generated: '2026-09-05'
method: searched
probe: true
source: https://www.transportation.gov/vulnerability-disclosure-policy
policy:
  - https://www.transportation.gov/vulnerability-disclosure-policy
contact:
  - DOT-VDP@dot.gov
scope_note: >-
  BTS SERVES NO POLICY ON ITS OWN HOSTS — the vulnerability disclosure policy that covers
  bts.gov is published by its parent department. The Bureau of Transportation Statistics is
  a statistical agency inside the U.S. Department of Transportation and bts.gov,
  data.bts.gov, geodata.bts.gov and transtats.bts.gov are DOT-operated information systems;
  the DOT policy states it exists so "DOT works to ensure a security conscious posture of
  DOT-operated information systems" and gives researchers guidelines for the systems in its
  Scope section. This is the parent-organization case the ownership rule allows, stated
  explicitly rather than assumed.
bug_bounty: false
disclosure_program: coordinated-vulnerability-disclosure
last_updated_by_publisher: '2026-03-03'
evidence:
  - source: https://www.transportation.gov/vulnerability-disclosure-policy
    kind: disclosure-page
    http_status: 403
    note: >-
      The live URL returns HTTP 403 Access Denied to this crawler from the same Akamai edge
      that blocks www.bts.gov. Existence and content were confirmed from the Internet
      Archive capture of 2026-08-27 (HTTP 200), which renders the full policy including the
      Scope, Reporting a Vulnerability and Disclosure sections and the DOT-VDP@dot.gov
      contact, and states "Last updated: Tuesday, March 3, 2026". A 403 from a bot-blocking
      edge is not a dead page.
  - source: https://www.transportation.gov/.well-known/security.txt
    kind: security.txt
    http_status: 403
    served: false
    note: >-
      NOT an RFC 9116 document. The archived capture (2026-02-01) of this path is a
      32-byte opaque validation token, not a security.txt. DOT has a VDP page but does not
      publish machine-readable security.txt, and neither does any BTS host — see
      well-known/bureau-of-transportation-statistics-well-known.yml, where the path 404s on
      data.bts.gov, geodata.bts.gov and www.transtats.bts.gov.
recommendation: >-
  A one-line /.well-known/security.txt on data.bts.gov and geodata.bts.gov pointing at the
  existing DOT policy would make this discoverable to a machine. The policy already exists;
  only the pointer is missing.