Cadasto · Vulnerability Disclosure

Cadasto Vulnerability Disclosure

Vulnerability disclosure

Cadasto publishes a minimal but real RFC 9116 security.txt with a working contact address and a valid, non-expired Expires field. It does NOT publish a disclosure policy page, a safe harbour statement, a scope definition, a response SLA, or a bug bounty.

Cadasto runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

HealthcareHealth ITopenEHRElectronic Health RecordsClinical Data RepositoryInteroperabilityFHIRVendor Neutral ArchiveClinical DataAQLMCPAgent SkillsNetherlands

Program: Hackerone security.txt present

Disclosure Policy

Security Contact

Contact

mailto:security@cadasto.com

Source

Vulnerability Disclosure

generated: '2026-09-02'
method: searched
probe: true
source: >-
  https://www.cadasto.com/.well-known/security.txt (HTTP 200, text/plain, fetched 2026-09-02 —
  saved verbatim to well-known/cadasto-security.txt) and the identical document served at
  https://cadasto.io/.well-known/security.txt (HTTP 200). Corroborated by SECURITY.md files
  in the first-party GitHub repositories github.com/Cadasto/openehr-server-mcp,
  /openehr-sdk-go, /openehr-bmm and /openehr-assistant-plugin.
description: >-
  Cadasto publishes a minimal but real RFC 9116 security.txt with a working contact address and
  a valid, non-expired Expires field. It does NOT publish a disclosure policy page, a safe
  harbour statement, a scope definition, a response SLA, or a bug bounty.
contact:
- mailto:security@cadasto.com
expires: '2026-12-31T11:00:00.000Z'
expired: false
fields_present: [Contact, Expires]
fields_absent: [Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical, Hiring, CSAF]
hosts_serving:
- https://www.cadasto.com/.well-known/security.txt
- https://cadasto.io/.well-known/security.txt
bug_bounty:
  program: null
  platform: null
  evidence: >-
    No HackerOne, Bugcrowd or Intigriti program was found for cadasto.com or cadasto.io, and
    security.txt names no policy URL.
disclosure_policy_url: null
safe_harbour: false
repository_policy:
  present: true
  files:
  - https://github.com/Cadasto/openehr-sdk-go/blob/main/SECURITY.md
  - https://github.com/Cadasto/openehr-server-mcp/blob/main/SECURITY.md
  - https://github.com/Cadasto/openehr-bmm/blob/main/SECURITY.md
  - https://github.com/Cadasto/openehr-assistant-plugin/blob/main/SECURITY.md
evidence:
- source: well-known/cadasto-security.txt
  kind: RFC 9116 security.txt served at 200 on two hosts
  fetched: '2026-09-02'
gaps:
  - security.txt carries no Policy field, so a researcher has a contact address but no published
    scope, no disclosure timeline and no safe-harbour commitment.
  - Expires is 2026-12-31; the document will go stale in under four months.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cadasto-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.