Infer By Flow7 Vulnerability Disclosure

generated: '2026-08-11'
method: searched
source: >-
  https://infer.flow7.org/terms (section 26, Notices and contact; section 14, Security),
  https://infer.flow7.org/support, and a live probe of https://infer.flow7.org/.well-known/security.txt
description: >-
  Infer publishes a reachable security-reporting channel, but not as a machine-readable one. There is
  no RFC 9116 security.txt, no bug bounty and no VDP page. What exists is a named security contact in
  the Terms and a "Security or abuse" category on the support intake form.
program: none
bug_bounty: false
bounty_platform: null
vdp_page: null
safe_harbor_published: false
security_txt:
  url: https://infer.flow7.org/.well-known/security.txt
  status: 404
  present: false
contacts:
  - type: email
    value: security@flow7.org
    source: https://infer.flow7.org/terms
    source_note: >-
      Published in section 26 (Notices and contact) as the Security address. Obfuscated on the page by
      Cloudflare email protection, so it is not machine-readable without executing the decoder script.
      Role address, not a personal one.
  - type: form
    value: https://infer.flow7.org/support
    category: Security or abuse
    source: https://infer.flow7.org/support
    source_note: >-
      Infer describes the support form as its supported contact path and states that replies to the
      acknowledgement email are not accepted as support requests — so the form, not email threading,
      is the durable intake.
provider_obligations:
  - >-
    Terms section 14 (Security) obliges the customer to notify Infer of a compromise, unauthorized
    access, or a vulnerability relating to the Service. The obligation runs toward Infer; no
    corresponding researcher-facing disclosure policy, response SLA or safe harbor is published.
  - >-
    The DPA (2026-08-08) defines Security Incident and covers Infer's own notification duties to a
    Business User.
published_controls:
  source: https://infer.flow7.org/privacy section 9 (Security)
  controls:
    - encrypted transport
    - password hashing
    - hashed API keys
    - secure cookies
    - pricing-integrity controls
    - monitoring
    - backups
    - retention controls
  note: Prose commitments, not an audited control set.
credential_hygiene_posture:
  note: >-
    Worth recording as a positive: Infer repeats a "never paste your key" rule in the OpenAPI
    securityScheme description, in the docs quickstart, in the support form warning, and in all three
    published agent skills. Its Codex provider doctor is deliberately built with no credential field
    and no hosted request path. That is a stronger operational security posture toward AI agents than
    most providers in the catalog take.
gaps:
  - No RFC 9116 security.txt at /.well-known/security.txt (404).
  - No bug bounty on HackerOne, Bugcrowd or Intigriti; none found.
  - No published vulnerability disclosure policy, response timeline, or researcher safe harbor.