Guidewire · Vulnerability Disclosure

Guidewire Vulnerability Disclosure

Vulnerability disclosure

Guidewire runs a coordinated vulnerability disclosure program on Hackerone. A dedicated security contact is published.

InsurancePolicyClaimsBillingP&C
Program: Hackerone

Disclosure Policy

Security Contact

Contact
emailpsirt@guidewire.com
Contact
form
Contact
notePSIRT (Product Security Incident Response Team) mailbox. No web form is published.

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-09-12'
method: searched
source: https://www.guidewire.com/contact-us/vulnerability-disclosure-policy/
provider: guidewire
providerId: guidewire
published: true
http_status: 200
probed: '2026-09-12'
policy_url: https://www.guidewire.com/contact-us/vulnerability-disclosure-policy/
contact:
  email: psirt@guidewire.com
  form: null
  note: PSIRT (Product Security Incident Response Team) mailbox. No web form is published.
scope: Security vulnerabilities discovered in Guidewire products and services.
required_report_contents:
  - title
  - description
  - severity, scored with CVSS 3.0
  - impact
  - location / affected component
  - recommended remediation
  - proof of concept
bug_bounty:
  offered: false
  evidence: >-
    "At this time, Guidewire does not offer a Bug Bounty Program or compensation to researchers for
    vulnerability reports."
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  platforms_found: []
safe_harbor:
  published: false
  note: >-
    No explicit safe-harbor clause protecting good-faith research from legal action. The policy instead
    requires the reporter to treat the submission as Guidewire Confidential Information: "By engaging or
    participating in and/or submitting a security vulnerability to Guidewire, you agree to treat that
    information as the Confidential Information of Guidewire."
response_commitments:
  acknowledgement_sla: null
  remediation_sla: null
  note: >-
    Guidewire commits to working with the reporter to verify the issue and to notifying affected
    customers where remediation is required. No timeline is published.
security_txt:
  published: false
  note: >-
    No RFC 9116 /.well-known/security.txt is served on guidewire.com, www.guidewire.com or
    docs.guidewire.com. The only security.txt reachable on a guidewire.com host is on
    status.guidewire.com and it belongs to Atlassian (Statuspage), not Guidewire — see
    well-known/guidewire-well-known.yml. Publishing a security.txt pointing at
    psirt@guidewire.com and the policy URL above would be a one-file fix.
related:
  trust_center: security/guidewire-trust-center.yml
  security_docs: https://docs.guidewire.com/security/

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/guidewire-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.