Feature

Vulnerability Disclosure & Bug Bounty

A published path for reporting security issues.

6 providers 12 APIs 4 declared variants

A security.txt, VDP, or bug-bounty program gives researchers a defined way to report vulnerabilities. Signals a provider that expects and handles security findings.

6 API providers on the APIs.io network offer vulnerability disclosure & bug bounty. The highest-rated are Packagist, Cybereason, BeyondTrust, Cresta, US Cyber Command.

Providers

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Developing 2 Usable, with meaningful gaps to close

PackagistPackagist is the default package repository for Composer, the PHP dependency manager. It indexes over 454,0...1 API42.2 CybereasonCybereason is an enterprise cybersecurity company (now part of LevelBlue) that provides a defense platform ...1 API39.9

Thin 2 Limited public surface area

BeyondTrustBeyondTrust is a cybersecurity company specializing in privileged access management (PAM) and vulnerability...6 APIs30.7 CrestaCresta (legally Cresta Intelligence, Inc.) is a Palo Alto, California enterprise Customer Experience AI com...1 API30.1

Emerging 2 Early or largely undocumented

US Cyber CommandUS Cyber Command (USCYBERCOM) is a Unified Combatant Command of the United States Armed Forces responsible ...2 APIs24.5 AxoniusAxonius is a cybersecurity asset management platform providing SaaS management, device discovery, and secur...1 API16.5

What Providers Actually Declared

This feature is a canonical term. These are the free-text strings providers wrote in their own apis.yml that map onto it.

Joint Cybersecurity AdvisoriesRFC 9116 security.txt with HackerOne submission form and PGP keySecurity advisories API aggregating FriendsOfPHP, GitHub Advisory Database, and PSA sourcesVulnerability Management

Scroll for all 4

Work with this as data

Every feature here is available over the APIs.io API and to AI agents over MCP. Features is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for features

3 MCP tools reach this

apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

Search the catalog

curl "https://apis.io/api/v1/search?q=vulnerability-disclosure&limit=10"

Everything under a tag

curl "https://apis.io/api/v1/tags/vulnerability-disclosure"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.