generated: '2026-08-01'
method: searched
probe: true
source: https://morningconsult.com/security
policy:
- https://morningconsult.com/security
contact:
- security@morningconsult.com
security_txt: false
security_txt_note: /.well-known/security.txt returns 404 on morningconsult.com and
  api.morningconsult.com; the policy is published as a web page instead.
bug_bounty:
  offered: false
  statement: Morning Consult does not offer monetary rewards or bug bounties for
    vulnerability reports.
  platform: null
policy_summary: >-
  Morning Consult publishes a responsible-disclosure policy welcoming good-faith
  security research. It commits to maintaining confidentiality of reports, acknowledging
  reports promptly, and coordinating disclosure to protect customers. Scope is limited
  to publicly accessible Morning Consult owned domains and subdomains, web applications,
  APIs and services.
scope:
  in_scope:
  - Publicly accessible Morning Consult owned domains and subdomains
  - Web applications
  - APIs and services
commitments:
- Confidentiality of submitted reports
- Prompt acknowledgement of reports
- Coordinated disclosure to protect customers
evidence:
- source: https://morningconsult.com/security
  kind: disclosure page
  http_status: 200
  keywords:
  - vulnerability disclosure
  - responsible disclosure
  - security research
  - security@morningconsult.com
- source: security/morning-consult-trust-center.yml
  kind: trust center
  detail: https://trust.morningconsult.com/ (Vanta)