Auditoria Vulnerability Disclosure

generated: '2026-08-06'
method: searched
probe: true
source: https://www.auditoria.ai/trust/
policy: []
policy_page: https://www.auditoria.ai/trust/
contact:
  channel: email
  published_as: >-
    A "Report a Concern" link inside the "Report a Security Concern" section of the trust
    page. The address is served through Cloudflare email obfuscation
    (/cdn-cgi/l/email-protection) rather than as plain text, so it is reachable from a
    browser but not from a machine-readable fetch. Not decoded or recorded here.
  security_txt: false
bug_bounty:
  program: null
  platform: null
  found: false
findings:
  has_disclosure_invitation: true
  has_published_policy: false
  has_security_txt: false
  has_safe_harbor_language: false
  has_scope_definition: false
  has_response_sla: false
gaps:
  - No /.well-known/security.txt on any Auditoria host (RFC 9116) - probed www, app and auth, all 404.
  - >-
    The invitation to report is a single sentence and a mailto link; there is no published
    disclosure policy, no scope statement, no safe-harbor commitment and no response
    timeline, so a researcher has no stated terms to act under.
  - No public bug bounty or coordinated-disclosure program on HackerOne, Bugcrowd or Intigriti.
evidence:
- source: https://www.auditoria.ai/trust/
  http_status: 200
  kind: disclosure-invitation
  quote: >-
    "Report a Security Concern - As a leading software-as-a-service and platform-as-a-service
    provider, Auditoria is committed to setting the standard in safeguarding our environment
    and customers' data. Partner with us by reporting any security concerns."
- source: https://www.auditoria.ai/.well-known/security.txt
  http_status: 404
  kind: security.txt
- source: https://app.auditoria.ai/.well-known/security.txt
  http_status: 200
  kind: security.txt
  rejected: SPA catch-all returned the 1134-byte HTML application shell, not a security.txt
- source: https://auth.auditoria.ai/.well-known/security.txt
  http_status: 404
  kind: security.txt
x-evidence:
  checked: '2026-08-06'