Datavant Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://www.datavant.com/report-vulnerabilities
policy:
  - https://www.datavant.com/report-vulnerabilities
contact:
  - security@datavant.com
bug_bounty: null
safe_harbor: false
security_txt: false
note: >-
  Datavant publishes a dedicated "Report Software Vulnerabilities" page that names a single
  reporting channel - security@datavant.com - and defines what it considers a vulnerability.
  It stops there: no scope statement, no safe-harbor / authorized-testing language, no
  disclosure timeline or SLA, no PGP key, no bug-bounty program (HackerOne / Bugcrowd /
  Intigriti all absent), and no RFC 9116 security.txt is served on any Datavant host
  (www.datavant.com, api.datavant.io, developer.datavant.com and auth.datavant.com all
  return 404 for /.well-known/security.txt; api.datavant.com returns 403 to anonymous
  callers on every path). The page carries no publication or review date.
evidence:
  - source: https://www.datavant.com/report-vulnerabilities
    kind: disclosure-page
    http_status: 200
    quote: >-
      "To report a vulnerability to the Datavant Security team, please contact us at
      security@datavant.com."
    fetched: '2026-08-14'
  - source: https://www.datavant.com/wp-json/wp/v2/pages/871
    kind: disclosure-page-source
    http_status: 200
    note: Page content read from the site's own WordPress REST API to confirm the mailto target.
    fetched: '2026-08-14'
  - source: https://www.datavant.com/.well-known/security.txt
    kind: security.txt
    http_status: 404
    fetched: '2026-08-14'
  - source: https://auth.datavant.com/.well-known/security.txt
    kind: security.txt
    http_status: 404
    fetched: '2026-08-14'
  - source: https://api.datavant.io/.well-known/security.txt
    kind: security.txt
    http_status: 404
    fetched: '2026-08-14'
gaps:
  - No /.well-known/security.txt on any host, so the contact is not machine-discoverable.
  - No safe-harbor statement for good-faith researchers.
  - No stated acknowledgement or remediation timeline.