Emerge Vulnerability Disclosure

generated: '2026-08-12'
method: searched
probe: true
source: https://api.emergemarket.io/.well-known/security.txt
has_program: true
policy: []
contact:
- mailto:devsecops@emergemarket.com
security_txt:
  url: https://api.emergemarket.io/.well-known/security.txt
  file: well-known/emerge-security.txt
  rfc: RFC 9116
  status: 200
  content_type: text/plain; charset=utf-8
  fields:
    Contact: mailto:devsecops@emergemarket.com
    Expires: '2029-12-05T14:07:00Z'
  served_on:
  - https://api.emergemarket.io
  - https://demo-api.emergemarket.dev
  - https://app.emergemarket.io
  - https://api-docs.emergemarket.io
  - https://carrier-api-docs.emergemarket.io
  not_served_on:
  - https://www.emergemarket.com
  - https://emergemarket.com
  gaps:
  - "No Policy: field (no link to a disclosure policy)"
  - "No Encryption:, Acknowledgments:, Preferred-Languages: or Canonical: field"
  - Expires is set 3+ years out, well beyond the RFC 9116 recommendation of under a year
bug_bounty:
  platform: none
  probed: [HackerOne, Bugcrowd, Intigriti]
  result: no public program found
disclosure_page:
  url: null
  note: >-
    No /security, /responsible-disclosure or /vulnerability-disclosure page exists on
    www.emergemarket.com (all 404). The security.txt Contact address is the only published intake.
trust_center: security/emerge-trust-center.yml
evidence:
- source: https://api.emergemarket.io/.well-known/security.txt
  kind: security.txt
  status: 200
- source: https://www.emergemarket.com/security
  kind: disclosure-page
  status: 404
- source: https://www.emergemarket.com/.well-known/security.txt
  kind: security.txt
  status: 404