generated: '2026-08-28'
method: searched
probe: true
source: https://www.northwesternmutual.com/responsible-disclosure-policy/
program: Bugcrowd-managed responsible disclosure program
program_url: https://bugcrowd.com/engagements/northwestern-mutual-mbb-og
platform: bugcrowd
policy:
  - https://bugcrowd.com/engagements/northwestern-mutual-mbb-og
  - https://www.northwesternmutual.com/responsible-disclosure-policy/
contact:
  - https://bugcrowd.com/engagements/northwestern-mutual-mbb-og
  - mailto:security@northwesternmutual.com
scope: >-
  Stated on the responsible disclosure policy page as "information related to suspected
  security vulnerabilities of any Northwestern Mutual services exposed to the internet".
  No asset list, exclusion list or testing rules are published on the company's own page;
  those live on the Bugcrowd engagement.
safe_harbor: not-stated
  # The company's own responsible-disclosure page carries no explicit safe-harbor or
  # legal-protection language. Any such terms would be on the Bugcrowd engagement.
response_commitment: not-stated
rewards: not-stated
security_txt:
  url: https://www.northwesternmutual.com/.well-known/security.txt
  status: 200
  file: ../well-known/northwestern-mutual-security.txt
  expires: '2030-06-01T20:00:00.000Z'
  signed: false
  preferred_languages: en
  hiring: https://www.northwesternmutual.com/careers/
  deviations:
    - >-
      Served with Content-Type application/json instead of the text/plain required by
      RFC 9116 section 3.
    - >-
      Expires is set to 2030-06-01, roughly four years out. RFC 9116 section 2.5.5
      recommends a value less than a year in the future.
    - No Encryption field and no detached OpenPGP signature.
evidence:
  - source: https://www.northwesternmutual.com/.well-known/security.txt
    kind: security.txt (live probe)
    status: 200
    fetched: '2026-08-28'
  - source: https://www.northwesternmutual.com/responsible-disclosure-policy/
    kind: responsible disclosure policy page (live fetch)
    status: 200
    fetched: '2026-08-28'
  - source: https://bugcrowd.com/engagements/northwestern-mutual-mbb-og
    kind: Bugcrowd engagement page (live probe)
    status: 200
    fetched: '2026-08-28'