Gigacatalyst Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://gigacatalyst.com/trust/vulnerability-disclosure
# The mechanical probe (probe-security-programs.py) returned vdp=none because it checks
# the conventional paths (/security, /responsible-disclosure, /vulnerability-disclosure,
# /.well-known/security.txt). Gigacatalyst publishes its policy one level deeper, at
# /trust/vulnerability-disclosure, linked from the trust center. Found and read by hand.
policy:
- https://gigacatalyst.com/trust/vulnerability-disclosure
contact:
- security@gigacatalyst.com   # published on the policy page (obfuscated in HTML via Cloudflare email protection)
effective_date: '2026-05-01'
security_txt: false            # /.well-known/security.txt returns 404 on gigacatalyst.com
bug_bounty:
  offered: false
  note: >-
    "We do not currently offer a paid bug bounty program, but we are grateful for
    responsible disclosures that help keep our customers safe."
  platform: null
response_targets:
- milestone: acknowledgement of receipt
  target_days: 2
- milestone: initial assessment and severity classification
  target_days: 5
- milestone: remediation progress updates and resolution notice
  target_days: null
  note: ongoing
scope:
  in_scope:
  - gigacatalyst.com and all subdomains
  - Gigacatalyst APIs and backend services
  - Builder and app generation infrastructure
  - Authentication and session management
  out_of_scope:
  - Social engineering of employees or customers
  - Denial of service (DoS/DDoS) attacks
  - Physical attacks against offices or data centers
  - Third-party services not operated by Gigacatalyst
  - Issues already reported and under active remediation
safe_harbor:
  offered: true
  conditions:
  - good-faith effort to avoid privacy violations, data destruction, and service disruption
  - no access to or modification of data belonging to other users
  - prompt reporting with no public disclosure before remediation
  - no exploitation beyond what is necessary to demonstrate the issue
recognition:
  credit_offered: true
  note: public credit given with the researcher's permission once a vulnerability is resolved
report_requirements:
- description of the vulnerability including the affected service or endpoint
- step-by-step reproduction instructions
- assessed potential impact or severity
- supporting material (proof-of-concept code, screenshots, HTTP requests/responses)
- preferred contact method for follow-up
evidence:
- source: https://gigacatalyst.com/trust/vulnerability-disclosure
  kind: disclosure-policy-page
  http_status: 200
  fetched: '2026-08-14'
- source: https://gigacatalyst.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-14'