Cloudability · Vulnerability Disclosure

Cloudability Vulnerability Disclosure

Vulnerability disclosure

Cloudability publishes no vulnerability-disclosure document on any cloudability.com or apptio.com host. Disclosure runs through two published routes: a named Apptio security mailbox on the Apptio trust page, and IBM's corporate PSIRT programme (Cloudability is an IBM Apptio product), which operates a public HackerOne bug-bounty team and serves a conformant security.txt.

Cloudability runs a coordinated vulnerability disclosure program on Hackerone.

Cloud Cost ManagementCost OptimizationFinOpsMulti-CloudRecommendationsReporting

Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

specification: API Commons Vulnerability Disclosure
specificationVersion: '0.1'
provider: Cloudability
providerId: cloudability
generated: '2026-09-05'
modified: '2026-09-05'
method: searched
source: >-
  https://www.apptio.com/company/trust/ (Apptio Trusted Platform page) and the
  live security.txt at https://www.ibm.com/.well-known/security.txt, both
  fetched 2026-09-05.
description: >-
  Cloudability publishes no vulnerability-disclosure document on any
  cloudability.com or apptio.com host. Disclosure runs through two published
  routes: a named Apptio security mailbox on the Apptio trust page, and IBM's
  corporate PSIRT programme (Cloudability is an IBM Apptio product), which
  operates a public HackerOne bug-bounty team and serves a conformant
  security.txt.
program:
  published: true
  security_txt:
    served: true
    url: https://www.ibm.com/.well-known/security.txt
    host: www.ibm.com
    http_status: 200
    content_type: text/plain
    file: ../well-known/cloudability-security.txt
    expires: '2026-10-05T00:00:00+00:00'
    note: >-
      IBM corporate PSIRT security.txt. Not served on a cloudability.com or
      apptio.com host — those return 404 (www.apptio.com), redirects
      (cloudability.com, apptio.com), an SPA shell (app.cloudability.com) or a
      blanket 401 (api.cloudability.com).
  contacts:
    - type: email
      value: infosec@apptio.com
      source: https://www.apptio.com/company/trust/
      scope: Apptio / Cloudability product security
    - type: email
      value: psirt@us.ibm.com
      source: https://www.ibm.com/.well-known/security.txt
      scope: IBM corporate PSIRT
    - type: url
      value: https://www.ibm.com/trust/security-psirt
      source: https://www.ibm.com/.well-known/security.txt
      scope: IBM PSIRT policy and reporting page
  bug_bounty:
    platform: HackerOne
    url: https://hackerone.com/ibm?type=team
    http_status: 200
    verified: '2026-09-05'
    note: >-
      Published in IBM's security.txt Contact field. Covers IBM products; scope
      for Cloudability specifically is decided inside the HackerOne programme
      and is not stated in the security.txt.
  encryption_key: https://www.ibm.com/downloads/documents/us-en/15db45ee46d2037d
  acknowledgments: https://www.ibm.com/blogs/psirt/ibm-acknowledgement/
gaps:
  - >-
    No security.txt on any host a Cloudability API consumer would try first —
    api.cloudability.com, app.cloudability.com, www.cloudability.com or
    www.apptio.com. A researcher has to already know the product belongs to IBM
    to find the disclosure route.
  - >-
    The IBM security.txt Expires field is 2026-10-05, one month out from this
    probe. It is current, but it is the shortest-lived document in this record.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cloudability-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.