Callrail Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://www.callrail.com/security/disclosure
description: >-
  CallRail runs a published Vulnerability Disclosure Program with submission guidelines and rules
  of engagement. It is explicitly NOT a bug bounty: "This program isn't intended to represent a
  public bug bounty program and we make no offers of reward or compensation for submitting
  potential issues." There is no HackerOne or Bugcrowd program (both probed, HTTP 404).
policy:
  - https://www.callrail.com/security/disclosure
contact:
  - legal@callrail.com
contact_note: >-
  Reports are submitted through the form on the disclosure page. legal@callrail.com is the address
  CallRail publishes for immediate contact if a researcher encounters protected information (PCI,
  PHI, PII) during testing.
bug_bounty:
  present: false
  rewards: false
  platforms_checked:
    - {platform: HackerOne, url: 'https://hackerone.com/callrail', http_status: 404}
    - {platform: Bugcrowd, url: 'https://bugcrowd.com/callrail', http_status: 404}
security_txt:
  present: false
  note: >-
    No /.well-known/security.txt (RFC 9116) on any CallRail host — api.callrail.com,
    apidocs.callrail.com and app.callrail.com all return 404; www.callrail.com returns 200 with the
    single-page-app HTML shell for every /.well-known/* path, which is not a document.
    See well-known/callrail-well-known.yml.
submission_guidelines:
  - Submit a clear, concise description of the issue, including a proof-of-concept URL and details of the systems tested.
  - Submit a clear, concise description of the steps needed to reproduce the issue.
  - Submit issues through the form rather than making them public (message boards, mailing lists, forums).
  - Wait for notification of resolution before disclosing to third parties.
rules_of_engagement:
  prohibited:
    - Activity that may cause an outage, stop services, or disrupt CallRail's services.
    - Harm to CallRail, its customers, shareholders, partners, or employees.
    - Unlawful activity (domestic or international).
    - Activity violating regulations (domestic or international).
    - Storing, sharing, compromising, or destroying CallRail or CallRail customer data.
    - Fraudulent activity or completing fraudulent financial transactions as part of testing.
  on_protected_data: >-
    If a researcher encounters protected information (PCI, PHI, PII), they are required to stop
    testing and immediately contact legal@callrail.com.
evidence:
  - source: https://www.callrail.com/security/disclosure
    kind: disclosure-page
    http_status: 200
    fetched: '2026-08-14'
  - source: https://www.callrail.com/security
    kind: security-policy-page
    http_status: 200
    fetched: '2026-08-14'
    note: Links "Submit a vulnerability" to the disclosure page.
  - source: https://trust.callrail.com/
    kind: trust-center-quick-link
    http_status: 200
    fetched: '2026-08-14'
    note: 'Quick link "Report a Vulnerability" -> https://www.callrail.com/security/disclosure'
x-evidence:
  fetch_note: >-
    callrail.com is an Angular/Builder.io SPA. A plain GET on any path returns the same 20,934-byte
    shell, so a naive probe scores 200 on paths that do not exist. The pages above were confirmed
    against CallRail's own prerendered responses (Prerender/Googlebot user agent), which returned
    distinct, real content: 46,791 bytes for /security/disclosure and 78,903 bytes for /security.