generated: '2026-09-05'
method: searched
source: >-
  https://www.citizensbank.com/account-safeguards/overview.aspx ("Security, Privacy and Legal", HTTP
  200 on 2026-09-05) links directly to https://citizensbank.responsibledisclosure.com/hc/en-us.
provider: Citizens Financial Group
providerId: citizens-financial-group
program:
  published: true
  name: Citizens Bank Responsible Disclosure
  url: https://citizensbank.responsibledisclosure.com/hc/en-us
  platform: ResponsibleDisclosure.com, operated by Synack
  type: vulnerability disclosure program (VDP)
  bounty: >-
    No. The published program guidelines prohibit "requesting compensation for time and materials or
    vulnerabilities discovered" - recognition and coordinated disclosure after a fix, not payment.
  coordinated_disclosure: >-
    A researcher who reports an in-scope, valid issue following program guidelines is recognized and
    is permitted to disclose the vulnerability after a fix has been issued.
  prohibited_activities:
    - Disruptive testing (DoS, or any action affecting confidentiality, integrity or availability).
    - Social engineering or phishing of customers or employees.
    - Requesting compensation for time, materials, or vulnerabilities discovered.
evidence:
  - url: https://www.citizensbank.com/account-safeguards/overview.aspx
    status: 200
    note: Citizens' own "Security, Privacy and Legal" page carries the outbound link to the program.
  - url: https://citizensbank.responsibledisclosure.com/hc/en-us
    status: 403
    note: >-
      Cloudflare interstitial ("Just a moment... Enable JavaScript and cookies to continue"). The
      page demonstrably exists - it is indexed and reachable in a browser - only our crawler was
      turned away. Not treated as dead.
security_txt:
  published: false
  note: >-
    /.well-known/security.txt returns 404 on citizensbank.com, www.citizensbank.com,
    developer.citizensbank.com and sandboxdeveloper.citizensbank.com (probed 2026-09-05, see
    well-known/). Citizens runs a disclosure program but does not advertise it at the RFC 9116 path,
    so an automated scanner will not find it. This is the single cheapest fix available to them.
related_pages:
  - {name: Account Security, url: 'https://www.citizensbank.com/account-safeguards/security.aspx', status: 200}
  - {name: Account Information Security, url: 'https://www.citizensbank.com/account-safeguards/account-information-security.aspx', status: 200}
  - {name: Cyber Security Center, url: 'https://www.citizensbank.com/learning/cyber-security-center.aspx', status: 200}
  - {name: Online Fraud Protection, url: 'https://www.citizensbank.com/account-safeguards/online-fraud-protection.aspx', status: 200}
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com