Awin Affiliate Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.awin.com/.well-known/security.txt
description: >-
  Awin runs a private, invitation-based bug bounty on Intigriti and advertises it
  through an RFC 9116 security.txt served from three separate hosts. Researchers
  are asked to create an Intigriti account first and then email their
  @intigriti.me address to security-bugs@awin.com to be invited into the
  programme - so the programme itself is not publicly enumerable. The API host
  serves a DIFFERENT security.txt advertising an OpenBugBounty listing instead.
program:
  type: private bug bounty
  platform: Intigriti
  platform_url: https://www.intigriti.com
  invitation_required: true
  invitation_process: >-
    Create an Intigriti account, then send your @intigriti.me address to
    security-bugs@awin.com to be invited into the programme.
policy:
- https://www.awin.com/.well-known/security.txt
policy_text: >-
  To submit your findings please set up an account with www.intigriti.com. After
  you're done, send us your @intigriti.me address to security-bugs@awin.com so we
  can invite you into the program.
contact:
- mailto:security-bugs@awin.com
additional_programs:
- platform: OpenBugBounty
  url: https://openbugbounty.org/bugbounty/infosec_jma/
  advertised_on: https://api.awin.com/.well-known/security.txt
  note: >-
    Only the API host advertises this. The www and ui hosts do not mention
    OpenBugBounty at all - the three published security.txt documents disagree
    with each other, which is worth flagging to Awin.
security_txt_hosts:
- host: https://www.awin.com
  status: 200
  fields: [Contact, Policy]
- host: https://api.awin.com
  status: 200
  fields: [Contact, OpenBugBounty]
- host: https://ui.awin.com
  status: 200
  fields: [policy text only - no Contact: field]
rfc9116_gaps:
- No Expires field on any of the three documents (mandatory in RFC 9116).
- No Encryption, Acknowledgments, Preferred-Languages or Canonical fields.
- The ui.awin.com document is free text with no field syntax at all.
evidence:
- source: https://www.awin.com/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
- source: https://api.awin.com/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
- source: https://ui.awin.com/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
- source: well-known/awin-affiliate-security.txt
  kind: saved verbatim
x-evidence:
  fetched: '2026-08-13'