Department of Defense Sets Ground Rules for Hackers

The U.S. Department of Defense published a Vulnerability Disclosure Policy and launched a public bug bounty program (managed by HackerOne) to give security researchers a legal channel to report vulnerabilities in public-facing DoD systems; the policy restricts data exfiltration, phishing, and denial-of-service testing, offers recognition but not cash rewards for DoD findings, while the separate Hack the Army initiative may provide monetary bounties.