Vulnerability Disclosure Program
Help us keep UNLV websites, applications, and services secure. If you discover a suspected security issue, report it to the Information Security Office so we can investigate and address it.
Reporting Guidelines
What You Can Do
- Report suspected security issues discovered through normal use or inadvertent discovery.
- Provide information that helps us understand and reproduce the issue.
- Stop and report the issue if you unintentionally encounter sensitive information.
What To Avoid
- Accessing, modifying, downloading, or deleting data that does not belong to you.
- Attempting to bypass authentication, authorization, or other security controls.
- Actions that could disrupt services or affect other users.
- Vulnerability scanning, penetration testing, exploitation, or other active security testing activities.
- Denial-of-service testing or attempts to impact system availability.
Submitting a report does not grant permission to test UNLV systems.
Keep Findings Confidential
Share information about potential security vulnerabilities only with UNLV. Do not publish technical details, screenshots, proof-of-concept code, or other information related to a reported issue. If you think a public disclosure is necessary, contact us first, and we will coordinate a response.
Good-Faith Reporting
UNLV will not pursue action against individuals who report suspected security issues in good faith and follow the reporting guidelines.
Compensation
UNLV does not offer cash rewards or other compensation for vulnerability reports.