Criteo Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.criteo.com/.well-known/security.txt
contact:
- security@criteo.com
policy: []
policy_note: >-
  Criteo serves an RFC 9116 security.txt on three hosts, but it carries ONLY Contact,
  Preferred-Languages and Expires. There is no `Policy:` field, no `Encryption:`, no
  `Acknowledgments:` and no `Canonical:`. A researcher gets an email address and no published
  terms — no scope statement, no safe-harbour language, no disclosure timeline.

served_on:
- host: https://www.criteo.com
  path: /.well-known/security.txt
  status: 200
  expires: '2030-04-01T10:00:00.000Z'
- host: https://api.criteo.com
  path: /.well-known/security.txt
  status: 200
  expires: '2027-08-01T10:00:00.000Z'
- host: https://mcp.criteo.com
  path: /.well-known/security.txt
  status: 200
  expires: '2027-08-01T10:00:00.000Z'
- host: https://developers.criteo.com
  path: /.well-known/security.txt
  status: 404

expires_finding: >-
  The three served copies disagree. www.criteo.com declares Expires 2030-04-01 while
  api.criteo.com and mcp.criteo.com declare 2027-08-01. RFC 9116 says the Expires value should
  be less than a year out and that a file past its Expires must not be trusted; a 2030 date on
  the corporate host is nearly four years ahead and effectively disables the freshness signal.
  The two dates also indicate two separately-maintained files rather than one canonical
  document, which is what the `Canonical:` field exists to resolve.

bug_bounty:
  program: null
  probed:
  - {url: 'https://hackerone.com/criteo', status: 404}
  - {url: 'https://bugcrowd.com/criteo', status: 404}
  finding: >-
    No public bug bounty or coordinated-disclosure program was found on HackerOne, Bugcrowd or
    Intigriti, and no /responsible-disclosure page exists on criteo.com
    (https://www.criteo.com/responsible-disclosure/ returns 404).

security_pages:
- url: https://www.criteo.com/security/
  status: 200
- url: https://security.criteo.com/
  status: 200
  kind: trust center (SafeBase)
  detail: security/criteo-trust-center.yml

evidence:
- source: https://www.criteo.com/.well-known/security.txt
  kind: security.txt (live probe)
  status: 200
  fetched: '2026-08-13'
  fields: [Contact, Preferred-Languages, Expires]
- source: https://api.criteo.com/.well-known/security.txt
  kind: security.txt (live probe)
  status: 200
  fetched: '2026-08-13'
- source: https://mcp.criteo.com/.well-known/security.txt
  kind: security.txt (live probe)
  status: 200
  fetched: '2026-08-13'
- source: https://www.criteo.com/security/
  kind: security page
  status: 200
  fetched: '2026-08-13'

summary:
  security_txt: true
  hosts_serving: 3
  contact_published: true
  policy_published: false
  bug_bounty: false
  encryption_key: false
  canonical: false