Buffer Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://buffer.com/security
url: https://buffer.com/security
name: Buffer responsible disclosure and reward program
summary: >-
  Buffer runs a self-hosted responsible-disclosure program with rewards, an
  acknowledgements wall, a defined report format, a GPG channel for sensitive
  material, and a published out-of-scope list. It is NOT on HackerOne or
  Bugcrowd (the pages at hackerone.com/buffer and bugcrowd.com/buffer are the
  platforms' generic external-program directory stubs, not a hosted Buffer
  program), and Buffer serves NO /.well-known/security.txt on any host —
  the mechanical probe found nothing, which is why this file is searched
  rather than probed-only.
policy:
  - https://buffer.com/security
contact:
  - security@buffer.com
encryption:
  gpg: on-request
  detail: >-
    "If you plan to provide access tokens, secure cookies or sensitive
    data/logs as an example, we kindly ask you to let us know and we will
    provide our GPG public key to you."
report_requirements:
  - A summary of the problem
  - 'A severity rating of 1 - 5 (1 being least severe, 5 being most, ie. you can easily hijack, impersonate or access any other account or data)'
  - A PoC or breakdown of how to replicate the issue
  - The operating system name and version, and the web browser name and version used to replicate
rewards:
  offered: true
  forms: [acknowledgement, swag, bounty money]
  detail: >-
    "For reports that are not common non-vulnerabilities, we like to reward
    those who responsibly disclose vulnerabilities with an acknowledgement,
    swag or bounty money."
  amounts_published: false
scope:
  excluded_subdomains:
    - jobs.buffer.com
    - journey.buffer.com
  excluded_classes: >-
    Buffer links to a published list of "common non-vulnerabilities that don't
    qualify for rewards."
acknowledgements:
  published: true
  detail: >-
    A named hall of fame is published on the same page, listing dozens of
    individual researchers and firms (e.g. Hacksclusive, Sakurity, Geeknik,
    Bugsgalore).
security_txt:
  served: false
  probed:
    - {url: 'https://buffer.com/.well-known/security.txt', status: 404}
    - {url: 'https://buffer.com/security.txt', status: 404}
    - {url: 'https://developers.buffer.com/.well-known/security.txt', status: 404}
    - {url: 'https://api.buffer.com/.well-known/security.txt', status: 401, note: gateway catch-all, not a document}
  gap: >-
    An RFC 9116 security.txt at https://buffer.com/.well-known/security.txt
    pointing Policy: at https://buffer.com/security and Contact: at
    mailto:security@buffer.com would make this program machine-discoverable at
    zero cost. This is the single cheapest security-surface fix available to
    Buffer.
third_party_platforms:
  hackerone:
    url: https://hackerone.com/buffer
    status: 200
    hosted_program: false
    note: >-
      Generic HackerOne external-program directory page — its own meta
      description says it "documents any known process for reporting a security
      vulnerability to Buffer". Not evidence of a HackerOne-managed program.
  bugcrowd:
    url: https://bugcrowd.com/buffer
    status: 200
    hosted_program: false
    note: Same shape as above; a directory entry, not a hosted program.
evidence:
  - {source: 'https://buffer.com/security', kind: disclosure-policy, fetched: '2026-08-13', http_status: 200, keywords: [reporting an issue, responsibly disclose vulnerabilities, bounty money, GPG, acknowledgements, security@buffer.com]}