generated: '2026-06-20'
method: searched
probe: true
source: https://www.nasa.gov/vulnerability-disclosure-policy/ + https://bugcrowd.com/nasa-vdp
policy:
  - https://www.nasa.gov/vulnerability-disclosure-policy/
  - https://bugcrowd.com/nasa-vdp
contact:
  - https://bugcrowd.com/nasa-vdp
program:
  type: vulnerability-disclosure
  platform: Bugcrowd
  bounty: false
  scope: All NASA-managed systems accessible from the internet, including registered domain names. NASA internal-only services are out of scope.
  acknowledgement_sla: within 3 business days
  policy_pdf: https://www.nasa.gov/wp-content/uploads/2025/02/vulnerability-disclosure-policy-1-5.pdf
notes: >-
  NASA operates a formal Vulnerability Disclosure Program (not a paid bug bounty).
  Reports are submitted through Bugcrowd; the agency acknowledges receipt within
  three business days and may share reports with CISA and affected vendors. No
  /.well-known/security.txt is published on api.nasa.gov (probed 404).
evidence:
  - {source: https://www.nasa.gov/vulnerability-disclosure-policy/, kind: disclosure-policy}
  - {source: https://bugcrowd.com/nasa-vdp, kind: bugcrowd-program}