AppliedAI (AAICO) · Vulnerability Disclosure

Aaico Vulnerability Disclosure

Vulnerability disclosure

AppliedAI (AAICO) runs a coordinated vulnerability disclosure program on Hackerone.

CompanyArtificial IntelligenceWorkflow AutomationAgentsEnterpriseDocument ProcessingRegulated IndustriesBusiness Process AutomationBankingInsuranceHealthcareMCPA2A

Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

generated: '2026-09-05'
method: probed
source: probe of /.well-known/security.txt across all ten known AAICO/Opus hosts
published: false
note: >-
  AAICO publishes NO vulnerability disclosure programme that a researcher can find by the standard
  routes. /.well-known/security.txt returns 404 on every host probed (aaico.com, www.aaico.com,
  opus.com, www.opus.com, developer.opus.com, operator.opus.com, status.opus.com, files.opus.com)
  and returns the SPA HTML shell — not a document — on app.opus.com and trust.opus.com. No
  security@ contact, disclosure policy page, or bug-bounty programme (HackerOne / Bugcrowd /
  Intigriti) was found. A Vanta trust center exists at trust.opus.com and is the only published
  security-contact surface, but it is client-rendered and advertises no disclosure policy in its
  served HTML.
security_txt: false
bug_bounty: false
bounty_platform: null
disclosure_policy_url: null
security_contact: null
x-evidence:
- url: https://www.opus.com/.well-known/security.txt
  status: 404
  fetched: '2026-09-05'
- url: https://developer.opus.com/.well-known/security.txt
  status: 404
  fetched: '2026-09-05'
- url: https://operator.opus.com/.well-known/security.txt
  status: 404
  fetched: '2026-09-05'
- url: https://www.aaico.com/.well-known/security.txt
  status: 404
  fetched: '2026-09-05'
- url: https://trust.opus.com/.well-known/security.txt
  status: 200
  fetched: '2026-09-05'
  note: 200 returns the Vanta SPA HTML shell for every /.well-known/* path — a catch-all, not a security.txt.
recommendation: >-
  For a company holding SOC 2 Type II and ISO 27001 and selling into banking, insurance and
  healthcare, an RFC 9116 security.txt on opus.com and aaico.com is the single cheapest gap to
  close here.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/aaico-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.