Elastic Stack (ELK Stack) · Vulnerability Disclosure

Elk Stack Vulnerability Disclosure

Vulnerability disclosure

Elastic Stack (ELK Stack) runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

AnalyticsLoggingMonitoringObservabilitySearchSecurityVector DatabaseSIEMMachine-Learning

Program: Hackerone security.txt present

Disclosure Policy

Policy

https://www.elastic.co/product-security

Policy

https://www.elastic.co/cloud/security

Security Contact

Contact

security@elastic.co

Source

Vulnerability Disclosure

generated: '2026-08-27'
method: searched
probe: true
source: >-
  https://api.elastic-cloud.com/.well-known/security.txt (HTTP 200,
  text/plain, saved verbatim as well-known/elk-stack-security.txt) and
  https://www.elastic.co/product-security (HTTP 200, reached via a 307 from
  https://www.elastic.co/community/security).
program: Elastic Vulnerability Disclosure Program
policy:
- https://www.elastic.co/product-security
- https://www.elastic.co/cloud/security
contact:
- security@elastic.co
pgp:
  fingerprint: 1224D1A572A73755B61A377B14D65EE0D2AE61D2
  source: security.txt Encryption field (openpgp4fpr) and the product-security page
bug_bounty:
  exists: true
  platform: HackerOne
  url: https://hackerone.com/elastic
  status: 200
  note: >-
    Email reports sent directly to security@elastic.co are accepted but are
    ineligible for a bounty — the HackerOne program is the paid channel.
disclosure_policy:
  model: Coordinated Vulnerability Disclosure
  detail: >-
    Elastic asks reporters not to publish details until it has researched and
    responded through its own channels. No formal safe-harbour legal language
    appears on the product-security page.
cve_numbering_authority: true
cve_note: Elastic is an authorized CVE Numbering Authority and issues its own CVE IDs.
advisories:
  format: Elastic Security Advisories (ESA)
  contents:
  - CVE ID
  - CVSS severity
  - affected versions
  - remediation
  forum: https://discuss.elastic.co/c/announcements/security-announcements/31
  rss: https://discuss.elastic.co/c/announcements/security-announcements.rss
security_txt:
  served: true
  host: api.elastic-cloud.com
  path: /.well-known/security.txt
  status: 200
  file: well-known/elk-stack-security.txt
  fields:
  - Contact
  - Encryption
  - Hiring
  - Policy
  rfc9116_gaps:
  - >-
      No `Expires` field. RFC 9116 makes it mandatory, so this file is a partial
      implementation.
  - >-
      Not served on www.elastic.co (404) or the apex elastic.co (404) — only on
      the Elastic Cloud control-plane host, which is the host a researcher is
      least likely to check first.
evidence:
- source: https://api.elastic-cloud.com/.well-known/security.txt
  status: 200
- source: https://www.elastic.co/product-security
  status: 200
- source: https://hackerone.com/elastic
  status: 200
- source: https://www.elastic.co/.well-known/security.txt
  status: 404

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/elk-stack-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.