Empatica Vulnerability Disclosure

generated: '2026-08-12'
method: probed
source: https://www.empatica.com/
name: Empatica coordinated vulnerability disclosure — probe result
found: false
program: none-published
description: >-
  Empatica publishes no coordinated vulnerability disclosure policy, no
  security.txt, and no bug bounty program that could be found. NO
  VulnerabilityDisclosure or Security pointer is emitted in apis.yml from this
  file, because the underlying thing does not exist.
false_positive_corrected:
  what: >-
    probe-security-programs.py recorded a hit on
    https://www.empatica.com/vulnerability-disclosure/ because the response was
    HTTP 200 and its body contained the keyword "vulnerability".
  why_it_is_wrong: >-
    www.empatica.com serves a Next.js catch-all that answers 200 with the same
    ~103KB HTML shell for every unknown path. The body of
    /vulnerability-disclosure/ is byte-identical to the body of the control probe
    /definitely-not-a-real-page-zzz9/ apart from the requested path being echoed
    back inside the page props — and that echoed path is the ONLY occurrence of
    the string "vulnerability" in the document. The keyword match was the URL
    reflecting itself.
  verified_on: '2026-08-12'
probes:
- {url: 'https://www.empatica.com/.well-known/security.txt', status: 200, verdict: soft-404-html-shell,
  document: false}
- {url: 'https://api.empatica.com/.well-known/security.txt', status: 404, document: false}
- {url: 'https://care.empatica.com/.well-known/security.txt', status: 200, verdict: soft-404-html-shell,
  document: false}
- {url: 'https://support.empatica.com/.well-known/security.txt', status: 404, document: false}
- {url: 'https://www.empatica.com/vulnerability-disclosure/', status: 200, verdict: soft-404-html-shell,
  document: false}
- {url: 'https://www.empatica.com/security/', status: 200, verdict: soft-404-html-shell,
  document: false}
- {url: 'https://www.empatica.com/definitely-not-a-real-page-zzz9/', status: 200, note: control
    probe establishing the catch-all}
- {url: 'https://trust.empatica.com/', status: 0, note: DNS does not resolve}
- {url: 'https://security.empatica.com/', status: 0, note: DNS does not resolve}
bug_bounty:
  hackerone: not-found
  bugcrowd: not-found
  intigriti: not-found
  method: searched
nearest_contact:
  compliance: compliance@empatica.com
  note: >-
    A compliance address is published on https://www.empatica.com/legal/. It is not
    a security contact and no disclosure terms, safe-harbour statement or response
    SLA accompany it.
recommendation: >-
  For an ISO/IEC 27001:2022-certified manufacturer of FDA-cleared medical devices
  that handles continuous physiological data, the absence of any published intake
  path for security researchers is the most conspicuous gap in the whole profile.
  Publishing /.well-known/security.txt (RFC 9116) with Contact, Policy and
  Preferred-Languages would close it in an afternoon.