Harmonic Ai Vulnerability Disclosure

generated: '2026-08-14'
method: searched
source: https://harmonic.ai/legal/terms-of-service
checked: '2026-08-14'
summary: >-
  Harmonic.ai publishes a named vulnerability-reporting contact in its own Terms of Service, but
  ships no /.well-known/security.txt, no dedicated security or disclosure page, and no bug bounty
  program. The channel exists and is first-party; the program around it is undocumented.
program:
  published: true
  kind: email-only
  contact: mailto:security@harmonic.ai
  quote: >-
    "Additionally, if you discover any security vulnerabilities, please email them to
    security@harmonic.ai."
  location: https://harmonic.ai/legal/terms-of-service
  document_last_updated: '2025-12-09'
policy:
  page: null
  safe_harbor_documented: false
  scope_documented: false
  response_sla_documented: false
  disclosure_timeline_documented: false
  rewards: none-published
bug_bounty:
  platform: null
  hackerone: false
  bugcrowd: false
  intigriti: false
  note: No bug bounty program was located on any Harmonic.ai host or on the major bounty platforms.
security_txt:
  served: false
  probes:
    - url: https://harmonic.ai/.well-known/security.txt
      status: 404
    - url: https://harmonic.ai/security.txt
      status: 404
    - url: https://api.harmonic.ai/.well-known/security.txt
      status: 403
  note: >-
    RFC 9116 is not implemented. harmonic.ai returns a 404 body reading "Invalid .well-known
    request" for every /.well-known/* path; api.harmonic.ai 403s behind Kong before any
    /.well-known/ path is reachable. A security.txt naming the existing security@harmonic.ai
    address would be a one-file fix and is the single cheapest security-posture improvement
    available to this provider.
trust_center:
  present: false
  probes:
    - url: https://trust.harmonic.ai
      status: 000
      note: DNS/connection failure — no such host.
    - url: https://security.harmonic.ai
      status: 000
      note: DNS/connection failure — no such host.
    - url: https://harmonic.ai/security
      status: 404
    - url: https://harmonic.ai/trust
      status: 404
  note: >-
    No trust center exists, so no TrustCenter pointer is emitted. Certification claims are published
    only as site-footer text — recorded in conformance/harmonic-ai-conformance.yml.
    Do NOT confuse this provider with Harmonic Security (harmonic.security), a different company
    that DOES run a trust center at trust.harmonic.security; a web search for
    "Harmonic SOC 2 trust center" returns that company's assets, not this one's.
evidence:
  - url: https://harmonic.ai/legal/terms-of-service
    status: 200
    finding: security@harmonic.ai named as the vulnerability reporting address
    checked: '2026-08-14'