Google Analytics Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.google.com/.well-known/security.txt
provider: Google Analytics
providerId: google-analytics
description: >-
  Google Analytics has no product-specific disclosure surface. It is covered by
  Google's estate-wide vulnerability disclosure programme, published as a
  standards-compliant security.txt on the corporate host. None of the Google
  Analytics API hosts serve a security.txt of their own — all six probed hosts
  return 404 (see well-known/google-analytics-well-known.yml).
security_txt:
  url: https://www.google.com/.well-known/security.txt
  http_status: 200
  rfc: RFC 9116
  file: well-known/google-analytics-security.txt
  expires: '2030-04-01T00:00:00Z'
policy:
  - https://g.co/vrp
contact:
  - https://g.co/vulnz
  - mailto:security@google.com
encryption: https://services.google.com/corporate/publickey.txt
acknowledgments: https://bughunters.google.com/
hiring: https://g.co/SecurityPrivacyEngJobs
bug_bounty:
  program: Google Vulnerability Reward Program (VRP)
  platform: self-hosted (bughunters.google.com)
  url: https://g.co/vrp
  submission: https://g.co/vulnz
  hall_of_fame: https://bughunters.google.com/
  scope_note: >-
    Google Analytics properties and APIs fall under Google's general product VRP
    scope rather than a dedicated Analytics programme.
evidence:
  - source: https://www.google.com/.well-known/security.txt
    kind: security.txt (live probe)
    http_status: 200
    fetched: '2026-08-13'
  - source: https://analyticsdata.googleapis.com/.well-known/security.txt
    kind: negative probe
    http_status: 404
    fetched: '2026-08-13'
  - source: https://analyticsadmin.googleapis.com/.well-known/security.txt
    kind: negative probe
    http_status: 404
    fetched: '2026-08-13'
  - source: https://developers.google.com/.well-known/security.txt
    kind: negative probe
    http_status: 404
    fetched: '2026-08-13'
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com