generated: '2026-06-20'
method: searched
probe: true
source: https://www.microsoft.com/.well-known/security.txt
policy:
  - https://www.microsoft.com/en-us/msrc/cvd
  - https://www.microsoft.com/en-us/msrc/bounty/
  - https://www.microsoft.com/en-us/msrc/bounty-safe-harbor
contact:
  - https://msrc.microsoft.com/report/vulnerability/new
acknowledgments: https://msrc.microsoft.com/update-guide/acknowledgement
encryption: https://msrc.microsoft.com/.well-known/csaf/openpgp/998D7EC1A516E3D17FF90480EF148D3CDE714E0D.asc
csaf: https://msrc.microsoft.com/csaf/provider-metadata.json
bug_bounty:
  program: Microsoft Bug Bounty Program (includes Microsoft Azure bounty)
  url: https://www.microsoft.com/en-us/msrc/bounty
  azure_program: https://www.microsoft.com/en-us/msrc/bounty-microsoft-azure
evidence:
  - {source: 'https://www.microsoft.com/.well-known/security.txt', kind: security.txt}
  - {source: 'https://www.microsoft.com/en-us/msrc/cvd', kind: coordinated-vulnerability-disclosure-policy}
  - {source: 'https://www.microsoft.com/en-us/msrc/bounty', kind: bug-bounty}
notes: >-
  Microsoft Security Response Center (MSRC) runs coordinated vulnerability
  disclosure with legal safe harbor and a paid bug bounty covering Azure. The
  security.txt is served from www.microsoft.com and publishes CSAF advisories.