Responsible Disclosure Program

Compliancy with this program requires that you read the following carefully and abide by all of the specific scoping guidelines. Questions regarding these restrictions can be sent to: (Email) ResponsibleDisclosure@pnc.com.

When performing any actions relating to your vulnerability submission, PNC requires you act in accordance with the following guidelines. Engaging in any activities that are inconsistent with applicable laws or this program may subject you to criminal and/or civil liabilities. To remain in compliance with this program, you must not:

• Violate privacy.
• Negatively impact the user experience.
• Destroy or manipulate data.
• Use exploits unless they are absolutely necessary to confirm a vulnerability.
• Exfiltrate data under any circumstances, establish command line access and/or persistence, or "pivot" to other systems.
• Once you've established a vulnerability exists or encountered personally identifiable, financial, proprietary information, or trade secrets you must stop your test and notify PNC Security immediately.

Do not perform any of the following actions:

• Destruction, alteration, disclosure, or access denial of PNC or customer data.
• Causing or attempting to cause harm against PNC, PNC employees, affiliates, or customers.
• Denial of service testing.
• Social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing.
• Intentionally accessing any data or information being stored or transmitted by PNC with exception to what is absolutely necessary to validate the existence of the vulnerability.
• Exfiltration of data; customer, financial, intellectual property, personally identifiable or otherwise.
• Public disclosure of the vulnerability without written consent from PNC Financial Services.
• Intentional compromise of sensitive or confidential data, intellectual property, or financial interests of PNC, its third parties, or personnel.

STOP your activities and notify us immediately if you encounter any of the information below while testing within the scope of this program:

• Personally identifiable information.
• Financial information (e.g. credit card or bank account numbers).
• Proprietary information or trade secrets of companies of any party.

Responsible disclosure reports must be submitted by persons who are 18 years or older.

You must comply with all applicable laws and regulations. PNC Financial Services does not permit, allow, or authorize any actions that are inconsistent with this program. PNC Financial Services reserves all legal rights in the event of noncompliance with these guidelines.

If you make a good faith effort to comply with this program, we will work with you to understand and quickly resolve the issue, and PNC Financial Services will not recommend legal action in relation to your submitted vulnerability.

PNC Financial Services may modify this program and associated terms at any time.