Responsible disclosure policy

Definitions

ExxonMobil

“ExxonMobil” means (a) ExxonMobil Holdings Corporation or any parent of ExxonMobil Holdings Corporation, (b) any company or partnership in which ExxonMobil Holdings Corporation or any parent of ExxonMobil Holdings Corporation now or hereafter, directly or indirectly (1) owns or (2) controls, more than fifty per cent (50%) of the ownership interest having the right to vote or appoint its directors or functional equivalents (“Affiliated Company”) and (c) any joint venture in which ExxonMobil Holdings Corporations, any parent of ExxonMobil Holdings Corporation or an Affiliated Company has day to day operational control.

Purpose

This responsible disclosure policy sets out the framework and procedure for someone reporting one or more vulnerabilities in any of ExxonMobil’s computer systems and networks (websites, applications, process control environments, etc). This policy does not grant authorization, permission, or otherwise allow express or implied access to ExxonMobil information systems to any individual, group of individuals, consortium, partnership, or any other business or legal entity.

This responsible disclosure policy is not a “Bug Bounty” program. The public is not encouraged or allowed to actively search for vulnerabilities in any ExxonMobil computer systems and networks. No monetary or other compensation will be offered or provided in connection with making reports hereunder.

ExxonMobil employs a range of practices and activities to protect the integrity, availability and confidentiality of our applications, computer systems, networks and the data within them.  If you have reason to believe there are potential vulnerabilities within any of our applications and systems, we encourage the finder to report these in line with this policy, such that we can take appropriate follow-up actions.

Contact and reporting

Vulnerability disclosures must be sent using the form.

If you believe you have found a security vulnerability, please submit your report via the below linked webform.

In your report, please include details of:

• The website, IP, page, system or network, etc. where you believe the vulnerability can be observed.
• A brief description of the vulnerability (for example; “XSS vulnerability”).
• Steps to reproduce – which should be benign, nondestructive, proof-of-concept steps to help us identify and triage the report accurately.

Click here to access the form.

Privacy policy

For details of our handling of any personal details we receive in connection with your report, please refer to our privacy policy available at: https://corporate.exxonmobil.com/global-legal-pages/privacy-policy. 

What you should do

• Report any suspected potential vulnerabilities as soon as possible after identifying them.
• Comply with all applicable laws and regulations when conducting any security research.
• Provide sufficient details to help us identify, reproduce and investigate the issue.  We may request additional information if needed.
• Maintain the confidentiality of any information you access or encounter during discovery or subsequent communications.
• Limit your exposure to any vulnerabilities discovered, including:
  • avoiding downloading data,
  • avoiding alerting data and/or configurations,
  • avoiding altering or interfering with the impacted systems and networks,
  • acting in good faith to avoid privacy violations, interruption or degradation of services.

What you cannot do

• Do not violate any applicable laws or regulations.
• Do not cause harm or damage to ExxonMobil, its systems, its customers or others.
• Do not compromise the privacy, safety, or security of ExxonMobil, its customers or any individual.
• Do not compromise the confidentiality, integrity, or availability of any ExxonMobil systems or networks.
• Do not access, download or view data which you are not authorized to access.
• Do not alter, delete or modify any data, systems, or services.
• Do not use high-intensity, invasive, or destructive tools or techniques to discover vulnerabilities.
• Do not conduct social engineering, ‘phishing’, impersonation or any physical security testing against ExxonMobil personnel, contractors or infrastructure.
• Do not disclose any vulnerability information publicly or with third parties without ExxonMobil’s written permission, even if you believe the vulnerability(ies) are already publicly known.

Our response

• After you have submitted a report, it will be reviewed and triaged according to our internal practices and procedures for addressing reports of suspected vulnerabilities.
• We may engage with you or contact you to seek additional information where we deem necessary to properly identify or address the potential vulnerability(ies).

Changes to this policy

We reserve the right to change this policy at any time and without notice.  When we make material changes to this policy it will be updated on our website.  We encourage you to review this policy for updates.

Page last updated: 8 September 2026