediation and Conciliation Service	VDP	N/A	https://www.fmcs.gov/vulnerability-disclosure-policy
Federal Mine Safety and Health Review Commission	VDP	N/A	https://www.fmshrc.gov/vulnerability-disclosure-policy
Federal Retirement Thrift Investment Board	VDP	N/A	https://www.frtib.gov/vulnerability-disclosure-policy
Federal Trade Commission	VDP	N/A	https://www.ftc.gov/vulnerability-disclosure-policy
General Services Administration	VDP	N/A	https://www.gsa.gov/vulnerability-disclosure-policy
Harry S Truman Scholarship Foundation	VDP	N/A	https://www.truman.gov/vulnerability-disclosure-policy
Institute of Museum and Library Services	VDP	N/A	https://www.imls.gov/vulnerability-disclosure-policy
Inter-American Foundation	VDP	N/A	https://www.iaf.gov/vulnerability-disclosure-policy/
James Madison Memorial Fellowship Foundation	VDP	N/A	https://www.jamesmadison.gov/vulnerability-disclosure-policy
Japan-United States Friendship Commission	VDP	N/A	https://www.jusfc.gov/vulnerability-disclosure-policy
Marine Mammal Commission	VDP	N/A	https://www.mmc.gov/vulnerability-disclosure-policy/
Merit Systems Protection Board	VDP	N/A	https://www.mspb.gov/vulnerability-disclosure-policy/
Millennium Challenge Corporation	VDP	N/A	https://www.mcc.gov/vulnerability-disclosure-policy
Morris K. Udall and Stewart L. Udall Foundation	VDP	N/A	https://www.udall.gov/vulnerability-disclosure-policy
National Aeronautics and Space Administration	VDP	N/A	https://www.nasa.gov/vulnerability-disclosure-policy
National Archives and Records Administration	VDP	N/A	https://www.nara.gov/vulnerability-disclosure-policy
National Capital Planning Commission	VDP	N/A	https://www.ncpc.gov/vulnerability-disclosure-policy
National Council on Disability	VDP	N/A	https://www.ncd.gov/vulnerability-disclosure-policy
National Credit Union Administration	VDP	N/A	https://www.ncua.gov/vulnerability-disclosure-policy
National Endowment for the Arts	VDP	N/A	https://www.arts.gov/vulnerability-disclosure-policy
National Endowment for the Humanities	VDP	N/A	https://www.neh.gov/vulnerability-disclosure-policy
National Labor Relations Board	VDP	N/A	https://www.nlrb.gov/vulnerability-disclosure-policy
National Mediation Board	VDP	N/A	https://nmb.gov/NMB_Application/index.php/vdp/
National Science Foundation	VDP	N/A	https://www.nsf.gov/vulnerability-disclosure-policy
National Transportation Safety Board	VDP	N/A	https://www.ntsb.gov/Pages/vulnerability-disclosure-policy.aspx
Nuclear Regulatory Commission	VDP	N/A	https://www.nrc.gov/vulnerability-disclosure-policy
Nuclear Waste Technical Review Board	VDP	N/A	https://www.nwtrb.gov/vulnerability-disclosure-policy
Occupational Safety and Health Review Commission	VDP	N/A	https://www.oshrc.gov/vulnerability-disclosure-policy
Office of the Comptroller of the Currency	VDP	N/A	https://www.occ.gov/about/policies/vulnerability-disclosure-policy.html
Office of Government Ethics	VDP	N/A	https://www.oge.gov/vulnerability-disclosure-policy
Office of Navajo and Hopi Indian Relocation	VDP	N/A	https://www.onhir.gov/vulnerability-disclosure-policy
Office of Personnel Management	VDP	N/A	https://www.opm.gov/vulnerability-disclosure-policy
Office of Special Counsel	VDP	N/A	https://osc.gov/vulnerability-disclosure-policy
Peace Corps	VDP	N/A	https://www.peacecorps.gov/vulnerability-disclosure-policy/
Pension Benefit Guaranty Corporation	VDP	N/A	https://www.pbgc.gov/vulnerability-disclosure-policy
Postal Regulatory Commission	VDP	N/A	https://www.prc.gov/vulnerability-disclosure-policy
Presidio Trust	VDP	N/A	https://www.presidio.gov/presidio-trust/about/vulnerability-disclosure-policy
Privacy and Civil Liberties Oversight Board	VDP	N/A	https://www.pclob.gov/vulnerability-disclosure-policy
Railroad Retirement Board	VDP	N/A	https://www.rrb.gov/vulnerability-disclosure-policy
Securities and Exchange Commission	VDP	N/A	https://www.sec.gov/vulnerability-disclosure-policy
Selective Service System	VDP	N/A	https://www.sss.gov/vulnerability-disclosure-policy
Small Business Administration	VDP	N/A	https://www.sba.gov/vulnerability-disclosure-policy
Social Security Administration	VDP	N/A	https://www.ssa.gov/vulnerability-disclosure-policy
Social Security Advisory Board	VDP	N/A	https://www.ssab.gov/vulnerability-disclosure-policy
Surface Transportation Board	VDP	N/A	https://prod.stb.gov/vulnerability-disclosure-policy
Tennessee Valley Authority	VDP	N/A	https://www.tva.com/vulnerability-disclosure-policy
U.S. Section of International Boundary and Water Commission	VDP	N/A	https://www.state.gov/vulnerability-disclosure-policy/
United States AbilityOne Commission	VDP	N/A	https://www.abilityone.gov/laws,_regulations_and_policy/documents/
United States Access Board	VDP	N/A	https://www.access-board.gov/vulnerability-disclosure-policy
United States Agency for Global Media	VDP	N/A	https://www.usagm.gov/vulnerability-disclosure-policy/
United States Agency for International Development	VDP	N/A	https://www.usaid.gov/vulnerability-disclosure-policy
United States Commission on Civil Rights	VDP	N/A	https://www.usccr.gov/vulnerability-disclosure-policy
United States Department of Agriculture	VDP	N/A	https://www.usda.gov/vulnerability-disclosure-policy
United States Interagency Council on Homelessness	VDP	N/A	https://www.usich.gov/vulnerability-disclosure-policy
United States International Development Finance Corporation	VDP	N/A	https://www.dfc.gov/vulnerability-disclosure-policy
United States International Trade Commission	VDP	N/A	https://www.usitc.gov/vulnerability-disclosure-policy
United States Trade and Development Agency	VDP	N/A	https://www.ustda.gov/vulnerability-disclosure-policy
United States Courts	VDP	N/A	https://www.uscourts.gov/privacy-security-policy/vulnerability-disclosure-policy