Blue Prism Vulnerability Disclosure

generated: '2026-08-29'
method: searched
probe: true
source: https://www.blueprism.com/.well-known/security.txt
provider: Blue Prism
providerId: blue-prism
security_txt:
  url: https://www.blueprism.com/.well-known/security.txt
  http_status: 200
  saved: well-known/blue-prism-security.txt
  expires: '2027-08-28T19:24:13-05:00'
contact:
  - matthew@builtbymasonry.com
contact_note: >-
  The only Contact in security.txt is an individual address at builtbymasonry.com — a third-party
  web agency domain, not blueprism.com. A researcher reporting a vulnerability in Blue Prism
  Enterprise has no blueprism.com address to send it to from this file.
policy:
  - url: https://www.blueprism.com/security-policy
    http_status: 404
    status: dead
acknowledgements:
  - url: https://www.blueprism.com/hall-of-fame
    http_status: 404
    status: dead
encryption:
  - url: https://www.blueprism.com/pgp-key.txt
    http_status: 404
    status: dead
bug_bounty:
  published: false
  note: >-
    No HackerOne, Bugcrowd or Intigriti program was found for Blue Prism or SS&C Blue Prism.
finding: >-
  The security.txt file is SERVED and UNEXPIRED, but every optional URL it advertises is a 404 —
  Policy, Acknowledgements and Encryption all return 404 as of 2026-08-29. The file therefore
  documents a disclosure program whose published surface does not exist. Combined with a
  third-party agency contact address, an unauthenticated reporter following this file reaches
  nothing on a Blue Prism host. This is worth reporting back to the provider: three dead
  pointers and an off-domain contact are each a one-line fix.
related:
  security_program_page: https://www.blueprism.com/blue-prism-security/
  security_program_status: 200
  note: >-
    A real security program page DOES exist at /blue-prism-security/ (ISO 27001 and Cyber
    Essentials certificates, SAST, third-party vulnerability management). security.txt points at
    /security-policy instead, which does not.
evidence:
  - url: https://www.blueprism.com/.well-known/security.txt
    status: 200
  - url: https://www.blueprism.com/security-policy
    status: 404
  - url: https://www.blueprism.com/hall-of-fame
    status: 404
  - url: https://www.blueprism.com/pgp-key.txt
    status: 404
  - url: https://www.blueprism.com/blue-prism-security/
    status: 200
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com