Glooko Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://glooko.com/trust-privacy/
policy:
- https://glooko.com/trust-privacy/
contact:
- https://glooko.com/trust-privacy/
notes: >-
  Glooko's trust/privacy page publishes a dedicated security contact email for
  reporting security issues or questions. No formal public bug-bounty program
  (HackerOne/Bugcrowd/Intigriti) or hosted /.well-known/security.txt was found:
  glooko.com/.well-known/security.txt returned 404, and developers.glooko.com
  returns a single-page-app fallback (HTTP 200 text/html) for every path. The
  named security contact is documented on the trust/privacy page rather than a
  standalone responsible-disclosure page.
evidence:
- source: https://glooko.com/trust-privacy/
  kind: security-contact
  detail: Dedicated email contact for security issues published on the trust/privacy page.
probes:
- url: https://glooko.com/.well-known/security.txt
  status: 404
- url: https://developers.glooko.com/.well-known/security.txt
  status: 200
  real: false
  note: SPA fallback (Content-Type text/html), not an RFC 9116 security.txt.