Cisco PSIRT openVuln API · Vulnerability Disclosure

Cisco Psirt Vulnerability Disclosure

Vulnerability disclosure

Cisco PSIRT is the team that OPERATES this API, so the disclosure programme and the product being catalogued are the same organisation. Cisco serves a real, PGP-clear-signed RFC 9116 security.txt at the corporate root whose Contact is psirt@cisco.com and whose Policy is the Cisco Security Vulnerability Policy, and the API's own GitHub repo carries a SECURITY.md with 24x7 emergency contact details.

Cisco PSIRT openVuln API runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

SecurityVulnerability ManagementThreat IntelligenceDisclosureComplianceNetworking
Program: Hackerone security.txt present

Disclosure Policy

Policy
https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
Policy
https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md

Security Contact

Contact
mailto:psirt@cisco.com

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-19'
method: searched
probe: true
source: https://www.cisco.com/.well-known/security.txt
description: >-
  Cisco PSIRT is the team that OPERATES this API, so the disclosure programme and
  the product being catalogued are the same organisation. Cisco serves a real,
  PGP-clear-signed RFC 9116 security.txt at the corporate root whose Contact is
  psirt@cisco.com and whose Policy is the Cisco Security Vulnerability Policy, and
  the API's own GitHub repo carries a SECURITY.md with 24x7 emergency contact
  details.
policy:
  - https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
  - https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
contact:
  - mailto:psirt@cisco.com
encryption:
  - https://cscrdr.cloudapps.cisco.com/cscrdr/security/center/files/Cisco_PSIRT_PGP_Public_Key.asc
canonical: https://www.cisco.com/.well-known/security.txt
expires: '2027-01-01T00:00:00.000Z'
signed: true
signature: PGP clear-signed (SHA256)
csaf: https://www.cisco.com/.well-known/csaf/provider-metadata.json
bug_bounty:
  program: null
  platform: null
  note: >-
    Cisco runs no public HackerOne / Bugcrowd / Intigriti bounty for this surface.
    Disclosure is direct to PSIRT by email or phone.
emergency_support:
  phone:
    - '+1 877 228 7302 (toll-free within North America)'
    - '+1 408 525 6532 (international direct-dial)'
  hours: 24 hours a day, 7 days a week
  source: https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
nonemergency_support:
  email: psirt@cisco.com
  acknowledgement: Typically acknowledged within 48 hours.
advisories: https://www.cisco.com/go/psirt
evidence:
  - source: https://www.cisco.com/.well-known/security.txt
    kind: security.txt
    http_status: 200
    fetched: '2026-08-19'
    file: well-known/cisco-psirt-security.txt
  - source: https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
    kind: repo-security-policy
    http_status: 200
    fetched: '2026-08-19'
  - source: https://www.cisco.com/.well-known/csaf/provider-metadata.json
    kind: csaf-provider-metadata
    http_status: 200
    fetched: '2026-08-19'
    file: well-known/cisco-psirt-csaf-provider-metadata.json
note: >-
  The automated probe (0-working/probe-security-programs.py) returned
  vdp=none because it only reaches the hosts named in apis.yml
  (developer.cisco.com), which serves no security.txt. This file is the SEARCHED
  upgrade: the document is served from www.cisco.com, which the security.txt itself
  names as its Canonical URI.