Hull Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.hull.io/security/
policy:
  - https://www.hull.io/security/
contact:
  - security@hull.io
bug_bounty:
  published: false
  platform: null
  note: No HackerOne, Bugcrowd or Intigriti program is referenced anywhere on the Hull site.
security_txt:
  published: false
  path: /.well-known/security.txt
  status: 404
  note: >-
    Probed 2026-08-13 on www.hull.io — 404. No RFC 9116 security.txt is served;
    see well-known/hull-well-known.yml.
disclosure_instruction: >-
  "Please notify our security team immediately of any unauthorized use of your
  account credentials or any other suspected breach of security at
  security@hull.io." The page states an inbound reporting address but publishes
  no formal responsible-disclosure policy, no scope, no safe-harbour language
  and no response SLA.
practices_published:
  - Cryptography in use where necessary
  - Password / secured-token protection
  - Access to customer data restricted to certain personnel
  - Infrastructure on Amazon Web Services (inheriting AWS ISO/SOC certifications)
  - Third-party sub-processor due diligence; partners required to hold SOC 2 / ISO certification
  - Penetration testing (listed as an enterprise entitlement on the pricing page)
evidence:
  - source: https://www.hull.io/security/
    kind: security page
    http_status: 200
    fetched: '2026-08-13'
    keywords: [security@hull.io, suspected breach of security, GDPR, SOC2, penetration testing]
  - source: https://www.hull.io/.well-known/security.txt
    kind: security.txt probe
    http_status: 404
    fetched: '2026-08-13'
caveat: >-
  The /security/ page is served over HTTPS from the provider's own host but the
  certificate presented by www.hull.io is a Netlify wildcard (*.netlify.app) that
  does not match the hostname, so a standards-compliant client fails the
  handshake and cannot read this page without disabling verification. The
  document is genuinely the provider's; its transport is broken. See
  security/hull-domain-security.yml.