Anew Vulnerability Disclosure

generated: '2026-09-04'
method: searched
source: https://github.com/round/anew.page/blob/main/SECURITY.md + https://github.com/round/anew.page/security/advisories
summary: >-
  anew publishes a vulnerability disclosure channel, but only in the repository — not at
  /.well-known/security.txt. SECURITY.md is a single line pointing at the repository's GitHub security
  tab, and GitHub private vulnerability reporting is enabled there, so a researcher does have a real,
  private, working route.
published: true
channel: github-private-vulnerability-reporting
policy_url: https://github.com/round/anew.page/security/policy
report_url: https://github.com/round/anew.page/security/advisories
security_md: https://github.com/round/anew.page/blob/main/SECURITY.md
security_md_content: https://github.com/round/anew.page/security
security_txt:
  published: false
  probed:
    - url: https://anew.page/.well-known/security.txt
      status: 404
    - url: https://www.anew.page/.well-known/security.txt
      status: 404
    - url: https://setup.anew.page/.well-known/security.txt
      status: 404
bug_bounty:
  published: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  note: No bounty program found.
contact_email: null
pgp_key: null
safe_harbor: null
disclosure_timeline: null
evidence:
  - url: https://github.com/round/anew.page/security/advisories
    status: 200
    note: >-
      Page offers "Report a vulnerability", confirming GitHub private vulnerability reporting is enabled
      on the repository rather than merely linked.
  - url: https://github.com/round/anew.page/security/policy
    status: 200
gaps:
  - >-
    No /.well-known/security.txt on any host. This is the one notable hole in an otherwise thorough
    well-known surface, and it is the file a scanner or an automated researcher looks for first. A
    three-line RFC 9116 file pointing at the existing GitHub advisories URL would close it.
  - No published contact email, PGP key, safe-harbor statement or response-time commitment.