Gong Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.gong.io/security
policy:
- https://vdp.gong.io/
contact: []
program:
  type: vulnerability-disclosure-portal
  url: https://vdp.gong.io/
  http_status: 200
  hosted_on: vdp.gong.io (Gong-controlled subdomain)
  bug_bounty: not stated
  statement: >-
    "Discovered a security or privacy issue that you believe we should know
    about? We would love to hear from you." — Gong's public security page,
    linking to https://vdp.gong.io/
  scope_document: not published on the public page
  safe_harbor: not stated publicly
security_txt:
  served: false
  probed:
  - {url: 'https://www.gong.io/.well-known/security.txt', status: 404}
  - {url: 'https://app.gong.io/.well-known/security.txt', status: 404}
  - {url: 'https://api.gong.io/.well-known/security.txt', status: 401}
  - {url: 'https://help.gong.io/.well-known/security.txt', status: 404}
  note: >-
    Gong runs a real disclosure intake but does not advertise it in RFC 9116
    form, so an automated scanner finds nothing. Publishing a two-line
    /.well-known/security.txt with `Policy: https://vdp.gong.io/` would make an
    existing program machine-discoverable at essentially zero cost.
evidence:
- source: https://www.gong.io/security
  kind: security-page
  http_status: 200
  fetched: '2026-08-13'
- source: https://vdp.gong.io/
  kind: disclosure-portal
  http_status: 200
  fetched: '2026-08-13'
note: >-
  0-working/probe-security-programs.py reported vdp=none for this provider — its
  path list does not include a vdp.<domain> subdomain, and Gong's disclosure
  link lives on /security rather than on any of the probed
  /responsible-disclosure style paths. This file is the SEARCHED upgrade over
  that negative probe and should not be overwritten by a later probe-only pass.