Checkly Vulnerability Disclosure

generated: '2026-08-29'
method: probed
source: >-
  https://developers.checklyhq.com/.well-known/security.txt (HTTP 200, saved verbatim to
  well-known/checkly-security.txt) and https://www.checklyhq.com/security/security-response/ (HTTP 200).
description: >-
  Checkly runs a published vulnerability disclosure programme reachable from a machine-readable
  security.txt. Automated probes miss it because it is not served from www, api or app - only the
  docs host answers.
published: true
security_txt:
  url: https://developers.checklyhq.com/.well-known/security.txt
  status: 200
  file: well-known/checkly-security.txt
  fields:
    contact: mailto:security@checklyhq.com
    preferred_languages: en
    canonical: https://checklyhq.com/.well-known/security.txt
    policy: https://www.checklyhq.com/security/security-response/
    hiring: https://checklyhq.com/jobs
  defect: >-
    The Canonical field points at https://checklyhq.com/.well-known/security.txt, which returned 404
    on probe. The document is only served from developers.checklyhq.com. www, api and app all 404.
    A scanner following RFC 9116 canonical resolution will conclude Checkly publishes nothing.
contact:
  email: security@checklyhq.com
  method: email
policy:
  url: https://www.checklyhq.com/security/security-response/
  status: 200
bug_bounty:
  program: none found
  platforms_probed:
  - HackerOne
  - Bugcrowd
  - Intigriti
  note: No bounty platform is referenced from security.txt, the security response page or the docs.
probes:
- {url: 'https://developers.checklyhq.com/.well-known/security.txt', status: 200}
- {url: 'https://checklyhq.com/.well-known/security.txt', status: 404}
- {url: 'https://www.checklyhq.com/.well-known/security.txt', status: 404}
- {url: 'https://api.checklyhq.com/.well-known/security.txt', status: 404}
- {url: 'https://app.checklyhq.com/.well-known/security.txt', status: 404}
- {url: 'https://www.checklyhq.com/security/security-response/', status: 200}
recommendation: >-
  Serving the same file at https://checklyhq.com/.well-known/security.txt and
  https://www.checklyhq.com/.well-known/security.txt would close the gap; the content is already
  correct and the Canonical field already names the right URL.