Fireflies Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://fireflies.ai/bug-bounty
policy:
- https://fireflies.ai/bug-bounty
- https://fireflies.ai/security
program:
  type: bug-bounty
  name: Fireflies Bug Bounty Rewards Program
  url: https://fireflies.ai/bug-bounty
  rewards: true
  platform: null
  platform_note: >-
    Self-hosted program page. No HackerOne, Bugcrowd or Intigriti listing was found, and Fireflies
    runs an additional invite-only track at https://fireflies.ai/security/bug-bounty-invite.
  description: >-
    "Help us enhance security by identifying vulnerabilities. Report bugs, earn rewards, and make
    Fireflies safer for everyone." Linked from the main security page.
contact: []
contact_note: >-
  No security contact address is published in machine-readable form. There is no
  /.well-known/security.txt on any Fireflies host, so a scanner or agent has no RFC 9116 path to
  the disclosure policy — it is discoverable only by following a link from the marketing security
  page. This is the single cheapest gap on the Fireflies security surface to close.
security_txt:
  present: false
  probed:
  - {url: 'https://fireflies.ai/.well-known/security.txt', http_status: 404}
  - {url: 'https://api.fireflies.ai/.well-known/security.txt', http_status: 404}
  - {url: 'https://mcp.fireflies.ai/.well-known/security.txt', http_status: 404}
  - {url: 'https://docs.fireflies.ai/.well-known/security.txt', http_status: 404}
evidence:
- source: https://fireflies.ai/bug-bounty
  http_status: 200
  kind: bug bounty program page
- source: https://fireflies.ai/security
  http_status: 200
  kind: disclosure link
  keywords: [bug bounty, vulnerabilities, report bugs, rewards]
- source: https://fireflies.ai/security/bug-bounty-invite
  kind: invite-only program link found in the security page markup
x-evidence:
  fetched: '2026-08-14'