Responsible Disclosure Policy

The information on this page is intended for security researchers interested in reporting security vulnerabilities to the Personal Capital security team.

If you believe you've discovered a security vulnerability on a Personal Capital property or application, we strongly encourage you to inform us as quickly as possible and to not disclose the vulnerability publicly until it is fixed. We appreciate your assistance, and we review all reports and will do our best to address the issue in a timely fashion. To encourage responsible disclosure, Personal Capital will not seek judicial or law enforcement remedies against you for identifying security breaches, so long as the security and privacy of our users are not jeopardized. In order to facilitate an orderly exchange of research, we ask that you adhere to the following guidelines.