# Looking for a security contact at quicken.com

**URL:** <https://community.disclose.io/t/looking-for-a-security-contact-at-quicken-com/369>\
**Category:** Hacker Connect\
**Created:** [December 22, 2021, 8:35pm UTC](https://community.disclose.io/t/looking-for-a-security-contact-at-quicken-com/369 "2021-12-22T20:35:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![blimmer](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/blimmer/32/265_2.png) [@blimmer](https://community.disclose.io/u/blimmer)\
**Post date:** [December 22, 2021, 8:35pm UTC](https://community.disclose.io/t/looking-for-a-security-contact-at-quicken-com/369/1 "2021-12-22T20:35:15Z")

</div>

I found a security vulnerability on [quicken.com](http://quicken.com) that I’m trying to responsibly disclose (CVSS 5.3). I sent an email to [security@quicken.com](mailto:security@quicken.com) on December 19, but I haven’t heard back from anyone yet. Does anyone have an idea on how to contact them?

---

<div class="post-metadata">

**Author:** ![sickcodes](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/sickcodes/32/29_2.png) [@sickcodes](https://community.disclose.io/u/sickcodes)\
**Post date:** [February 19, 2022, 10:31pm UTC](https://community.disclose.io/t/looking-for-a-security-contact-at-quicken-com/369/2 "2022-02-19T22:31:48Z")

</div>

I was just browsing through their support forum, they seem to monitor it well, for example:

Terms page mentions Secu\* around 18 times, but info.

Apparently they want postcards sent to: `* Developer Contact Info: Direct any questions, complaints or claims to: Quicken Inc., 3760 Haven Ave, Menlo Park, CA 94025 or visit https://www.quicken.com/ to access Support.`

But in all seriousness, the forum there seem monitored, I would even hijack the Morgan Stanley Security Enhancement thread, or create a new one:

> **[Upcoming Morgan Stanley Security Enhancements](https://community.quicken.com/discussion/7903400/upcoming-morgan-stanley-security-enhancements)**
>
> Starting 12/12/21 Morgan Stanley is enhancing security features, which requires Quicken users to enable access on Morgan Stanley to continue to download accounts and transactions in Quicken.

Examples

> **[Quicken](https://signin.quicken.com/signin?client_id=vanilla_sso&response_type=jwt&redirect_uri=https:%2F%2Fcommunity.quicken.com%2Fentry%2Fconnect%2FJWTSSO)**

I would reply to one of those threads, or post a new one.

Quicken is absolutely huge so this is a doozy, @caseyjohnellis you know anyone?

Sorry I didn’t see this earlier!

---

<div class="post-metadata">

**Author:** ![blimmer](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/blimmer/32/265_2.png) [@blimmer](https://community.disclose.io/u/blimmer)\
**Post date:** [February 19, 2022, 11:55pm UTC](https://community.disclose.io/t/looking-for-a-security-contact-at-quicken-com/369/3 "2022-02-19T23:55:53Z")

</div>

I was able to get in touch with them via DMing `@Quicken_Care` on Twitter.