Jerry Vulnerability Disclosure

generated: '2026-08-04'
method: probed
probe: true
policy: []
contact:
- security@getjerry.com
contact_source: DNS CAA iodef record
status: contact-only
summary: >-
  Jerry publishes a security contact address, but only inside a DNS CAA `iodef`
  record on both registrable domains — the incident-reporting channel for
  certificate misissuance. There is no RFC 9116 security.txt, no responsible- or
  coordinated-disclosure policy page, no safe-harbour statement, and no bug
  bounty program on HackerOne, Bugcrowd or Intigriti. A researcher can find an
  address, but not terms. Because no disclosure policy is published, no
  `Security` / `SecurityPolicy` pointer is wired into apis.yml.
evidence:
- source: 'dig CAA jerry.ai'
  kind: dns-caa-iodef
  record: 0 iodef "mailto:security@getjerry.com"
- source: 'dig CAA getjerry.com'
  kind: dns-caa-iodef
  record: 0 iodef "mailto:security@getjerry.com"
probes_missed:
- {url: 'https://jerry.ai/.well-known/security.txt', http_status: 404}
- {url: 'https://getjerry.com/.well-known/security.txt', http_status: 404}
- {url: 'https://jerry.ai/security', http_status: 404}
- {url: 'https://jerry.ai/security/responsible-disclosure', http_status: 404}
- {url: 'https://jerry.ai/responsible-disclosure', http_status: 404}
- {url: 'https://jerry.ai/vulnerability-disclosure', http_status: 404}
- {url: 'https://jerry.ai/security-policy', http_status: 404}
- {url: 'https://jerry.ai/bug-bounty', http_status: 404}
- {url: 'https://getjerry.com/responsible-disclosure', http_status: 404}
- {url: 'https://hackerone.com/getjerry', http_status: 404}
- {url: 'https://hackerone.com/jerry.json', http_status: 404, note: '/jerry returns
    a 200 SPA shell but the JSON endpoint 404s — not a Jerry program.'}
gap:
  recommendation: >-
    Publish /.well-known/security.txt (RFC 9116) on jerry.ai and getjerry.com with
    Contact, Policy, Preferred-Languages and Expires, and a
    /security/responsible-disclosure page stating scope and safe harbour. The
    security@getjerry.com mailbox already exists — only the machine-readable
    pointer and the terms are missing.
x-evidence:
  fetched: '2026-08-04'
  method: DNS CAA lookup + unauthenticated HTTP GET