Involve Me Vulnerability Disclosure

generated: '2026-08-12'
method: searched
source: >-
  well-known/involve-me-security.txt, harvested verbatim from
  https://app.involve.me/.well-known/security.txt (HTTP 200, text/plain) and
  byte-identical at https://api.involve.me/.well-known/security.txt (HTTP 200).
description: >-
  involve.me publishes a valid, in-date RFC 9116 security.txt naming a dedicated
  security mailbox. That is the whole of its disclosure programme: there is no
  written policy, no bug bounty, no safe-harbour statement, no PGP key and no
  acknowledgements page.

security_txt:
  present: true
  valid: true
  expired: false
  hosts:
  - url: https://app.involve.me/.well-known/security.txt
    http_status: 200
    canonical: true
  - url: https://api.involve.me/.well-known/security.txt
    http_status: 200
    canonical: false
  - url: https://www.involve.me/.well-known/security.txt
    http_status: 404
    note: >-
      Not served from the marketing host, which is where a researcher starting at
      involve.me is most likely to look first.
  fields:
    contact: mailto:security@involve.me
    expires: '2027-01-01T00:00:00.000Z'
    preferred_languages: en
    canonical: https://app.involve.me/.well-known/security.txt
    policy: null
    encryption: null
    acknowledgments: null
    hiring: null

contact:
- mailto:security@involve.me

disclosure_policy:
  published: false
  url: null
  probes:
  - url: https://www.involve.me/security
    status: 404
  - url: https://security.involve.me/
    status: 302
    redirects_to: https://www.involve.me/
    note: >-
      Resolves into involve.me's funnel-hosting edge and lands on the marketing
      homepage with utm_campaign=customer_organization-deleted. It is not a security
      page; anything that reads a 200 there is reading the homepage.
  - url: https://www.involve.me/responsible-disclosure
    status: 404

bug_bounty:
  program: false
  platform: null
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  safe_harbor: false

trust_center: security/involve-me-trust-center.yml

evidence:
- source: well-known/involve-me-security.txt
  kind: RFC 9116 security.txt, harvested verbatim
  url: https://app.involve.me/.well-known/security.txt
  http_status: 200

gaps:
- No Policy: field, so a researcher has no stated scope, timeline or safe harbour.
- No Encryption: key, so a report containing a working exploit must travel in plaintext email.
- security.txt is absent from www.involve.me, the host a researcher will try first.
- No acknowledgements page, so there is no public record of past reports.