generated: '2026-08-13'
method: searched
probe: true
source: https://www.ziffdavis.com/general/ziff-davis-responsible-vulnerability-disclosure-program
policy:
  - https://www.ziffdavis.com/general/ziff-davis-responsible-vulnerability-disclosure-program
  - https://bugcrowd.com/ziffdavis-vdp-pro
contact:
  - https://bugcrowd.com/ziffdavis-vdp-pro
security_txt:
  url: https://www.ziffdavis.com/.well-known/security.txt
  status: 404
  note: >-
    No RFC 9116 security.txt is served on ziffdavis.com. The disclosure program is
    published as an HTML page and a Bugcrowd engagement only, so an automated
    security.txt probe misses it entirely.
program:
  name: Ziff Davis Responsible Vulnerability Disclosure Program
  type: responsible-disclosure
  bug_bounty: false
  bounty_platform: bugcrowd
  platform_url: https://bugcrowd.com/ziffdavis-vdp-pro
  intake: >-
    Bugcrowd-hosted submission form. Ziff Davis states it uses the platform to
    triage, validate and respond to responsibly disclosed reports. No security@
    mailbox is published.
  scope_statement: >-
    "Potential security vulnerabilities relating to Ziff Davis' systems or
    products." No public in-scope / out-of-scope asset list, CVSS matrix or reward
    schedule is published on the ziffdavis.com page; the Bugcrowd brief is a
    client-rendered page (HTTP 200) whose scope table is not present in the served
    HTML.
  report_should_include:
    - >-
      The location of the vulnerability (endpoint or URL), which may require the
      software product name, version and platform, or the website address where the
      vulnerability can be observed
    - 'A brief description of the type of vulnerability, e.g. "XSS vulnerability on <domain name>"'
    - >-
      Steps to reproduce the vulnerability, as a benign, non-destructive proof of
      concept
  safe_harbour: >-
    Not stated on the Ziff Davis page. No legal-action commitment, no safe-harbor
    language and no reference to a standard framework appears in the published text.
governance_context:
  - >-
    The program is referenced from the corporate ESG page
    https://www.ziffdavis.com/esg-security under Proactive Risk Management, alongside
    the Corporate Audit Services function that reports to the Audit Committee.
evidence:
  - source: https://www.ziffdavis.com/general/ziff-davis-responsible-vulnerability-disclosure-program
    kind: vulnerability disclosure policy page (live probe)
    http_status: 200
  - source: https://bugcrowd.com/ziffdavis-vdp-pro
    kind: >-
      Bugcrowd engagement page, title "Vulnerability Disclosure: Ziff Davis
      Vulnerability Disclosure Program" (live probe)
    http_status: 200
  - source: https://www.ziffdavis.com/esg-security
    kind: corporate Data Privacy & Security page referencing the program (live probe)
    http_status: 200
  - source: https://bugcrowd.com/ziffdavis
    kind: >-
      NOT the program. This slug is an unrelated Bugcrowd researcher account
      (user_type "hacker", id 75007); the company engagement is ziffdavis-vdp-pro.
    http_status: 200
  - source: https://www.ziffdavis.com/.well-known/security.txt
    kind: security.txt probe — absent
    http_status: 404