Bugsnag Vulnerability Disclosure

generated: '2026-09-17'
method: searched
source: https://docs.bugsnag.com/security/responsible-disclosure/
probe: true
policy_url: https://docs.bugsnag.com/security/responsible-disclosure/
report_url: https://smartbear.com/security/
http_status: 200
program: responsible disclosure (no public bug bounty)
bug_bounty: false
bounty_platforms_checked:
  - platform: HackerOne
    url: https://hackerone.com/smartbear
    status: 404
  - platform: Bugcrowd
    url: https://bugcrowd.com/smartbear
    status: 404
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt on any BugSnag or SmartBear host — see
  well-known/bugsnag-well-known.yml. The policy exists but is not machine
  discoverable.
commitments:
  - Initial confirmation of a report within 72 hours of submission.
  - No legal action pursued or supported in relation to conforming research.
  - Work with the reporter to understand and resolve the issue quickly.
researcher_requirements:
  - Avoid privacy violations, UX degradation, disruption of production systems and data destruction.
  - Stay within the published scope.
  - Use the identified communication channels.
  - Keep findings confidential for 90 days or until resolved.
scope:
  - https://www.bugsnag.com
  - https://app.bugsnag.com
  - https://api.bugsnag.com
  - https://notify.bugsnag.com
  - https://sessions.bugsnag.com
  - https://build.bugsnag.com
out_of_scope:
  - Services hosted by third-party providers.
  - Physical testing (office access, tailgating).
  - Social engineering (phishing, vishing).
  - Applications or systems not listed in scope.
  - UI/UX bugs and spelling mistakes.
  - Network-level Denial of Service (DoS/DDoS).
unwanted_data:
  - Personally identifiable information (PII)
  - Cardholder data
evidence:
  - source: https://docs.bugsnag.com/security/responsible-disclosure/
    kind: disclosure policy page
    http_status: 200
    probed: '2026-09-17'
  - source: https://smartbear.com/security/
    kind: parent-company security program and vulnerability submission
    http_status: 200
    probed: '2026-09-17'
gaps:
  - >-
    The published scope predates the current host set: it omits
    upload.bugsnag.com, otlp.bugsnag.com and bugsnag.mcp.smartbear.com, all of
    which are live authenticated ingest or agent surfaces.