CrowdTwist · Vulnerability Disclosure
Crowdtwist Vulnerability Disclosure
Vulnerability disclosure
CrowdTwist runs a coordinated vulnerability disclosure program on Hackerone.
CompanyLoyaltyCustomer EngagementMarketingGamificationRewardsOracleCX MarketingLoyalty ProgramsPointsRetailCommerceSegmentationWebhookLoyalty & Incentives
Program: Hackerone
Disclosure Policy
Security Contact
Source
Vulnerability Disclosure
generated: '2026-08-13'
method: searched
source: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting/
api: Oracle CrowdTwist Loyalty and Engagement
summary: >-
CrowdTwist itself publishes nothing — no security.txt, no disclosure page, no bug bounty on any
crowdtwist.com host. Vulnerability handling for this product runs through Oracle's corporate
program, which is the correct owner: Oracle acquired CrowdTwist in March 2019, operates it as
Oracle CrowdTwist Loyalty and Engagement, hosts all of its documentation on the Oracle Help
Center, and the crowdtwist.com corporate site now 301-redirects to oracle.com. That is the
parent-brand case, and it is stated on Oracle's own pages.
program:
published: true
owner: Oracle Corporation (parent)
scope_note: >-
Oracle's program covers Oracle products and cloud services generally. It does not name
CrowdTwist specifically, and there is no CrowdTwist-scoped disclosure page.
reporting_page: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting/
reporting_page_status: 200
security_practices_page: https://www.oracle.com/corporate/security-practices/
security_practices_page_status: 200
contact: secalert_us@oracle.com
bug_bounty: false
bug_bounty_note: >-
Oracle does not run a public bug bounty (no HackerOne, Bugcrowd or Intigriti program was
found). Oracle's published position is that it does not pay for vulnerability reports.
safe_harbor_published: false
disclosure_model: coordinated disclosure via Oracle Critical Patch Update / Security Alert cycle
security_txt:
published: false
probes:
- url: https://crowdtwist.com/.well-known/security.txt
status: 301
- url: https://api.crowdtwist.com/.well-known/security.txt
status: 404
- url: https://www.oracle.com/.well-known/security.txt
status: 403
note: >-
No RFC 9116 security.txt is served on any CrowdTwist host, and Oracle's own corporate host
returns 403 on that path, so no `SecurityTxt` pointer is wired.
pointer_note: >-
A canonical `Security` pointer IS wired in apis.yml — the disclosure route for this product is
real, published and reachable without credentials, it is simply Oracle's rather than
CrowdTwist's. The parent-brand justification is recorded above per the ownership rule.
Work with this as data
Every security artifact here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for security posture
4 MCP tools reach this
find_securityBrowse and filter every security artifact in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This security artifact
curl "https://apis.io/api/v1/security/crowdtwist-vulnerability-disclosure"
All security posture
curl "https://apis.io/api/v1/security?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.