Doubleverify Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://trust.doubleverify.com/
program_advertised: true
policy_public: false
policy: []
contact: []
bug_bounty:
  platform: null
  url: null
  found: false
security_txt:
  served: false
  note: >-
    /.well-known/security.txt returns 404 on doubleverify.com, developer.doubleverify.com
    and trust.doubleverify.com. The one 200 in the estate is on status.doubleverify.com and
    it is Atlassian's signed file (Canonical https://www.atlassian.com/.well-known/security.txt,
    Contact security@atlassian.com) served by the Statuspage vendor — not DoubleVerify's,
    and not counted.
evidence:
- source: https://trust.doubleverify.com/
  kind: trust-center-control-listing
  http_status: 200
  finding: >-
    DoubleVerify's SafeBase trust centre lists "Responsible Disclosure" as a control under
    App Security. The program therefore exists and DoubleVerify says so publicly.
- source: https://doubleverify.com/.well-known/security.txt
  kind: rfc9116
  http_status: 404
- source: https://doubleverify.com/security
  kind: disclosure-page
  http_status: 404
- source: https://doubleverify.com/responsible-disclosure
  kind: disclosure-page
  http_status: 404
- source: https://doubleverify.com/vulnerability-disclosure
  kind: disclosure-page
  http_status: 404

pointer_decision:
  emit_vulnerability_disclosure: true
  emit_security: false
  rationale: >-
    The `Security` pointer that the security_disclosure check reads is DELIBERATELY
    WITHHELD. DoubleVerify advertises a Responsible Disclosure control on its trust centre,
    but the policy text, the reporting channel and the security contact are all behind
    SafeBase registration, and no security.txt, no public disclosure page and no bug-bounty
    listing exists anywhere in the estate. A researcher who finds a vulnerability today
    cannot reach DoubleVerify without first requesting access to a trust portal. That is
    the presence of a program, not the publication of a policy, so it is recorded as
    VulnerabilityDisclosure and not credited as a published security policy.
  remediation_for_provider: >-
    Serving an RFC 9116 /.well-known/security.txt on doubleverify.com with Contact and
    Policy fields — or ungating the Responsible Disclosure page — would close this
    immediately.

x-evidence:
  fetched: '2026-08-13'