Responsible Disclosure Program

Responsible Disclosure

At BlackRock, we take cybersecurity seriously and value the contributions of the security community at large. The responsible disclosure of potential issues helps us ensure the security and privacy of our customers and their data.

If you believe you have identified a potential security issue, please send it to us in accordance with our Responsible Disclosure Guidelines and include the following information:

  • A description of the issue and where it is located.
  • A description of the steps required to reproduce the issue.

Responsible Disclosure Guidelines

Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:

  • Do not engage in any activity that can cause harm to BlackRock, our customers, or our employees.
  • Do not engage in any activity that can stop or degrade BlackRock services or assets.
  • Do not initiate a fraudulent financial transaction.
  • Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets or systems reside, (ii) data traffic is routed or (iii) the researcher is conducting research activity.
  • Do not store, share, compromise or destroy BlackRock or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact BlackRock. This step protects any potentially vulnerable data, and you.
  • No automated scanning or testing.
  • Provide BlackRock reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.

By responsibly submitting your findings to BlackRock in accordance with these guidelines BlackRock agrees not to pursue legal action against you. BlackRock reserves all legal rights in the event of noncompliance with these guidelines.

Once a report is submitted, BlackRock commits to provide prompt acknowledgement of receipt of all reports and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.

Out of Scope Vulnerabilities

Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out-of-scope vulnerabilities include:

  • Physical testing
  • Social engineering or phishing
  • Denial of service attacks
  • Resource Exhaustion Attacks
  • Attacks requiring MITM or physical access to a user's device.

Submission Format

When reporting a potential vulnerability, please include a detailed summary of the vulnerability, including the target, steps, tools, and artifacts used during discovery (screen captures welcome).

Submission Instructions

BlackRock uses HackerOne to triage and validate responsibly disclosed vulnerability reports. Please submit your report via HackerOne - https://hackerone.com/blackrock

Submitting your report via HackerOne will help ensure timely validation. If you are unable to report via HackerOne, you may email us at responsible.disclosure@blackrock.com