This is a Responsible Disclosure Program Policy for security issues. If you need customer service needs, please contact us. If you are reporting fraud, phishing emails, or text scams, please call us at 1-800-724-2440.

M&T Bank is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers (also referred to in this document as ”you” and “your”) clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems.

This policy describes what systems and types of research are covered hereunder, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

Guidelines

• You are at least 18 years old;
• You are not located in or a resident of a country under United States sanctions, nor a person on, or working on behalf of a party identified on, any restricted party list maintained by the United States government;
• You consent to your information being stored and transferred to the United States and acknowledge that you have read and accepted the terms of this policy and HackerOne’s Vulnerability Disclosure Guidelines;
• You agree not to disclose vulnerability details to anyone other than M&T without first obtaining M&T’s written permission;
• You agree that your research will be conducted for testing and research purposes only, and that you will not attempt to gain access to customer or user accounts or M&T’s confidential information;
• Social engineering (e.g. phishing, vishing, smishing) is prohibited;.
• Large scale automated attacks using penetration testing software is prohibited;.
• Denial of Service attacks are prohibited;.
• Physical attacks are prohibited;.
• Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited;.
• You agree to mMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service;.
• You agree to oOnly interact with accounts you own or with explicit permission of the account holder; and.
• Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

Scope

The program scope includes any public-facing system owned, operated, or controlled by M&T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program.

Out of Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or bruteforce issues on non-authentication endpoints.
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies.
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version).
• Software version disclosure/Banner identification issues/Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing
• Open redirect - unless an additional security impact can be demonstrated.
• Issues that require unlikely user interaction.

In addition to the out of scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing.

 Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We may increase the scope of this policy over time.  

Authorization and Safe Harbor

Security research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

M&T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.

Questions

Please contact us with questions regarding this policy at support@hackerone.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M&T Bank and our users safe!!