Fodda (PSFK) · Vulnerability Disclosure

Fodda Ai Vulnerability Disclosure

Vulnerability disclosure

Fodda (PSFK) runs a coordinated vulnerability disclosure program on Hackerone.

Market IntelligenceTrend ResearchKnowledge GraphConsumer InsightsEarnings IntelligenceBrand IntelligenceResearchInstitutional DataMCPA2AAgent-NativeMachine PaymentsCompany

Program: Hackerone

Disclosure Policy

Policy

disclosure_timeline_documentedfalse

Policy

page

Policy

response_sla_documentedfalse

Policy

rewardsnone-published

Policy

safe_harbor_documentedfalse

Policy

scope_documentedfalse

Security Contact

Source

Vulnerability Disclosure

generated: '2026-09-19'
method: searched
source: https://www.fodda.ai/compliance-dossier + https://raw.githubusercontent.com/piers-fawkes/fodda-mcp/main/SECURITY_SUMMARY.md
checked: '2026-09-19'
summary: 'Fodda publishes a named, first-party vulnerability-reporting channel — security@fodda.ai — on its Compliance
  Dossier page ("Security & vulnerability reporting: security@fodda.ai"; "direct vulnerability triage at security@fodda.ai")
  and in the fodda-mcp repository''s SECURITY_SUMMARY.md. It ships no /.well-known/security.txt on any host, no
  dedicated disclosure policy page, no safe-harbor statement and no bug bounty. probe-security-programs.py wrote
  nothing because its bar is a security.txt Policy line, a bounty listing or a disclosure page; this file records
  the email channel that does exist.'
program:
  published: true
  kind: email-only
  contact: mailto:security@fodda.ai
  quotes:
  - 'Security & vulnerability reporting: security@fodda.ai | Procurement & compliance: compliance@fodda.ai'
  - founder-led engineering access, verified human oversight telemetry via Slack, and direct vulnerability triage
    at security@fodda.ai
  location: https://www.fodda.ai/compliance-dossier
  document_last_updated: 2026-08-27 (per llms.txt)
policy:
  page: null
  safe_harbor_documented: false
  scope_documented: false
  response_sla_documented: false
  disclosure_timeline_documented: false
  rewards: none-published
bug_bounty:
  platform: null
  hackerone: false
  bugcrowd: false
  intigriti: false
security_txt:
  served: false
  probes:
  - url: https://www.fodda.ai/.well-known/security.txt
    status: 404
  - url: https://api.fodda.ai/.well-known/security.txt
    status: 404
  - url: https://mcp.fodda.ai/.well-known/security.txt
    status: 404
  - url: https://clerk.fodda.ai/.well-known/security.txt
    status: 404
  - url: https://app.fodda.ai/.well-known/security.txt
    status: 200 SPA shell (not a document)
  note: A security.txt naming the existing security@fodda.ai address would be a one-file fix.
related_pages:
- url: https://www.fodda.ai/security
  status: 200
  note: 'Security overview (marketing-level: private graph infrastructure, data isolation, deterministic retrieval,
    no training on client data).'
- url: https://www.fodda.ai/blog/security-refresh-2026
  status: 200
  note: '2026-02-12: NIST CSF 2.0 alignment, SOC 2 Type II readiness roadmap by Q4 2026, GCP hosting, read-only
    data model, tenant isolation.'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/fodda-ai-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.