generated: '2026-07-27'
method: searched
probe: true
source: https://www.ferc.gov/vulnerability-disclosure-policy
policy:
  - https://www.ferc.gov/vulnerability-disclosure-policy
  - https://www.ferc.gov/sites/default/files/2025-03/Vulnerability%20Disclosure%20Policy.pdf
contact:
  - vdpfeedback@ferc.gov
document:
  title: Federal Energy Regulatory Commission Vulnerability Disclosure Policy (VDP)
  version: '3.0'
  issued: '2025-02-25'
  owner_office: FERC Cybersecurity and Information Assurance Division
  revision_history:
    - version: '1.0'
      date: '2021-03-01'
      note: Official release
    - version: '2.0'
      date: '2022-04-06'
      note: Updated to include additional system in scope
    - version: '3.0'
      date: '2025-02-25'
      note: Biennial review and update
authority:
  - CISA Binding Operational Directive 20-01
  - Federal Information Security Modernization Act (FISMA) of 2014, Pub. L. 113-283
  - OMB Circular A-130, Appendix III
  - 'U.S. DOJ, A Framework for a Vulnerability Disclosure Program for Online Systems'
  - 44 U.S.C. 3552(b)(1), 3553(b)(2), 3553(d)-(e), 3554(a)(1)(B)(ii)
scope:
  in_scope:
    - www.ferc.gov and its subdomains
    - www.eLibrary.ferc.gov and its subdomains
    - https://ferconline.ferc.gov/
  out_of_scope:
    - All other Commission applications
    - Connected services not expressly listed
    - Systems belonging to FERC vendors (report to the vendor)
  note: >-
    FERC states it "shall increase the scope of this policy over time" and invites researchers to
    contact vdpfeedback@ferc.gov before testing anything they are unsure about.
  api_coverage_gap: >-
    Neither API host profiled here is named in scope. api.data.ferc.gov and data.ferc.gov are
    subdomains of ferc.gov but not of www.ferc.gov as written, and ecollection.ferc.gov is not
    listed at all — so the two production APIs sit outside the literal wording of FERC's own VDP.
    Worth raising with FERC at the next biennial review.
safe_harbor:
  authorized: true
  text: >-
    "If researchers make a good faith effort to comply with this policy during their security
    research, the Commission shall work with researchers to understand and resolve the issue quickly.
    Should legal action be initiated by a third party against researchers for activities that were
    conducted in accordance with this policy, the Commission shall make this authorization known."
reporting:
  channel: email
  address: vdpfeedback@ferc.gov
  anonymous_reports_accepted: true
  acknowledgement_sla: 3 business days
  disclosure_expectation: >-
    Researchers must give FERC a reasonable amount of time to resolve the issue before disclosing
    publicly; no fixed embargo window is stated.
  wanted_in_a_report:
    - Location of the vulnerability and potential impact of exploitation
    - Detailed reproduction steps (proof-of-concept scripts or screenshots)
    - Reports written in English
  coordination: >-
    FERC may share reports affecting all users of a product with CISA, handled under CISA's
    coordinated vulnerability disclosure process. FERC will not share a researcher's name or contact
    information without express permission.
prohibited_testing:
  - Denial of service (DoS/DDoS) or anything impairing availability
  - Physical testing, social engineering, phishing, vishing
  - Full red-team penetration testing involving unauthorized access to servers
  - Using an exploit to exfiltrate data, establish persistent access, or pivot to other systems
  - High volumes of low-quality reports
bug_bounty:
  program: false
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program. No monetary reward. Coordinated disclosure by email
    only.
security_txt:
  published: false
  probed:
    - {url: 'https://www.ferc.gov/.well-known/security.txt', status: 404}
    - {url: 'https://ferc.gov/.well-known/security.txt', status: 404}
    - {url: 'https://data.ferc.gov/.well-known/security.txt', status: 404}
    - {url: 'https://api.data.ferc.gov/.well-known/security.txt', status: 404}
  note: >-
    BOD 20-01 requires a security.txt at the .well-known path for federal agency domains. FERC's
    policy exists and is thorough, but it is published as a PDF and is not machine-discoverable —
    the single cheapest fix available to FERC on this whole profile.
evidence:
  - source: https://www.ferc.gov/vulnerability-disclosure-policy
    kind: policy-page
    retrieved: '2026-07-27'
    note: >-
      Live page returns HTTP 403 to non-browser clients (Cloudflare interstitial); retrieved via the
      Internet Archive snapshot of 2026-07-02.
  - source: https://www.ferc.gov/sites/default/files/2025-03/Vulnerability%20Disclosure%20Policy.pdf
    kind: policy-pdf
    retrieved: '2026-07-27'
    note: Full 9-page policy document, read verbatim.
observations:
  - kind: anonymous-personal-data
    surface: GET https://ecollection.ferc.gov/api/PublicSubmissionHistory
    finding: >-
      Returns 37,588 filing records with no authentication, each carrying a filerEmail field with the
      individual filer's work email address. The filings themselves are public regulatory record; the
      bulk, unauthenticated, machine-readable email list is a harvesting surface FERC may not have
      intended. No individual is named anywhere in this repository, no example carries a real value,
      and no agent skill or MCP tool here is built on this endpoint.
    reported_to_ferc: false
  - kind: information-disclosure
    surface: ecollection.ferc.gov 404 responses
    finding: >-
      Routing-miss errors echo an internal origin URI (https://localhost:443/...) in the message body.
      Low severity, easily fixed.
  - kind: waf-status-mismatch
    surface: GET /api/TaxonomyHistory/TaxonomyPackage/{id}
    finding: >-
      A WAF interstitial ("The requested URL was rejected") is served with HTTP 200 and text/html,
      so naive clients treat a block as a success.