generated: '2026-07-27'
method: searched
probe: true
source: https://www.pge.com/en/about/company-information/vulnerability-disclosure-policy.html
description: >-
  PG&E publishes a full vulnerability disclosure policy for security
  researchers, covering authorization/safe-harbour, guidelines, prohibited test
  methods, scope, reporting channel and response commitments. It is NOT
  advertised through /.well-known/security.txt (RFC 9116) — that path returns
  HTTP 404 on www.pge.com, api.pge.com and sharemydata.pge.com — so the policy
  is discoverable only from the corporate site.
policy:
  - https://www.pge.com/en/about/company-information/vulnerability-disclosure-policy.html
contact:
  - mailto:pgecirt@pge.com
safe_harbor: >-
  "If we determine that you have made a good-faith effort to comply with this
  policy during your security research, we will consider your security research
  to be authorized ... and PG&E will not recommend legal action related to your
  security research performed in a manner that is consistent with this policy."
response_commitments:
  acknowledgement: Best-effort acknowledgement within three (3) business days.
  coordination: >-
    PG&E commits to confirming the vulnerability where possible and to being as
    transparent as it can about remediation steps and delays.
  anonymous_reports: Accepted.
bug_bounty:
  platform: none published
  monetary_awards: >-
    Discretionary. The policy states discretion over disclosure payments lies
    exclusively with PG&E, and that no payments will be issued to individuals on
    sanctions lists or in sanctioned countries. There is no HackerOne, Bugcrowd
    or Intigriti program.
prohibited_testing:
  - Network denial of service (DoS/DDoS) or other availability-impairing tests
  - Physical testing, social engineering (phishing, vishing) and other non-technical testing
  - Defacing or altering websites
  - Extortion of any kind
  - Creating an unreasonable number of accounts for testing
escalation: >-
  The policy notes reports may be shared with the Cybersecurity and
  Infrastructure Security Agency (CISA), and that PG&E will not share a
  reporter's name or contact information without express permission.
security_txt:
  served: false
  probed: '2026-07-27'
  probes:
    - {url: 'https://www.pge.com/.well-known/security.txt', status: 404}
    - {url: 'https://api.pge.com/.well-known/security.txt', status: 404}
    - {url: 'https://sharemydata.pge.com/.well-known/security.txt', status: 404}
evidence:
  - source: https://www.pge.com/en/about/company-information/vulnerability-disclosure-policy.html
    kind: disclosure-policy-page
    http_status: 200
    fetched: '2026-07-27'
    keywords: [vulnerability disclosure, security research, safe harbour, pgecirt@pge.com]
api_specific_contact: >-
  Share My Data platform issues (not security vulnerabilities) go to
  ShareMyData@pge.com per PG&E's third-party developer page.