Blueconic Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.blueconic.com/trust-center
description: >-
  BlueConic publishes a vulnerability-reporting address and a documented handling process on
  its Trust Center and in the help center's penetration-testing guidelines. There is no bug
  bounty program and no RFC 9116 security.txt on any BlueConic-operated host.
policy:
  - https://www.blueconic.com/trust-center
  - https://support.blueconic.com/en/articles/266965-guidelines-for-penetration-tests
contact:
  - security@blueconic.com
process:
  acknowledgement: >-
    "Once the report has been submitted, you will receive a non-automated response to your
    initial contact within 24 hours, confirming receipt of your reported vulnerability."
  validation: >-
    BlueConic validates the report, works with the reporter for additional information where
    needed, and delivers the results of the initial investigation along with a plan for
    resolution.
  supporting_material_requested: proof-of-concept code, tool output
customer_penetration_testing:
  permitted: true
  advance_permission_required: true
  request_via: https://support.blueconic.com/en/articles/247573-contacting-support
  response_time: 48 hours
  constraints:
    - Only the specified BlueConic environment may be tested.
    - (D)DoS testing is not permitted.
    - BlueConic must obtain AWS permission before the test can take place; extensions require a new AWS approval.
  upstream_policies:
    - https://aws.amazon.com/security/penetration-testing/
    - https://aws.amazon.com/aup/
bug_bounty:
  program: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program was found for BlueConic. Note that
    support.blueconic.com/.well-known/security.txt DOES advertise bugcrowd.com/intercom —
    that is Intercom's program for Intercom's own help-center platform, not BlueConic's, and
    is not credited here. See well-known/blueconic-well-known.yml.
security_txt:
  present: false
  probed:
    - url: https://www.blueconic.com/.well-known/security.txt
      status: 404
    - url: https://rest.apidoc.blueconic.com/.well-known/security.txt
      status: 404
evidence:
  - source: https://www.blueconic.com/trust-center
    kind: trust-center
    http_status: 200
    keywords: [vulnerability disclosure, 'security@blueconic.com', security incident response plan]
  - source: https://support.blueconic.com/en/articles/266965-guidelines-for-penetration-tests
    kind: disclosure-page
    http_status: 200
    keywords: [suspected vulnerabilities, 'security@blueconic.com', 24 hours, penetration test]
checked: '2026-08-13'