Crossenagage Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://trust.spotler.com/responsible-disclosure
policy:
- https://trust.spotler.com/responsible-disclosure
contact:
- disclosure@spotler.com
- infosec@spotler.com
pgp: true
note: CrossEngage was acquired by Spotler and its disclosure programme runs at the Spotler Trust Center.
  The Responsible Disclosure page (fetched 2026-08-13, HTTP 200) asks researchers to report to disclosure@spotler.com,
  offers a PGP key for encrypted submissions, and sets out scope rules (no DDoS, no social engineering,
  no third-party data access, no public discussion before resolution). No public bug-bounty platform (HackerOne/Bugcrowd/Intigriti)
  is used.
security_txt:
  served: unverified
  note: 'https://crossengage.io/.well-known/security.txt 301s to https://spotler.com/.well-known/security.txt,
    which returns HTTP 403 behind a Cloudflare managed browser challenge on every attempt, including with
    a browser user-agent. We could not read a security.txt ourselves, so none is claimed and no SecurityTxt
    pointer is emitted. The provider hosts do not serve one: /.well-known/security.txt returns 404 on
    api.crossengage.io, api.documentation.crossengage.io, documentation.crossengage.io and app.crossengage.io.'
evidence:
- source: https://trust.spotler.com/responsible-disclosure
  kind: responsible-disclosure-page
  http_status: 200
  keywords:
  - responsible disclosure
  - disclosure@spotler.com
  - PGPKEY
  - report your findings
- source: https://trust.spotler.com/
  kind: trust-center-index
  http_status: 200
- source: https://spotler.com/.well-known/security.txt
  kind: security.txt
  http_status: 403
  keywords:
  - cloudflare managed challenge