Formality Vulnerability Disclosure

generated: '2026-08-17'
method: searched
probe: true
source: https://www.formality.com/.well-known/security.txt
contact:
- mailto:security@formality.co
policy: []
bug_bounty:
  program: null
  platform: null
  note: >-
    No bug bounty or coordinated-disclosure program was found. HackerOne, Bugcrowd and
    Intigriti were checked and no Formality program exists, and no
    /security, /responsible-disclosure or /vulnerability-disclosure page is served on
    formality.com (all return HTTP 403 from the origin, i.e. the path does not exist).
security_txt:
  served: true
  status: 200
  content_type: text/plain
  file: well-known/formality-security.txt
  hosts_serving:
  - https://www.formality.com/.well-known/security.txt
  - https://formality.com/.well-known/security.txt
  - https://app.eu1.formality.com/.well-known/security.txt
  - https://app.fr1.formality.com/.well-known/security.txt
  - https://auth.eu1.formality.com/.well-known/security.txt
  fields_present: [Contact, Preferred-Languages, Expires]
  fields_absent: [Policy, Encryption, Acknowledgments, Canonical, Hiring, CSAF]
  expires: '2029-12-31T23:00:00.000Z'
  last_modified: '2026-07-28'
  note: >-
    A REAL, VALID RFC 9116 document — the strongest agent-readable security signal
    Formality publishes. It carries a reachable contact, declares English and French as
    preferred languages, and is not expired. It is deliberately minimal: there is no
    Policy field, so a researcher gets an address but no published scope, safe-harbour
    statement, or expected response time. It is served from one S3 object behind the
    shared CloudFront distribution, which is why it appears identically on the marketing
    origin and on every application host.
domain_note: >-
  The disclosure contact is security@formality.co — the .co domain, not the .com the
  website runs on. This is consistent and deliberate rather than a typo: the legal
  notice publishes contact@formality.co and privacy@formality.co on the same pattern,
  so Formality uses formality.co for mail and formality.com for web.
evidence:
- source: https://www.formality.com/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
  fetched: '2026-08-17'
- source: https://www.formality.com/en/legal-notice.html
  kind: published contact addresses
  http_status: 200
  fetched: '2026-08-17'
security_pointer_emitted: true
security_pointer_note: >-
  type:Security is emitted in apis.yml pointing at the live security.txt URL, since that
  is the actual document Formality serves for vulnerability reporting. type:SecurityTxt
  and type:WellKnown are also emitted, both backed by this observed 200.
gaps_worth_raising_with_provider:
- Add a Policy field naming scope and safe harbour.
- Publish a disclosure page at a human-readable URL.
- Consider Canonical and Acknowledgments fields.