generated: '2026-09-14'
method: searched
probe: true
source: https://www.adp.com/about-adp/data-security/vulnerability-disclosure.aspx
policy:
  - https://www.adp.com/about-adp/data-security/vulnerability-disclosure.aspx
report_form: https://www.adp.com/about-adp/data-security/vulnerability-disclosure-form.aspx
contact:
  - abuse@adp.com
contact_note: 'abuse@adp.com is ADP''s address for reporting suspicious/phishing email; vulnerability reports themselves go through the web form.'
bug_bounty:
  platform: null
  paid: false
  note: 'ADP names no bug-bounty platform — no HackerOne, Bugcrowd or Intigriti program. Reporting is direct, through ADP''s own form.'
pgp_key: null
security_txt:
  served: false
  probed:
    - {url: 'https://www.adp.com/.well-known/security.txt', status: 403, note: 'Akamai denies non-browser agents; no RFC 9116 document could be read'}
    - {url: 'https://developers.adp.com/.well-known/security.txt', status: 200, note: 'SPA catch-all — byte-identical to the negative control, not a document'}
    - {url: 'https://apps.adp.com/.well-known/security.txt', status: 404}
scope: 'any vulnerability found in ADP''s site, products or applications'
safe_harbor:
  offered: true
  text: >-
    "If this policy and ADP's procedures are followed, ADP pledges not to initiate legal action
    against researchers for penetrating or attempting to penetrate our systems, provided that the
    following conditions are met."
prohibited:
  - sharing, disclosing or publicising an unresolved vulnerability with third parties
  - denial of service, brute force or spam testing
  - accessing or attempting to access data that does not belong to you
  - testing with non-test accounts
  - data destruction
  - physical or electronic attacks and social engineering
adp_commitments:
  - timely acknowledgement of a report
  - an estimated remediation timeframe
  - notification when the issue is fixed
related:
  security_alerts: https://www.adp.com/about-adp/data-security/alerts.aspx
  client_best_practices: https://www.adp.com/about-adp/data-security/client-resources.aspx
evidence:
  - {source: 'https://www.adp.com/about-adp/data-security/vulnerability-disclosure.aspx', kind: disclosure-policy, fetched: '2026-09-14'}
  - {source: 'https://www.adp.com/about-adp/data-security.aspx', kind: security-program-page, fetched: '2026-09-14'}
note: >-
  0-working/probe-security-programs.py recorded vdp=none for this provider because www.adp.com
  answers 403 to the probe's user agent. The pages are live and were read with a browser user agent;
  this artifact is searched, not probed-negative.