Hotmart Vulnerability Disclosure

generated: '2026-08-04'
method: searched
source: https://hackerone.com/hotmartvdp
description: >-
  Hotmart runs a public, managed Vulnerability Disclosure Program (VDP) on HackerOne and publishes
  a Cybersecurity Policy on its own domain that names a direct reporting channel. Neither is
  discoverable from a /.well-known/security.txt — Hotmart publishes no RFC 9116 file on any host
  (see well-known/hotmart-well-known.yml) — so both were found by search, not by probe.

program:
  name: Hotmart (VDP)
  type: vulnerability-disclosure
  managed_by: HackerOne
  url: https://hackerone.com/hotmartvdp
  state: public_mode
  submission_state: open
  offers_bounties: false
  started_accepting_at: '2025-02-03'
  safe_harbor: >-
    "Any activities conducted in a manner consistent with this policy will be considered authorized
    conduct, and if legal action is initiated by a third party, Hotmart will take steps to make it
    known that your actions were conducted in compliance with this policy."
  disclosure_policy: >-
    Coordinated, non-public. Researchers may not discuss vulnerabilities — including resolved ones
    — outside the program without express consent; HackerOne disclosure guidelines apply.
  response_targets:
    first_response_business_days: 5
    time_to_triage_business_days: 8
    time_to_resolution: depends on severity and complexity
  severity_note: >-
    Final severity is determined by the Hotmart team against internal criteria, which may differ
    from the HackerOne Detailed Platform Standards.
  scope:
    - asset: '*.buildstaging.com'
      asset_type: WILDCARD
      eligible_for_submission: true
      eligible_for_bounty: false
      note: Staging environment; available Monday to Friday only. Production testing is prohibited.
    - asset: '*.hotmart.com'
      asset_type: WILDCARD
      eligible_for_submission: false
      eligible_for_bounty: false
    - asset: '*.teachable.com'
      asset_type: WILDCARD
      eligible_for_submission: false
      eligible_for_bounty: false
      note: Teachable is a Hotmart company; it is listed but not open for submission.
    - asset: '*ctf*.buildstaging.com'
      asset_type: WILDCARD
      eligible_for_submission: false
      eligible_for_bounty: false
  scope_note: >-
    Only the staging wildcard is open for submission. The production Hotmart and Teachable domains
    are listed out-of-scope, so the Hotmart Developers API hosts (developers.hotmart.com,
    sandbox.hotmart.com, api-sec-vlc.hotmart.com) are NOT in the testable scope of this program.

policy:
  name: Cybersecurity Policy
  url: https://hotmart.com/en/legal/cybersecurity-policy
  published: true
  covers:
    - data classification
    - access management
    - encryption
    - vulnerability management
    - incident handling
    - security awareness training
  reporting_channel: cybersecurity@hotmart.com
  reporting_language: >-
    "In the event of any inconsistency or failure in the Hotmart environment identified by the
    external public, the Company provides a channel for receiving the respective communication via
    email."
  certifications_named: []
  certifications_note: >-
    The Cybersecurity Policy describes a security program but names no certification or attestation
    (no ISO 27001, PCI DSS, SOC 2, GDPR or LGPD claim). No `Compliance` pointer is emitted — see
    conformance/hotmart-conformance.yml.

contacts:
  - type: email
    value: cybersecurity@hotmart.com
    source: https://hotmart.com/en/legal/cybersecurity-policy
  - type: platform
    value: https://hackerone.com/hotmartvdp
    source: https://hackerone.com/hotmartvdp

security_txt:
  published: false
  note: >-
    No /.well-known/security.txt on hotmart.com, developers.hotmart.com, sandbox.hotmart.com,
    api-sec-vlc.hotmart.com, app-vlc.hotmart.com or checkout.hotmart.com. Adding one pointing at
    the HackerOne program and cybersecurity@hotmart.com would make both channels machine-discoverable.

gaps:
  - No RFC 9116 security.txt, so neither channel is discoverable from the hosts themselves.
  - The developer/API hosts are out of the VDP's submittable scope.
  - No bounty is offered; submissions are recognition-only.
  - No public hall of fame or disclosure statistics.

x-evidence:
  fetched: '2026-08-04'
  probes:
    - url: https://hackerone.com/hotmartvdp
      http_status: 200
      note: >-
        Page is client-rendered; program record read from the HackerOne GraphQL API
        (team handle "hotmartvdp") — name "Hotmart (VDP)", state public_mode, submission_state
        open, offers_bounties false, started_accepting_at 2025-02-03.
    - url: https://hotmart.com/en/legal/cybersecurity-policy
      http_status: 200
      content_type: text/html
    - url: https://hotmart.com/.well-known/security.txt
      http_status: 404