Hyundai Vulnerability Disclosure

generated: '2026-09-13'
method: searched
probe: true
source: https://www.hyundai.com/.well-known/security.txt
contact:
  - HAEE_Security@hyundai-autoever.eu
policy_url: null
bug_bounty: null
acknowledgements: null
encryption: null
canonical: null
preferred_languages:
  - en
  - de
expires: '2026-12-31T23:59:59Z'
expires_valid: true
rfc9116: true
evidence:
  - source: https://www.hyundai.com/.well-known/security.txt
    kind: security.txt (live probe)
    status: 200
    content_type: text/plain; charset=UTF-8
    date: '2026-09-13'
    file: well-known/hyundai-security.txt
findings:
  - >-
    The security.txt is minimal but valid — Contact, Expires and Preferred-Languages only.
    It omits the optional Policy, Acknowledgments, Encryption and Canonical fields, so a
    researcher gets an address but no published disclosure process or safe-harbour terms.
  - >-
    The contact address belongs to Hyundai AutoEver Europe (hyundai-autoever.eu) and the
    preferred languages are English and German, indicating the file is operated by the
    European IT subsidiary rather than by the Korean developer platform. A vulnerability in
    the Hyundai Developers connected-car API has no published reporting channel of its own.
  - >-
    No security.txt on developers.hyundai.com, console.developers.hyundai.com or
    prd.kr-ccapi.hyundai.com — all 404. See well-known/hyundai-well-known.yml.
  - >-
    No bug bounty programme found on HackerOne, Bugcrowd or Intigriti for Hyundai Motor
    Company, and no vulnerability-disclosure page on the developer portal.
  - >-
    The developer portal does publish a narrow security-adjacent contact path:
    developers@hyundai.com for technical support, and the console guide directs partners to
    that address if a Client ID / Client Secret is exposed.