Actively Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.actively.ai/responsible-disclosure
name: Actively Responsible Disclosure Policy
policy_url: https://www.actively.ai/responsible-disclosure
contact: security@actively.ai
scope: "*.actively.ai (connected services and vendor systems excluded)"
safe_harbor: true
bug_bounty: false
acknowledgement_sla: 5 business days
security_txt: false
security_txt_note: >-
  Probed 2026-08-13. /.well-known/security.txt returns HTTP 404 on
  www.actively.ai, api.actively.ai and auth.actively.ai. The disclosure policy
  exists in prose only and is not machine-discoverable per RFC 9116 — a
  low-cost gap, since the Contact and Policy fields are already written.
prohibited:
- network denial of service attacks
- physical testing
- social engineering (phishing)
reporting_requirements:
- vulnerability location
- potential impact
- reproduction steps
- remediation recommendations
notes: >-
  Good-faith research under the policy is considered authorized. Submitters
  acknowledge no expectation of payment; there is no paid bounty program.
evidence:
- source: https://www.actively.ai/responsible-disclosure
  kind: disclosure page
  http_status: 200
  keywords:
  - responsible disclosure
  - safe harbor
  - security contact
- source: https://www.actively.ai/security
  kind: security page
  http_status: 200
  keywords:
  - vulnerability disclosure
  - security@actively.ai
- source: https://www.actively.ai/.well-known/security.txt
  kind: rfc9116 probe
  http_status: 404
  fetched: '2026-08-13'
- source: https://api.actively.ai/.well-known/security.txt
  kind: rfc9116 probe
  http_status: 404
  fetched: '2026-08-13'