generated: '2026-09-17'
method: searched
source: https://security.workday.com/.well-known/security.txt
program:
  published: true
  security_txt: https://security.workday.com/.well-known/security.txt
  security_txt_status: 200
  rfc: RFC 9116
  contact: https://hackerone.com/e83dc112-4739-4d96-bcc3-230aaacfe347/embedded_submissions/new
  platform: HackerOne (embedded submission form)
  expires: '2026-12-30T11:00:00.000Z'
  preferred_languages: en
  hiring: https://www.workday.com/en-us/company/careers/cybersecurity.html
  policy_url: https://hackerone.com/workday
  policy_url_status: 200
fields_absent:
  - Policy
  - Encryption
  - Acknowledgments
  - Canonical
note: >-
  Workday serves a valid RFC 9116 security.txt from its security subdomain (security.workday.com), not from
  the registrable domain - a probe of workday.com/.well-known/security.txt returns 404. The Contact line is a
  HackerOne embedded submission form; the public HackerOne profile at hackerone.com/workday describes the
  disclosure programme. No Policy, Encryption or Acknowledgments field is published.