17Hats Vulnerability Disclosure

generated: '2026-08-05'
method: searched
probe: true
source: https://www.17hats.com/security
policy:
- https://www.17hats.com/security
contact:
- security@17hats.com
program:
  type: self-hosted bug bounty
  platform: none
  note: >-
    17hats runs its own reward program directly by email rather than through
    HackerOne, Bugcrowd or Intigriti. No safe-harbour language, scope statement,
    or PGP key is published on the page.
  reward_range_usd:
    min: 50
    max: 500
    basis: >-
      "depending on its severity, we will reward between $50 and $500 based on
      our discretion"
  response_window: up to 21 business days
security_txt:
  published: false
  note: >-
    No /.well-known/security.txt on www.17hats.com (404). The security.txt that
    returns 200 at help.17hats.com belongs to Intercom, the help-centre vendor
    (Canonical https://app.intercom.com/.well-known/security.txt), not to
    17hats. See well-known/17hats-well-known.yml.
evidence:
- source: https://www.17hats.com/security
  kind: disclosure page
  http_status: 200
  title: Security at 17hats
  keywords:
  - vulnerability
  - security@
  - reward
- source: https://www.17hats.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  finding: not published
gaps:
- No RFC 9116 security.txt at the canonical well-known path.
- No published scope, safe-harbour, or disclosure timeline commitment.
- No public CVE/advisory feed.