Hashnode Vulnerability Disclosure

generated: '2026-08-13'
method: probed
source: live HTTP probes of hashnode.com
published: false
description: >-
  RECORDED ABSENCE, and a correction. Hashnode publishes no vulnerability
  disclosure policy, no security.txt, and no bug bounty program that could be
  found from any public surface. No VulnerabilityDisclosure or Security pointer is
  emitted from this file, because the file documents that the surface is not served.

correction:
  supersedes: '2026-07-11'
  previous_claim: >-
    A 2026-07-11 probe recorded method "searched" with
    https://hashnode.com/vulnerability-disclosure as a disclosure page, on the
    strength of an HTTP 200 and the keyword "vulnerability".
  why_it_was_wrong: >-
    That URL is a soft 404. hashnode.com is a Next.js application that routes
    unrecognised top-level paths to a username lookup and answers HTTP 200 with the
    application shell rendering "User not found". The only occurrence of the word
    "vulnerability" was the requested path itself, echoed back in the page title.
    The page has never existed. A 200 status is not evidence of a document.
  tooling_note: >-
    0-working/probe-security-programs.py reproduces this false positive on every
    run - it matched the keyword again on 2026-08-13 and re-wrote the claim. This
    file was corrected by hand afterwards. Do NOT re-run that probe against
    hashnode without also re-applying this correction; the fix belongs in the
    probe, which needs a soft-404 guard (reject a body whose title or heading
    reads "User not found", and require the disclosure keyword to appear outside
    the requested path string).

probes:
  - {url: 'https://hashnode.com/vulnerability-disclosure', http_status: 200, document: false, note: 'soft 404 - body renders "User not found"'}
  - {url: 'https://hashnode.com/security', http_status: 200, document: false, note: 'soft 404 - application shell with no security content'}
  - {url: 'https://hashnode.com/security.txt', http_status: 200, document: false, note: 'soft 404 - body renders "User not found"'}
  - {url: 'https://hashnode.com/.well-known/security.txt', http_status: 404, document: false}
  - {url: 'https://gql-beta.hashnode.com/.well-known/security.txt', http_status: 404, document: false}
  - {url: 'https://raw.githubusercontent.com/Hashnode/.github/main/SECURITY.md', http_status: 404, document: false}
  - {url: 'https://raw.githubusercontent.com/Hashnode/support/main/SECURITY.md', http_status: 404, document: false}
  - {url: 'https://github.com/Hashnode/gql-skill/security/policy', http_status: 200, document: false, note: 'default GitHub tab chrome; no policy has been published'}

policy: []
contact: []
bug_bounty:
  program: null
  platform: null
  note: No HackerOne, Bugcrowd, or Intigriti program found for Hashnode.

general_contact:
  note: >-
    Hashnode publishes a general support address (hello@hashnode.com /
    hello+support@hashnode.com) but no security-specific contact, no PGP key, and
    no disclosure terms.

checked: '2026-08-13'

maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com