Eton Solutions Vulnerability Disclosure

generated: '2026-08-04'
method: probed
probe: true
result: none-found
source: https://eton-solutions.com/
summary: >-
  Eton Solutions publishes no vulnerability disclosure policy, no bug bounty program, no
  security.txt and no security@ reporting address that could be found from the public
  surface. The nearest published documents are an Information Security Policy Statement
  (an ISMS commitment statement, not a reporting channel) and an Acceptable Use Policy
  that runs in the opposite direction — it expressly prohibits unauthorized attempts to
  probe, scan, penetrate or test the vulnerability of an Eton system or network, whether
  by passive or intrusive techniques. Recorded as a negative finding. No `Security` or
  `VulnerabilityDisclosure` pointer is wired into apis.yml, because no disclosure channel
  exists to point at.
policy: []
contact: []
bug_bounty: none
platforms_checked:
- HackerOne
- Bugcrowd
- Intigriti
security_txt:
  found: false
  note: >-
    /.well-known/security.txt returned the site-wide SiteGround bot-protection challenge
    (HTTP 202, text/html), as did a deliberately nonexistent control path, so its absence
    is unconfirmed rather than proven. See well-known/eton-solutions-well-known.yml.
related_published_documents:
- kind: information-security-policy
  url: https://eton-solutions.com/information-security-policy-statement/
  note: ISMS policy statement; contains no reporting channel or disclosure terms.
- kind: acceptable-use-policy
  url: https://www.eton-solutions.com/acceptable-use-policy
  note: >-
    Prohibits unauthorized probing, scanning, penetration or vulnerability testing of Eton
    systems. Policy inquiries are directed to CFO@eton-solutions.com — a finance contact,
    not a security reporting channel.
- kind: data-processing-agreement
  url: https://eton-solutions.com/data-processing-agreement/
  note: >-
    Defines "Personal Data Breach" and breach-handling obligations contractually, between
    Eton and its clients/vendors. Not a public reporting route.
recommendation: >-
  Publishing an RFC 9116 /.well-known/security.txt with a Policy: and Contact: field, and a
  short coordinated-disclosure page carving researchers out of the Acceptable Use Policy's
  no-probing clause, would be the single cheapest security-posture improvement available to
  Eton Solutions and is a common expectation for a vendor holding SOC 2 Type II and
  ISO/IEC 27001.