Ahasend Vulnerability Disclosure

generated: '2026-08-30'
method: searched
probe: true
source: https://ahasend.com/responsible-disclosure
url: https://ahasend.com/responsible-disclosure
program:
  published: true
  type: responsible-disclosure
  bug_bounty: false
  platform: null
  note: >-
    AhaSend publishes a responsible-disclosure policy on its own domain and links to it from the
    security page. No bug-bounty platform (HackerOne, Bugcrowd, Intigriti) was found, and no
    monetary reward is advertised.
security_txt:
  served: false
  probes:
    - {url: 'https://ahasend.com/.well-known/security.txt', status: 404}
    - {url: 'https://api.ahasend.com/.well-known/security.txt', status: 404}
  remediation: >-
    Mirroring the existing policy at /.well-known/security.txt (RFC 9116) with Contact and Policy
    fields is a single-file change and is the one machine-readable path a scanner looks for.
disclosure_practice:
  note: >-
    AhaSend discloses fixed vulnerabilities in its public changelog rather than only privately —
    the July 2026 entry names two dashboard open-redirect issues, states that no customer data was
    accessible and that there was no indication of exploitation. That is voluntary transparency
    above what its peers publish.
  example: https://ahasend.com/docs/changelog.md
evidence:
  - source: https://ahasend.com/responsible-disclosure
    kind: disclosure page
    status: 200
    keywords:
      - vulnerability
      - responsible disclosure
      - security research
  - source: https://ahasend.com/security
    kind: security overview linking the disclosure policy
    status: 200
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com