M&T Bank is committed to ensuring the security of our customers by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how you should submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems in accordance with the guidelines below. Note: This is a Responsible Disclosure Program, which addresses technical vulnerabilities that could be exploited. For all customer service needs, please contact us. If you are reporting fraud or phishing, please call us at 1-800-724-2440.

Program Terms

• Your report is subject to HackerOne’s Vulnerability Disclosure Guidelines.
• Social engineering (e.g., phishing, vishing, smishing, tabnabbing) for the purposes of validating a vulnerability is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. You must only interact with accounts you own or with the explicit permission of the account holder.
• Comply with applicable federal, state, local, and international laws in connection with your participation in this Responsible Disclosure Program.
• M&T reserves the right to modify the terms of this policy or terminate the program at any time.

Researcher Responsibilities

By submitting a report to M&T you agree to adhere to the following guidelines:

• You are at least 18 years old;
• You are not located in or a resident of a country under United States sanctions, nor a person on, or working on behalf of a party identified on, any restricted party list maintained by the United States government;
• You consent to your information being stored and transferred to the United States and acknowledge that you have read and accepted the terms of this policy and HackerOne’s Vulnerability Disclosure Guidelines;
• You agree not to disclose vulnerability details to anyone other than M&T without first obtaining M&T’s written permission;
• You agree that your research will be conducted for testing and research purposes only, and that you will not attempt to gain access to customer or user accounts or M&T’s confidential information;
• Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else;
• You understand that nothing in this agreement, including submission of a report, shall be deemed to constitute the grant to you of any license or other right to any M&T or third-party product, service, patent, trademark, trade secret, or any other intellectual property; and
• By submitting a report to M&T Bank, you grant to M&T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.

Reporting Guidelines

Reporting a Vulnerability

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M&T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.

Create a Clear Report

In order to help us triage and prioritize submissions, we recommend that your reports:

• Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Describe the location the vulnerability was discovered and clearly describe the potential impact of the exploitation.
• Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
• Be in English, if possible.

Scope

The program scope includes any public-facing system owned, operated, or controlled by M&T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.

Out of Scope Vulnerabilities

• Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Large scale automated attacks using penetration testing software is prohibited.
• Denial of Service attacks are prohibited.
• Physical attacks are prohibited.
• Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Out of Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or brute-force issues on non-authentication endpoints.
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies.
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing.
• Open redirect - unless an additional security impact can be demonstrated.
• Issues that require unlikely user interaction.

In addition to the out-of-scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.

Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system out of scope that you think merits testing, please contact us to discuss it first. We may amend the scope of this policy over time.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Reporting a Vulnerability

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly-discovered vulnerabilities that affect all users of a product or service and not solely M&T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.

Response Targets

M&T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:

To the best of our ability, we will keep you informed about our progress throughout the process.

Authorization and Safe Harbor

Security research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. M&T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.

Questions

Please contact us with questions regarding this policy at [email protected]. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M&T Bank and our users safe!!