Demostack Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://www.demostack.com/trust-center
policy:
  - https://www.demostack.com/trust-center
contact:
  - mailto:security@demostack.com
  - mailto:bug_bounty@demostack.com
program:
  type: vulnerability-disclosure-program
  name: Demostack Vulnerability Disclosure Program
  bug_bounty: false
  managed_platform: null
  statement: >-
    "Protecting your data is vital to our shared success. So to ensure the
    security of our systems, we maintain a Vulnerability Disclosure Program for
    ethical hackers to report potential bugs."
  report_to: mailto:bug_bounty@demostack.com
  note: >-
    Demostack runs the VDP itself over email. It uses HackerOne for regular
    penetration testing, but does not run a public HackerOne bounty program —
    no hackerone.com/demostack listing is linked from the trust center.
security_testing:
  penetration_testing:
    provider: HackerOne
    cadence: regular
    statement: '"We encrypt data at rest and in flight and use HackerOne for regular penetration tests."'
  continuous_scanning:
    tools:
      - Google Security Command Center
      - Snyk
    statement: >-
      "We use tools like Google's Security Command Center and Snyk to find and fix
      vulnerabilities and misconfigurations on a continuous basis."
security_txt:
  url: https://www.demostack.com/.well-known/security.txt
  http_status: 200
  contact: mailto:security@demostack.com
  expires: '2033-08-31T21:00:00.000Z'
  fields_present: [Contact, Expires]
  fields_missing: [Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical]
  note: >-
    RFC 9116 compliant but minimal — two fields, and no Policy line pointing at
    the trust center where the VDP is actually described.
evidence:
  - source: well-known/demostack-security.txt
    kind: security.txt
    url: https://www.demostack.com/.well-known/security.txt
    http_status: 200
  - source: https://www.demostack.com/trust-center
    kind: disclosure page
    http_status: 200
    keywords: [vulnerability disclosure program, ethical hackers, bug_bounty@demostack.com, hackerone]
  - source: https://www.demostack.com/security
    kind: security page
    http_status: 200