Ada Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://www.ada.cx/legal/vulnerability-disclosure/
program:
  name: Vulnerability Disclosure Program
  type: vulnerability-disclosure
  platform: Bugcrowd
  access: private, invite-only
  bounty: false
  bounty_note: >-
    Ada states plainly: "Ada runs a Vulnerability Disclosure Program, which does not offer
    guaranteed rewards for submissions." Researchers who want in must email the security team
    with their profile and relevant experience.
policy:
- https://www.ada.cx/legal/vulnerability-disclosure/
contact:
- mailto:security@ada.cx
- mailto:security@ada.support
contact_note: >-
  The disclosure page publishes security@ada.cx. The security.txt read on 2026-07-11 published
  security@ada.support. Both are recorded; they are not asserted to be the same mailbox.
trust_center: https://security.ada.cx/
evidence:
- source: https://www.ada.cx/legal/vulnerability-disclosure/
  kind: disclosure policy page
  fetched: '2026-08-14'
  http_status: 200
  note: >-
    Plain curl against this origin returns 403 (bot challenge); the page was read with a
    rendering fetch.
- source: https://www.ada.cx/.well-known/security.txt
  kind: security.txt (live probe)
  fetched: '2026-07-11'
  http_status: 200
  reprobe:
    fetched: '2026-08-14'
    http_status: 403
    note: >-
      The marketing origin now bot-challenges unauthenticated clients, so the RFC 9116 document
      could not be re-read. The July result stands; it is not downgraded on the strength of a
      bot challenge.