Kalderos Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.kalderos.com/company/security
policy:
  - https://www.kalderos.com/company/security
contact:
  - security@kalderos.com
description: >-
  Kalderos does not publish an RFC 9116 /.well-known/security.txt (probed: www 404;
  app.kalderos.com returns a single-page-app catch-all 200 for every path, not a real
  document) and runs no public bug-bounty program (HackerOne / Bugcrowd / Intigriti).
  It does publish a dedicated security contact and a track record of coordinated
  vulnerability response: the company security page documents its response to the
  Apache Log4j vulnerability (dated 2021-12-17) with a linked response document. Report
  security issues to security@kalderos.com.
bug_bounty: none
security_txt: false
evidence:
  - {source: https://www.kalderos.com/company/security, kind: security-contact, detail: "security@kalderos.com published as security contact"}
  - {source: https://www.kalderos.com/company/security, kind: incident-response, detail: "Documented Apache Log4j vulnerability response (2021-12-17)"}