Alphaai Vulnerability Disclosure

generated: '2026-08-11'
method: searched
probe: true
source: https://api.alphai.io/.well-known/security.txt
description: >-
  A served RFC 9116 security.txt with two contact channels and a valid Expires
  date. There is no bug bounty and no separate disclosure-policy page — the
  security.txt IS the policy, and it names the scope explicitly, which is more
  than most providers of this size publish.

policy: []
policy_url: null
contact:
  - https://alphai.io/contact
  - mailto:support@alphai.io
expires: '2027-07-04T00:00:00.000Z'
preferred_languages: [en]
canonical: https://api.alphai.io/.well-known/security.txt

scope_declared:
  - api.alphai.io (REST API)
  - mcp.alphai.io (MCP server)
  - alphai.io (website)
note: >-
  The file's comment header names all three hosts as in scope. A declared scope
  in a security.txt is uncommon and genuinely useful to a reporter.

bug_bounty:
  present: false
  platform: null
  checked: [hackerone, bugcrowd, intigriti]

disclosure_pages_probed:
  - {url: 'https://alphai.io/.well-known/security.txt', status: 404}
  - {url: 'https://api.alphai.io/.well-known/security.txt', status: 200}
  - {url: 'https://mcp.alphai.io/.well-known/security.txt', status: 404}

evidence:
  - source: well-known/alphaai-security.txt
    kind: security.txt
    http_status: 200
    fetched: '2026-08-11'
    url: https://api.alphai.io/.well-known/security.txt

gaps:
  - >-
    The security.txt is served ONLY from the API host. RFC 9116 expects it at the
    canonical web domain; a researcher checking alphai.io/.well-known/security.txt
    — the obvious first place to look — gets a 404. The Canonical field is
    self-consistent, so this is a placement choice rather than an error, but it
    reduces the file's discoverability to nearly zero for a human reporter.
  - No Encryption, Acknowledgments, or Hiring fields.
  - No separate vulnerability-disclosure policy page describing safe harbour or response timelines.