It's covered by the department of state's vulnerability disclosure program. As long as you don't do anything outside of the program guidelines you should be fine. https://hackerone.com/us-department-of-state/policy_scopes