Cerby · Vulnerability Disclosure

Cerby Vulnerability Disclosure

Vulnerability disclosure

Cerby runs a coordinated vulnerability disclosure program on Hackerone.

IdentityAccess ManagementSecurityPassword ManagementProvisioningSCIMIdentity GovernanceNonfederated ApplicationsAutomationWebhook
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

cerby-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-08-09'
method: probed
probe: true
result: none
finding: >-
  Cerby publishes NO vulnerability disclosure channel that a researcher could
  find and use. This is a recorded negative, not an unchecked box.
policy: []
contact: []
bug_bounty: none
probes:
- url: https://www.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://cerby.com/.well-known/security.txt
  http_status: 404
- url: https://api.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://app.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://docs.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://developer.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://help.cerby.com/.well-known/security.txt
  http_status: 404
- url: https://www.cerby.com/security
  http_status: 200
  outcome: >-
    A Security Policy (contractual security addendum) with no reporting channel.
    Searched the body for "security@", "responsible disclosure", "bug bounty",
    "HackerOne", "Bugcrowd" — none present.
- url: https://trust.cerby.com/
  http_status: 403
  outcome: Cloudflare bot challenge; a disclosure policy may be published behind it but could not be read.
searched:
  bug_bounty_platforms: [HackerOne, Bugcrowd, Intigriti]
  result: no public Cerby program found
gap: >-
  An identity and credential-management vendor — a company whose product holds
  its customers' passwords, TOTP seeds, and vault material — publishes no
  security.txt and no public route for reporting a vulnerability. The Security
  Policy commits to remediating critical and high vulnerabilities within 30
  days, but does not say how anyone outside the company is supposed to report
  one. An RFC 9116 security.txt at https://www.cerby.com/.well-known/security.txt
  with a Contact: and Policy: field is the lowest-cost fix available to them.
x-evidence:
- url: https://www.cerby.com/.well-known/security.txt
  http_status: 404
  fetched: '2026-08-09'
- url: https://www.cerby.com/security
  http_status: 200
  fetched: '2026-08-09'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/cerby-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.