Kalepa · Vulnerability Disclosure

Kalepa Vulnerability Disclosure

Vulnerability disclosure

Kalepa publishes a vulnerability disclosure policy for reporting security issues. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

InsuranceUnited StatesInsurtechUnderwritingProperty and CasualtyCommercial InsuranceArtificial IntelligenceACORDPartner GatedNo Public API
Program: security.txt present

Disclosure Policy

Policy
https://kalepa.com/security

Security Contact

Contact
security@kalepa.com

Source

Vulnerability Disclosure

kalepa-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-07-25'
method: searched
probe: true
source: https://kalepa.com/security
policy:
- https://kalepa.com/security
contact:
- security@kalepa.com
program:
  type: responsible-disclosure
  bug_bounty: false
  paid_rewards: false
  platform: none
  safe_harbor: >-
    "we will not take legal action against you nor ask law enforcement to
    investigate you provided you comply with the following Responsible Disclosure
    Guidelines"
  security_txt: false
scope:
  domains:
  - kalepa.com
  - kalepainsurance.com
  - kalepa.co
  - kalepa.io
  note: '"and any subdomain" — verbatim from the policy page.'
eligible_bug_classes:
- Cross-site Scripting
- Open redirect
- Cross-site request forgery
- File inclusion
- Authentication bypass
- Server-side code execution
ineligible_bug_classes:
- Missing cookie flags on non-session or third-party cookies
- Logout CSRF
- Social engineering
- Denial of service
- SSL BEAST/CRIME and similar
- Email spoofing, SPF, DMARC and DKIM issues
guidelines:
- Provide reproduction detail and a proof of concept.
- Make a good-faith effort to avoid privacy violations, data destruction and
  service degradation.
- Do not modify or access data that does not belong to you.
- Give Kalepa reasonable time to correct the issue before publishing.
- Do not perform research that could impact other users.
report_format:
  fields: [Name, Twitter, Bug type, Domain, Severity, URL, PoC, CVSS (optional), CWSS (optional)]
evidence:
- source: https://kalepa.com/security
  kind: disclosure page
  status: 200
  keywords:
  - vulnerability
  - responsible disclosure
  - security research
  - report a security
  - security issue
  - security@
- source: well-known/kalepa-well-known.yml
  kind: security.txt
  status: 404
  note: No RFC 9116 security.txt published at kalepa.com or api.kalepa.com.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/kalepa-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.