Instapage Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://policies.airslate.com/bug-bounty-program
policy:
- https://policies.airslate.com/bug-bounty-program
contact:
- hackerone@dochub.com
program:
  name: airSlate Bug Bounty Program
  operator: airSlate (Instapage's parent company)
  platform: HackerOne
  intake: >-
    Reports are accepted only through the airSlate HackerOne portal, or by email to
    hackerone@dochub.com which auto-generates a HackerOne report.
  rewards: monetary, subject to published eligibility requirements
  covers_instapage: true
  scope_evidence: >-
    The programme's out-of-scope list explicitly names Instapage — "Any vulnerabilities that arise
    solely from user-created pages on Instapage, such as reflected/stored XSS, open redirects,
    clickjacking, phishing, or spoofing" — which establishes that Instapage itself is in scope and
    only customer-authored page content is carved out.
  linked_from: https://instapage.com/security (site footer, "Bug Bounty Program")
security_txt:
  served: false
  note: >-
    No /.well-known/security.txt on instapage.com, api.instapage.com, devdocs.instapage.com or
    app.instapage.com — see well-known/instapage-well-known.yml. The disclosure route is published on
    the parent company's policy site instead, which is why the mechanical probe found nothing.
security_program:
  url: https://instapage.com/security
  vulnerability_management: >-
    Instapage publishes a Vulnerability Management Program (identify, prioritize, manage and report
    threats using a risk-based approach) and an Information Security Incident Management Program.
  testing_cadence: >-
    Monthly network scans, quarterly vulnerability assessments, internal and external penetration
    tests once a year.
  frameworks: ISO 27001/2 and NIST 800-53 aligned policies, reviewed yearly or after significant
    changes.
evidence:
- source: https://policies.airslate.com/bug-bounty-program
  http_status: 200
  kind: bug-bounty-policy
  keywords: [bug bounty, hackerone, responsible, in scope, out of scope, instapage]
- source: https://instapage.com/security
  http_status: 200
  kind: security-program-page
  keywords: [vulnerability management program, penetration test, incident management]
x-evidence:
  fetched: '2026-08-13'