An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock
(
)
or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
As a U.S. government agency, we are committed to protecting the public’s information, including financial and personal information, from unauthorized disclosure.
Security researchers should feel comfortable reporting vulnerabilities discovered under this policy so we have the opportunity to remediate the findings and keep information safe.
This policy describes what systems and types of research we cover, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.
This policy applies to the systems in the “Scopes” section identified on the VDP Platform.
We exclude any services not expressly listed, including connected services, from this policy’s scope, and we do not authorize testing on them. Report vulnerabilities you find in vendors’ non-federal systems directly to the vendor according to their disclosure policy, if any. If you aren’t sure whether a system or endpoint is in scope, contact us at gsa-vulnerability-reports@gsa.gov before starting your research.
We do not authorize the following test types:
If you encounter any of the following on our systems while testing within the scope of this policy, stop your test and notify us immediately. Do not disclose any of the following to third parties:
Security researchers shall:
We commit to acknowledging receipt of the report within two business days via the CISA VDP Platform.
You must comply with all applicable federal, state, and local laws when conducting security research or otherwise participating in this vulnerability disclosure program.
We do not authorize, permit, or otherwise allow, expressly or impliedly, any individual, group, consortium, partnership, or other business or legal entity to engage in any security research, vulnerability, or threat disclosure activity that is inconsistent with this policy or the law. If you engage in activities inconsistent with this policy or the law, you may face criminal and or civil liability.
If your security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of an entity other than us, such as other federal departments or agencies; state, local, or tribal governments; private sector companies or individuals; or any other third party, that entity may independently decide whether to pursue legal action related to those activities.
If you conduct your research and disclosure activities in accordance with this policy:
Email vulnerability reports to gsa-vulnerability-reports@gsa.gov or submit them via the CISA VDP Platform.
Note: We do not support Pretty Good Privacy, or PGP-encrypted emails. Do not share sensitive information through email. If you believe it is necessary to share sensitive information with us, note this in your report, and we will contact you to establish a more secure method.
Include the following in your report:
Please keep your report current by sending us new information as it becomes available. We may share your vulnerability reports with the Cybersecurity and Infrastructure Security Agency, and any affected vendors or open source projects.
We are committed to patching vulnerabilities within 90 days or less and disclosing details once we publish patches. We believe public disclosure of vulnerabilities is an essential part of the vulnerability disclosure process, and one of the best ways to improve software is to let everyone learn from each other’s mistakes.
At the same time, disclosure without a readily available patch tends to increase risk rather than reduce it. We ask that you refrain from sharing your report with others while we work on a patch. If you believe others should be informed of your report before the patch is available, let us know so we can make arrangements.
We may want to coordinate an advisory to publish simultaneously with the patch, but you’re welcome to self-disclose if you prefer. By default, we prefer to disclose everything, but we will never publish information about you or our communications with you without your permission. In some cases, we may need to redact sensitive information, so please check with us before self-disclosing.
Error, The Per Diem API is not responding. Please try again later.
No results could be found for the location you've entered.
Rates for Alaska, Hawaii, and U.S. territories and possessions are set by the Department of Defense.
Rates for foreign countries are set by the Department of State.
Rates are available between 10/1/2024 and 09/30/2027.
The End Date of your trip can not occur before the Start Date.
Traveler reimbursement is based on the location of the work activities and not the accommodations, unless lodging is not available at the work activity, then the agency may authorize the rate where lodging is obtained.
Unless otherwise specified, the per diem locality is defined as "all locations within, or entirely surrounded by, the corporate limits of the key city, including independent entities located within those boundaries."
Per diem localities with county definitions shall include"all locations within, or entirely surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties, including independent entities located within the boundaries of the key city and the listed counties (unless otherwise listed separately)."
When a military installation or Government - related facility(whether or not specifically named) is located partially within more than one city or county boundary, the applicable per diem rate for the entire installation or facility is the higher of the rates which apply to the cities and / or counties, even though part(s) of such activities may be located outside the defined per diem locality.