Guidelines for Vulnerability Disclosure:

  1. Reporting: Submit Vulnerability Reports promptly via form.
  2. Provide Details: Please provide detailed information regarding the discovered vulnerability, including a description, steps to reproduce, and any supporting documentation.
  3. Confidentiality: Keep the details of the vulnerability confidential until KPMG has had sufficient time to address the issue. Please do not discuss any vulnerabilities (even resolved ones) without express consent from the organization
  4. Legal Conduct: Avoid engaging in any activity that could potentially harm KPMG, our users, or any third parties.
Report a Vulnerability Opens in a new window

Exclusions:

The following issues are considered out of scope:

  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
  • Attacks requiring MITM or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Rate limiting or bruteforce issues on non-authentication endpoints
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Tabnabbing
  • Open redirect - unless an additional security impact can be demonstrated
  • Issues that require unlikely user interaction
  • Spam or social engineering techniques.
  • Physical attacks against KPMG LLP (UK) offices or data centers.
  • Verbose error messages without proof of exploitability.

Acknowledgment:

KPMG acknowledges and appreciates the contributions of security researchers who responsibly disclose vulnerabilities. KPMG does not provide a bug bounty for vulnerability disclosure.

Updates to Policy:

KPMG reserves the right to modify this vulnerability disclosure policy at any time. Please check this page periodically for updates.

Thank you for helping keep KPMG and our users safe!