Clearspeed Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
program: Responsible Disclosure Program
published: true
policy:
- https://compliance.clearspeed.com/
policy_note: >-
  The program is published as a control narrative on the Clearspeed trust center
  (SafeBase). There is no standalone /security or /responsible-disclosure page on
  www.clearspeed.com, and no /.well-known/security.txt on any Clearspeed host.
statement: >-
  "Clearspeed is committed to maintaining the security and privacy of its systems and
  data, and encourages the security community to participate in its Responsible
  Disclosure Program. We welcome reports from security researchers who identify potential
  vulnerabilities in our products or infrastructure. Clearspeed asks that researchers
  follow responsible practices by reporting findings privately and in good faith, giving
  us reasonable time to investigate and remediate issues before public disclosure. In
  return, we commit to timely acknowledgment, transparent communication, and fair
  recognition of valid reports."
commitments:
- timely acknowledgment
- transparent communication
- fair recognition of valid reports
researcher_expectations:
- report findings privately and in good faith
- allow reasonable time to investigate and remediate before public disclosure
bug_bounty:
  present: false
  paid: false
  platform_flag: >-
    The trust center control record carries an integrations flag {"hackerone":
    {"allowed":true}}, meaning the SafeBase HackerOne integration is permitted on this
    control. No public HackerOne program page for Clearspeed was found, and the published
    text offers recognition rather than a bounty, so this is recorded as a coordinated
    disclosure program, not a paid bug bounty.
contact: []
contact_note: >-
  No security@clearspeed.com address, no PGP key and no dedicated submission form is
  published. Reports are routed through the trust center contact flow. This is the main
  gap in an otherwise real program — a researcher landing on www.clearspeed.com has no
  discoverable way to report.
security_txt:
  present: false
  probed:
  - {url: 'https://www.clearspeed.com/.well-known/security.txt', http_status: 404}
  - {url: 'https://clearspeed.com/.well-known/security.txt', http_status: 404}
  - {url: 'https://developer.clearspeed.com/.well-known/security.txt', http_status: 404}
  - {url: 'https://api.us.clearspeed.com/.well-known/security.txt', http_status: 404}
  - {url: 'https://api.uk.clearspeed.com/.well-known/security.txt', http_status: 404}
related_practices:
  penetration_testing: >-
    "Clearspeed conducts regular penetration testing to proactively identify and address
    security vulnerabilities within its software systems." Findings are triaged,
    prioritized and remediated with follow-up.
  vulnerability_management: >-
    Automated vulnerability scanning across cloud infrastructure; findings assessed and
    prioritized by severity and exploitability, critical items on an expedited track.
  sbom: >-
    Software Bill of Materials maintained to track components against CVE databases.
evidence:
- {source: 'https://compliance.clearspeed.com/', kind: trust-center-control, control: Responsible
    Disclosure, http_status: 200}
- {source: 'https://www.clearspeed.com/security-commitment', kind: marketing-security-page,
  http_status: 200, note: links to the trust center; does not itself name a disclosure
    program}
x-evidence:
  fetched: '2026-08-04'
cross_links:
  trust_center: security/clearspeed-trust-center.yml
  well_known: well-known/clearspeed-well-known.yml