Dyspatch Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source:
- https://www.dyspatch.io/security.txt
- well-known/dyspatch-security.txt
contact:
- mailto:security@dyspatch.io
policy: []
policy_note: >-
  No Policy: field, no responsible-disclosure page, and no bug-bounty program.
  Probed hackerone/bugcrowd/intigriti presence and the usual disclosure paths
  (/security, /responsible-disclosure, /vulnerability-disclosure,
  /security-and-compliance, /data-security) — all 404 or redirect to unrelated
  pages (https://www.dyspatch.io/security/ 302s to /usage/, the acceptable-use
  page). The only published disclosure channel Dyspatch has is the email address
  in its security.txt.
security_txt:
  url: https://www.dyspatch.io/security.txt
  http_status: 200
  canonical_location: false
  canonical_expected: https://www.dyspatch.io/.well-known/security.txt
  canonical_status: 404
  fields_present: [Contact, Expires]
  fields_missing: [Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical,
    Hiring, CSAF]
  expires: '2024-11-16T19:16:00.000Z'
  expired: true
  expired_by_days: 635
  note: >-
    RFC 9116 says a security.txt whose Expires date has passed SHOULD NOT be
    used. This one expired on 2024-11-16 and has not been refreshed, and it is
    not at the /.well-known/ path a conforming client checks. The disclosure
    contact is therefore real but neither discoverable nor warranted current.
bug_bounty:
  present: false
  platforms_checked: [hackerone, bugcrowd, intigriti]
trust_center:
  present: false
  note: >-
    trust.dyspatch.io and security.dyspatch.io both resolve but redirect to the
    marketing homepage — they are wildcard DNS, not a trust center. No SOC 2,
    ISO 27001, PCI, HIPAA, FedRAMP or GDPR certification claim appears on the
    homepage, pricing page, privacy policy or terms of service. No `Compliance`
    or `TrustCenter` pointer is emitted, because there is nothing published to
    point at.
provider_fix:
  - Publish the file at /.well-known/security.txt as RFC 9116 requires.
  - Update the expired Expires value.
  - Add a Policy: URL describing how reports are handled and what is in scope.
evidence:
- source: https://www.dyspatch.io/security.txt
  kind: security.txt
  http_status: 200
- source: well-known/dyspatch-security.txt
  kind: security.txt (harvested copy)
x-evidence:
- url: https://www.dyspatch.io/security.txt
  http_status: 200
  fetched: '2026-08-13'
- url: https://www.dyspatch.io/security/
  http_status: 200
  fetched: '2026-08-13'
  note: redirects to https://www.dyspatch.io/usage/ (acceptable use policy), not a security page
- url: https://trust.dyspatch.io/
  http_status: 200
  fetched: '2026-08-13'
  note: redirects to the marketing homepage