Goatcounter Vulnerability Disclosure

generated: '2026-08-13'
method: probed
probe: true
source: https://www.goatcounter.com/security.txt
description: >-
  GoatCounter serves a real security.txt, but at the legacy document-root path /security.txt rather
  than the RFC 9116 canonical /.well-known/security.txt, which is why the mechanical
  probe-security-programs.py pass reported vdp=none — it checks the canonical path. The document is
  minimal: one Contact line and nothing else. There is no bug bounty, no named disclosure policy page,
  and no PGP key.
contact:
  - support@goatcounter.com
policy: []
encryption: []
expires: null
preferred_languages: []
acknowledgments: []
bug_bounty:
  present: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: none found
disclosure_pages_checked:
  - {url: 'https://www.goatcounter.com/.well-known/security.txt', status: 404}
  - {url: 'https://goatcounter.com/.well-known/security.txt', status: 404}
alternate_reporting_channels:
  - kind: github-issues
    url: https://github.com/arp242/goatcounter/issues
    note: >-
      The provider explicitly invites public GitHub issues for questions and problems. Public issues
      are not an appropriate channel for an unfixed vulnerability; the email contact above is.
  - kind: contact-form
    url: https://www.goatcounter.com/contact
rfc9116_compliance:
  compliant: false
  reasons:
    - Served at /security.txt, not /.well-known/security.txt (RFC 9116 section 3).
    - No Expires field, which RFC 9116 requires.
evidence:
  - source: https://www.goatcounter.com/security.txt
    kind: security.txt
    http_status: 200
    content_type: text/plain
    fetched: '2026-08-13'
    file: well-known/goatcounter-security.txt
    body: 'Contact: support@goatcounter.com'
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com