Dolarapp Vulnerability Disclosure

generated: '2026-08-12'
method: searched
probe: true
source: https://www.arqfinance.com/en-MX/responsible-disclosure-policy
program: responsible disclosure
bug_bounty: false
policy:
- https://www.arqfinance.com/en-MX/responsible-disclosure-policy
contact:
- https://www.arqfinance.com/en-MX/responsible-disclosure-policy
- help@arqfinance.com
security_txt: false
scope: >-
  Any digital asset owned, operated or maintained by ARQ (formerly DolarApp), including
  public-facing websites.
intake: web form on the responsible disclosure policy page
commitments:
  researcher_principles: [trust, respect, transparency, common good]
  safe_harbor_stated: false
  bounty_stated: false
  disclosure_timeline_published: false
evidence:
- source: https://www.arqfinance.com/en-MX/responsible-disclosure-policy
  kind: disclosure-policy-page
  http_status: 200
  keywords: [responsible disclosure, security vulnerability, security researchers, scope]
- source: https://www.arqfinance.com/en-MX/legal
  kind: legal-index
  http_status: 200
notes: >-
  ARQ publishes a written responsible disclosure policy but no security.txt on its own
  hosts, no named bug-bounty platform (no HackerOne / Bugcrowd / Intigriti listing found),
  no published remediation SLA and no explicit safe-harbor clause. Reports are taken
  through a web form on the policy page rather than a dedicated security@ mailbox. The
  security.txt files served at status.dolarapp.com and help.arqfinance.com belong to
  Atlassian and Intercom respectively — see well-known/dolarapp-well-known.yml.