Allo Media Vulnerability Disclosure

generated: '2026-08-17'
method: searched
probe: true
source: https://uh.live/.well-known/security.txt
note: >-
  The provider publishes a valid RFC 9116 security.txt and it is captured verbatim
  at well-known/allo-media-security.txt (174 bytes, HTTP 200, text/plain, fetched
  2026-08-17). Both a machine-readable contact and a named policy URL are present,
  which is more than most providers of this size manage. Two contacts are listed —
  one on the new brand domain and one on the legacy Allo-Media domain — which is a
  useful signal that the rebrand's security intake was migrated rather than
  dropped.
disclosure_surface: true
policy:
- https://uh.live/security-policy
contact:
- mailto:security@uh.live
- mailto:security@allo-media.fr
preferred_languages:
- en
- fr
expires: '2027-05-01T00:00:00.000Z'
expires_valid: true
expires_note: >-
  Expires is 2027-05-01, comfortably in the future as of 2026-08-17, so the file
  is live rather than a stale artifact. RFC 9116 requires this field and a large
  share of published security.txt files fail it; this one passes.
rfc9116_fields:
  contact: true
  expires: true
  policy: true
  preferred_languages: true
  encryption: false
  acknowledgments: false
  canonical: false
  hiring: false
  csaf: false
rfc9116_assessment: >-
  Valid and minimal. Has the mandatory Contact and Expires plus Policy and
  Preferred-Languages. Missing the optional Encryption (no PGP key for reporters
  to encrypt a report with — notable for a company that documents GPG encryption
  for customer audio uploads), Canonical, Acknowledgments and CSAF fields.
bug_bounty:
  program: null
  platform: null
  found: false
  note: >-
    No HackerOne, Bugcrowd, Intigriti or YesWeHack program found for allo-media or
    uh!ive. Disclosure is direct-to-email against a self-hosted policy page.
evidence:
- source: https://uh.live/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
  content_type: text/plain
  bytes: 174
  body_captured: true
  file: well-known/allo-media-security.txt
  checked: '2026-08-17'
- source: https://uh.live/.well-known/agent-card.json
  kind: control probe
  http_status: 404
  checked: '2026-08-17'
  note: >-
    Recorded as the control proving the 200 above is a real served document rather
    than a catch-all answering every /.well-known/ path.
x-probe-conditions: >-
  The provider's OVH-hosted origins rate-limit aggressively: after a short burst
  of requests they refuse TCP 443 from the source IP for several minutes (curl
  exit 7). The capture above succeeded on a paced retry. Any future re-probe of
  this provider must space requests out or it will record false negatives.