Choice Hotels International is one of the world's largest hotel franchisors with nearly 7,600 hotels across 22 brands in 46 countries and territories.
External Program
Submit bugs directly to this organization
At Choice Hotels International, we appreciate and encourage security researchers to contact us to report potential vulnerabilities identified in any product, system, or asset belonging to us. In support, we have established a Responsible Disclosure Policy, also called a Vulnerability Disclosure Policy. We will mature and revise this policy as we move forward into the future; please continue to check here for updates.
Thank you for notifying us about potential gaps in our security. We very much appreciate those of you who connect with us to rectify vulnerabilities to ensure the least amount of impact and risk to our stakeholder communities, and in support, we have established a Responsible Disclosure/Vulnerability Disclosure Policy.
We will not pursue legal action, nor initiate a complaint to law enforcement, against the finder/researcher operating in good faith. However, Choice Hotels International reserves all legal rights in the event of noncompliance to the Guidelines for Operating in Good Faith included in the Policy.
Please note, Choice Hotels International does not currently offer a "bug bounty" program; thus, we extend no offer of compensation/reward or public recognition for submittal of potential vulnerabilities.
To promote the discovery and reporting of vulnerabilities, we ask that you:
To disclose a potential vulnerability, please email the Information Security and Privacy Teams: [email protected]
When reporting a potential vulnerability, please include a detailed description of the vulnerability: tools utilized, target, processes, and results. Please support your findings by attaching any pertinent artifacts used for discovery. Though not required for review and validation/verification of the vulnerability, if you have information regarding the remediation of the vulnerability, please share your proposed resolution.
When a report is received by the Information Security Team, an acknowledgement will be sent in reply to the sender within five business days. A follow-on request for further information may be sent as needed. After validation/verification of a vulnerability, a follow-up reply will be sent to the sender.
Choice Hotels International will not negotiate in response to a threat (e.g., we will not negotiate under threat of withholding, or threat of releasing the vulnerability to the public). That said, we dedicate our resources to work with you and ask that you allow us a reasonable amount of time for both the validation/verification and the resolution of the vulnerability before taking action to make it public.
Reporting of vulnerability information to other third parties/vendors will be determined at the discretion of Choice Hotels International.
The following are out of scope for submittal under the Responsible Disclosure Policy. Out-of-scope vulnerabilities include: