Digital Asset Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
source: https://www.digitalasset.com/responsible-disclosure
policy:
- https://www.digitalasset.com/responsible-disclosure
contact:
- security@digitalasset.com
pgp_key: published on the responsible-disclosure page
bug_bounty: false
bug_bounty_note: >-
  Explicitly declined. The policy states "We do not offer a bug bounty program and
  compensation requests will not be considered."
safe_harbor: true
safe_harbor_text: >-
  "We won't take legal action against those who discover and report security vulnerabilities
  in accordance with this Responsible Disclosure Policy."
response_commitment: Investigation and response "as soon as possible, usually one business day."
reporting_channels:
- kind: email
  value: security@digitalasset.com
- kind: github-private-advisory
  product: Daml
  url: https://github.com/digital-asset/daml/security/advisories/new
- kind: github-private-advisory
  product: Canton Ledger
  url: https://github.com/digital-asset/canton/security/advisories/new
- kind: github-private-advisory
  product: Other Digital Asset Products and Services
  url: https://github.com/digital-asset/responsible-disclosure/security/advisories/new
- kind: github-private-advisory
  product: Canton Network and Splice
  url: https://github.com/canton-network/splice/security/advisories/new
out_of_scope:
- third-party SaaS vulnerabilities
- username enumeration
- HTTP header issues
- missing DMARC/SPF/DANE/CAA records
- OAuth misconfigurations
- logout CSRF
- EXIF vulnerabilities
- insecure SSL/TLS ciphers without a proof of concept
security_txt_published: false
gap: >-
  No RFC 9116 /.well-known/security.txt is served on digitalasset.com, docs.digitalasset.com
  or any api.utilities.* host, so the program above is not machine-discoverable. Publishing
  a security.txt with Contact: mailto:security@digitalasset.com and
  Policy: https://www.digitalasset.com/responsible-disclosure would close that gap.
evidence:
- source: https://www.digitalasset.com/responsible-disclosure
  http_status: 200
  kind: disclosure-policy-page
  keywords: [responsible disclosure, security@digitalasset.com, safe harbor, PGP]
- source: https://docs.digitalasset.com/registry/security/audits
  http_status: 200
  kind: docs-security-reporting-note
  quote: >-
    "Security Reporting: Found a potential vulnerability? Please do not open a public issue.
    Reach out directly to our security team at security@digitalasset.com."
- source: https://github.com/digital-asset/responsible-disclosure
  kind: dedicated-github-repo
  note: "Repo to accept Responsible Disclosure notification for Digital Asset products."
- source: /.well-known/security.txt
  http_status: 404
  kind: security-txt-absent
x-evidence:
  fetched: '2026-08-04'