Artsy Vulnerability Disclosure

generated: '2026-09-07'
method: searched
probe: true
source: >-
  https://www.artsy.net/llms.txt, https://developers.artsy.net/ (site footer),
  https://hackerone.com/artsy
note: >-
  probe-security-programs.py reported vdp=none because both surfaces are unreadable to an automated
  fetch: artsy.net/security sits behind a Cloudflare interstitial and hackerone.com/artsy renders
  client-side. Both were then confirmed by other means, recorded below with exactly what was and was
  not established. There is NO /.well-known/security.txt on any Artsy host.
policy:
  - url: https://www.artsy.net/security
    kind: security-page
    verified: link-only
    http_status: 403
    detail: >-
      Returns a Cloudflare "Just a moment..." challenge to an automated client, which per the pipeline
      contract is a bot challenge and not a dead page. The page is asserted to exist by Artsy itself in
      two first-party places: it is listed under "Buyer Resources & Policies" in
      https://www.artsy.net/llms.txt, and it is linked from the footer of every page on
      developers.artsy.net. The CONTENT of the policy could not be read in this pass.
  - url: https://hackerone.com/artsy
    kind: bug-bounty-platform
    verified: partial
    http_status: 200
    detail: >-
      A HackerOne team with handle "artsy" exists and resolves. Queried anonymously via
      hackerone.com/graphql it returns name "Artsy", the about line "Making the art world accessible to
      anyone with an internet connection." and an Artsy profile photo — so the team record is genuinely
      Artsy's, not a squat. HOWEVER policy, submission_state, offers_bounties and structured_scopes all
      return null/empty to an anonymous caller, which is the signature of a PRIVATE, invitation-only
      program. No public disclosure policy or scope list is published there.
contact:
  - value: artsy-api-developers@googlegroups.com
    kind: mailing-list
    scope: API issues and 50x reports, per https://developers.artsy.net/v2/docs/errors
    note: This is the API support list, not a security contact.
security_txt:
  served: false
  probed_hosts: [artsy.net, www.artsy.net, api.artsy.net, developers.artsy.net, metaphysics-production.artsy.net, artsy.github.io]
  result: 404 on five hosts, 530 on the apex. See well-known/artsy-well-known.yml.
evidence:
  - {source: 'https://www.artsy.net/llms.txt', kind: first-party-index, detail: 'lists https://www.artsy.net/security'}
  - {source: 'https://developers.artsy.net/', kind: first-party-footer, detail: 'links https://artsy.net/security on every documentation page'}
  - {source: 'https://hackerone.com/graphql team(handle:"artsy")', kind: platform-record, detail: 'name "Artsy", Artsy about-line and profile photo; policy null'}
  - {source: '/.well-known/security.txt', kind: negative, detail: 'not served on any of six Artsy hosts'}
assessment: >-
  Artsy publishes a security page and runs a HackerOne program, so a disclosure channel exists. What it
  does NOT publish is a machine-readable one: no security.txt, no public policy text, no scope list.
  A researcher can find the door; an agent cannot.