Crowdtwist Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting/
api: Oracle CrowdTwist Loyalty and Engagement
summary: >-
  CrowdTwist itself publishes nothing — no security.txt, no disclosure page, no bug bounty on any
  crowdtwist.com host. Vulnerability handling for this product runs through Oracle's corporate
  program, which is the correct owner: Oracle acquired CrowdTwist in March 2019, operates it as
  Oracle CrowdTwist Loyalty and Engagement, hosts all of its documentation on the Oracle Help
  Center, and the crowdtwist.com corporate site now 301-redirects to oracle.com. That is the
  parent-brand case, and it is stated on Oracle's own pages.
program:
  published: true
  owner: Oracle Corporation (parent)
  scope_note: >-
    Oracle's program covers Oracle products and cloud services generally. It does not name
    CrowdTwist specifically, and there is no CrowdTwist-scoped disclosure page.
  reporting_page: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting/
  reporting_page_status: 200
  security_practices_page: https://www.oracle.com/corporate/security-practices/
  security_practices_page_status: 200
  contact: secalert_us@oracle.com
  bug_bounty: false
  bug_bounty_note: >-
    Oracle does not run a public bug bounty (no HackerOne, Bugcrowd or Intigriti program was
    found). Oracle's published position is that it does not pay for vulnerability reports.
  safe_harbor_published: false
  disclosure_model: coordinated disclosure via Oracle Critical Patch Update / Security Alert cycle
security_txt:
  published: false
  probes:
  - url: https://crowdtwist.com/.well-known/security.txt
    status: 301
  - url: https://api.crowdtwist.com/.well-known/security.txt
    status: 404
  - url: https://www.oracle.com/.well-known/security.txt
    status: 403
  note: >-
    No RFC 9116 security.txt is served on any CrowdTwist host, and Oracle's own corporate host
    returns 403 on that path, so no `SecurityTxt` pointer is wired.
pointer_note: >-
  A canonical `Security` pointer IS wired in apis.yml — the disclosure route for this product is
  real, published and reachable without credentials, it is simply Oracle's rather than
  CrowdTwist's. The parent-brand justification is recorded above per the ownership rule.