Bluestacks Vulnerability Disclosure

generated: '2026-08-08'
method: probed
probe: true
source: https://payments-api.now.gg/.well-known/security.txt
summary: >-
  A genuine RFC 9116 security.txt is served from the now.gg Payments API host and
  names a security contact. It is EXPIRED — the Expires field is 2022-12-31, more
  than three years past — and it carries no Policy, Encryption, Preferred-Languages
  or Canonical field. No bug-bounty program (HackerOne / Bugcrowd / Intigriti) and no
  responsible-disclosure page were found on any bluestacks.com, now.gg or bluestacks.ai
  host.
contact:
- mailto:libin@bluestacks.com
policy: []
bug_bounty: []
security_txt:
  present: true
  url: https://payments-api.now.gg/.well-known/security.txt
  file: ../well-known/bluestacks-security.txt
  fields_present:
  - Contact
  - Expires
  fields_missing:
  - Policy
  - Encryption
  - Acknowledgments
  - Preferred-Languages
  - Canonical
  - Hiring
  expires: '2022-12-31T16:00:00.000Z'
  expired: true
  rfc9116_conformant: false
  deviations:
  - expired-Expires-field
  - no-Policy-field
  - served-only-from-the-payments-api-host-not-the-primary-domain
  - contact-is-a-named-individual-mailbox-not-a-role-address
evidence:
- source: https://payments-api.now.gg/.well-known/security.txt
  kind: security.txt
  http_status: 200
  content_type: text/plain; charset=utf-8
  fetched: '2026-08-08'
- source: https://www.bluestacks.com/.well-known/security.txt
  kind: security.txt
  http_status: 403
  note: edge blocks the /.well-known/ prefix on the primary domain
  fetched: '2026-08-08'
- source: https://now.gg/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-08'
recommendation: >-
  Publish a current security.txt at https://www.bluestacks.com/.well-known/security.txt
  and https://now.gg/.well-known/security.txt with a role address (security@), a
  Policy URL and a forward-dated Expires, and unblock the /.well-known/ prefix at the
  edge so RFC 8615 discovery works on the primary domain.