UNICEF Information Security Hall of Fame

UNICEF’s Responsible Disclosure Policy 

UNICEF is committed to protecting children worldwide, and that commitment extends to securing our digital assets to strengthen the protection of our Information and Communications Technology infrastructure, UNICEF actively encourages the global security community to partner with us by responsibly disclosing vulnerabilities in our publicly accessible information systems.

We deeply value the expertise and contributions of security researchers in identifying potential security issues. This collaborative approach allows us to continuously improve our security posture and better safeguard our mission of helping children around the world.

This site provides guidelines for security researchers conducting vulnerability research and reporting, while also recognizing those who have made valuable contributions to our security efforts. Together, we can ensure that UNICEF's digital resources remain secure, allowing us to focus on what matters most — improving the lives of children everywhere.

Safe harbor

We follow safe harbor principles for security researchers who:

• Make good faith efforts to avoid privacy violations, destruction of data, and interruption or degradation of our services. This includes limiting access to sensitive data - if researchers discover a vulnerability allowing access to sensitive data, they may access a minimal amount necessary to verify findings, but must not download complete datasets
• Only interact with accounts they own or with explicit permission of the account holder
• Do not exploit a security issue they discover for any reason beyond verification
• Report vulnerabilities directly to us as soon as possible after its discovery
• Keep information about any vulnerabilities confidential until they have been resolved

As long as you comply with this policy:

• We will not initiate legal action related to your research
• We will work with you to understand and resolve the issue quickly
• We will recognize your contribution if requested