Activecampaign Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://hackerone.com/activecampaign
description: >-
  ActiveCampaign runs a HackerOne program. The program page is a JavaScript shell, so a
  200 alone would not be evidence — the program was confirmed through HackerOne's own
  GraphQL endpoint, which resolves the handle to a real team, and against a control
  handle that 404s.
policy:
  - https://hackerone.com/activecampaign
contact: []
contact_note: >-
  No security@ address is published on activecampaign.com and no security.txt is
  served, so HackerOne is the only intake channel that can be confirmed. No contact
  address is asserted here.
security_txt:
  served: false
  probed:
    - {url: 'https://www.activecampaign.com/.well-known/security.txt', status: 404}
    - {url: 'https://developers.activecampaign.com/.well-known/security.txt', status: 404}
  note: >-
    RFC 9116 security.txt is absent on every reachable host. This is the cheapest
    disclosure fix available to ActiveCampaign — the program already exists, it is
    simply not machine-discoverable.
bug_bounty:
  platform: HackerOne
  handle: activecampaign
  url: https://hackerone.com/activecampaign
  offers_bounties: unknown
  offers_bounties_note: >-
    HackerOne's unauthenticated GraphQL response returns null for state,
    submission_state, policy and offers_bounties, so whether the program pays and
    whether it accepts public submissions cannot be established anonymously. Recorded
    as unknown rather than assumed.
security_page:
  url: https://www.activecampaign.com/security
  discloses_program: false
  note: >-
    The public security page describes controls (endpoint and network threat
    prevention, application firewalling, vulnerability scanning, secure SDLC) and names
    GDPR, SOC 2 and HIPAA, but does NOT link the HackerOne program or publish a
    disclosure address. A researcher landing on activecampaign.com/security has no path
    to report.
evidence:
  - {source: 'https://hackerone.com/graphql', kind: graphql-team-lookup, query: 'team(handle:"activecampaign")', result: '{"handle":"activecampaign","name":"ActiveCampaign"}', http_status: 200, fetched: '2026-08-13'}
  - {source: 'https://hackerone.com/activecampaign', kind: program-page, http_status: 200, fetched: '2026-08-13', note: 'SPA shell, 2,294 bytes. Treated as corroborating, not decisive.'}
  - {source: 'https://hackerone.com/zzz-not-a-real-program-xyz', kind: control, http_status: 404, fetched: '2026-08-13', note: 'Confirms HackerOne 404s unknown handles, so the 200 above is not a soft-404.'}
  - {source: 'https://www.activecampaign.com/security', kind: security-page, http_status: 200, fetched: '2026-08-13'}
  - {source: 'https://bugcrowd.com/activecampaign', kind: negative-probe, http_status: 404, fetched: '2026-08-13'}
  - {source: 'https://www.activecampaign.com/security/responsible-disclosure', kind: negative-probe, http_status: 404, fetched: '2026-08-13'}