Amtrust Financial Services Vulnerability Disclosure

generated: '2026-09-02'
method: probed
source: >-
  https://amtrustfinancial.com/vulnerability-disclosure (HTTP 200, 4,924 bytes, empty body),
  /.well-known/security.txt on every AmTrust host (all 404), and searches of HackerOne, Bugcrowd and
  Intigriti — probed 2026-09-02
published: false
note: >-
  CORRECTION of a 2026-07-11 false positive. The earlier artifact recorded method `searched` with a
  disclosure page at https://amtrustfinancial.com/vulnerability-disclosure. That URL does return HTTP
  200 and IS linked from the amtrustfinancial.com footer, but the page is EMPTY: 4,924 bytes of Kentico
  ASP.NET WebForms scaffolding — viewstate, script resources, a form element — with no body content,
  no policy text, no scope, no safe-harbour language and no contact. Its <title> is the generic site
  title, not a page title. AmTrust has reserved the URL and linked it from every page of the site
  without publishing anything at it.
evidence:
- url: https://amtrustfinancial.com/vulnerability-disclosure
  status: 200
  bytes: 4924
  finding: >-
    Body renders to zero words of text after stripping script/style. No <h1>, no policy, no reporting
    address, no PGP key, no scope statement.
  linked_from: amtrustfinancial.com site footer
- url: https://amtrustfinancial.com/.well-known/security.txt
  status: 404
- url: https://amtrustfinancial.com/security.txt
  status: 404
- url: https://apiportal.amtrustgroup.com/.well-known/security.txt
  status: 404
- url: https://utapiportal.amtrustgroup.com/.well-known/security.txt
  status: 404
- url: https://gateway.amtrustgroup.com/.well-known/security.txt
  status: 404
- url: https://auth.amtrustgroup.com/.well-known/security.txt
  status: 404
bug_bounty:
  published: false
  programs_checked: [HackerOne, Bugcrowd, Intigriti]
  finding: No public program found for AmTrust Financial Services.
security_txt:
  served: false
  hosts_probed: 6
recommendation: >-
  The cheapest possible fix in this entire profile: AmTrust already links /vulnerability-disclosure from
  every page. Publishing actual policy text at that URL, plus an RFC 9116 /.well-known/security.txt
  carrying Contact and Policy fields, would turn a dead link into a working disclosure channel.
no_pointer_reason: >-
  No `Security` pointer is emitted in apis.yml because AmTrust publishes no disclosure policy. A pointer
  would assert a channel that does not exist.