Customer Io Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://customer.io/legal/reporting-vulnerability
url: https://customer.io/legal/reporting-vulnerability
policy_published: true
security_txt: false
security_txt_evidence:
- url: https://customer.io/.well-known/security.txt
  status: 404
  checked: '2026-08-13'
- url: https://customer.io/security.txt
  status: 404
  checked: '2026-08-13'
- url: https://api.customer.io/.well-known/security.txt
  status: 404
  checked: '2026-08-13'
program:
  type: self-hosted reward program
  platform: null
  rewards: true
  reward_model: >-
    Monetary at Customer.io's discretion, scaled to severity. Reports that do
    not qualify may still earn merchandise if they cause Customer.io to change
    its security posture.
  first_reporter_only: true
  public_disclosure_rule: >-
    Bugs disclosed publicly without giving Customer.io reasonable time to
    respond are not rewarded.
scope:
  in_scope_product: Journeys
  in_scope_hosts:
  - fly.customer.io
  - track.customer.io
  out_of_scope:
  - Any host other than fly.customer.io and track.customer.io
  - Third-party applications that use Customer.io
  - Presence or absence of DMARC, SPF or other DNS records
  - Denial of service
  - Spam
  - Social engineering
  testing_rules:
  - Sign up with "Security Testing" appended to the Company Name, e.g. "Acme - Security Testing".
  - Test only against accounts and workspaces you created, or the published CTF workspace.
  - >-
    Limit scanner use to the actual stack — Node.js, Ember and REST APIs.
  - >-
    Disclose privately, allow reasonable time to respond, and avoid compromising
    other users' accounts.
  test_workspace:
    published: true
    workspace_id: '82491'
    admin_user: ctf@customer.io
    note: >-
      Customer.io publishes a capture-the-flag workspace for high-severity
      proofs of concept. The Site ID it publishes alongside these values is
      deliberately not mirrored into this catalog.
contacts:
  legal: legal@customer.io
  disclosure_page: https://customer.io/legal/reporting-vulnerability
  security_overview: https://customer.io/legal/security
  security_marketing: https://customer.io/security
evidence:
- source: https://customer.io/legal/reporting-vulnerability
  http_status: 200
  kind: vulnerability disclosure policy with reward program
  keywords:
  - responsibly disclosed vulnerabilities
  - reward program
  - in scope
  - out of scope
- source: https://customer.io/legal/security
  http_status: 200
  kind: security overview linking the disclosure policy
gap: >-
  The policy is thorough but undiscoverable by machine: there is no security.txt
  at any Customer.io host, so an automated scanner has no path from the domain
  to this page. RFC 9116 would cost one static file.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com