This is a Responsible Disclosure Program Policy for security issues. For all customer service needs, please contact us. 

M&T Bank is committed to ensuring the security of its customers by protecting their information. This policy is intended to give security researchers (also referred to in this document as ”you” and “your”) clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. We encourage you to contact us to report potential vulnerabilities in our systems.

Authorization and Safe Harbor

Security research activities conducted in good faith, and in a manner consistent with this policy, will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. 

Guidelines

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

This policy describes what systems and types of research are covered hereunder, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

Scope and Program Rules

The program scope includes any public-facing system owned, operated, or controlled by M&T Bank, Wilmington Trust, or their affiliates or subsidiaries, including web applications hosted on those sites. The assets specifically stated as in scope may be subject to change throughout the lifetime of this program. Your activities under this program include:

• Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Large scale automated attacks using penetration testing software is prohibited.
• Denial of Service attacks are prohibited.
• Physical attacks are prohibited.
• Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• If at any point you are uncertain whether to continue testing, please engage with us at responsibledisclosure@mtb.com.

Out of Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or bruteforce issues on non-authentication endpoints.
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies.
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version).
• Software version disclosure/Banner identification issues/Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Tabnabbing
• Open redirect - unless an additional security impact can be demonstrated.
• Issues that require unlikely user interaction.

In addition to the out of scope vulnerabilities listed above, any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at responsibledisclosure@mtb.com before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We reserve the right to modify the scope of this policy over time. 

M&T Bank does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) identified, outside of the program without express consent from M&T Bank.
• Follow the disclosure guidelines provided by HackerOne Inc.   

Reporting a vulnerability

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely M&T Bank, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.

M&T Bank will make a best effort to meet the following Service Level Agreements (SLAs) for those participating in our program:

To the best of our ability, we will keep you informed about our progress throughout the process.

We do not support PGP-encrypted emails. For particularly sensitive information, submit through this web form.

By submitting a report to M&T Bank, you grant to M&T Bank, its subsidiaries and its affiliates, a perpetual, irrevocable, no charge license to all intellectual property rights licensable by you in or related to the use of information or material submitted. You must notify us if any part of your report is not your own work or is the intellectual property of a third-party.

What we would like to see from you

In order to help us triage and prioritize submissions, we recommend that your reports:

• Describe the location the vulnerability was discovered and the potential impact of exploitation. 
• Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
• Be in English, if possible.

Questions

Questions regarding this policy may be sent to responsibledisclosure@mtb.com. We also invite you to contact us with suggestions for improving this policy. Thank you for helping keep M&T Bank and our users safe!