generated: '2026-07-27'
method: searched
probe: true
source: https://www.neso.energy/.well-known/security.txt
description: >-
  NESO runs a published vulnerability disclosure policy (VDP), not a paid bug
  bounty. The policy is advertised via an RFC 9116 security.txt on the corporate
  host and reports are taken through an embedded HackerOne submission form. The
  policy page states explicitly that NESO does not offer monetary rewards.
policy:
  - https://www.neso.energy/responsible-disclosure
contact:
  - https://hackerone.com/53e3b347-8e91-4fba-bc3f-0fd3cb5b4275/embedded_submissions/new?locale=en
program:
  type: vulnerability-disclosure-policy
  platform: HackerOne (embedded submission form)
  paid_bounty: false
  monetary_rewards: false
  safe_harbour_stated: true
  expires: '2026-09-20T22:59:00+01:00'
response_targets:
  initial_response: 5 working days
  triage: 10 working days
  status_enquiry_cadence: no more than once every 14 days
  coordinated_disclosure: >-
    Requests to publicly disclose a resolved report are welcomed, but public
    release should be coordinated with NESO.
out_of_scope:
  - Denial of service, or any test that overwhelms a service with request volume
  - High-intensity invasive or destructive scanning
  - Modifying data in NESO systems or services
  - Non-exploitable findings and "not best practice" reports (e.g. missing security headers)
  - TLS configuration weaknesses (weak cipher suites, TLS 1.0 support)
  - Social engineering, phishing, or physical attacks on staff or infrastructure
evidence:
  - source: well-known/neso-security.txt
    kind: security.txt (saved verbatim from live probe)
  - source: https://www.neso.energy/.well-known/security.txt
    kind: security.txt (live probe, HTTP 200, text/plain)
  - source: https://www.neso.energy/responsible-disclosure
    kind: disclosure policy page (live probe, HTTP 200)