Kentico Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.kentico.com/vulnerability-disclosure-program
policy:
  - https://www.kentico.com/vulnerability-disclosure-program
contact:
  - mailto:security@kentico.com
security_txt: https://www.kentico.com/.well-known/security.txt
program:
  name: Kentico Vulnerability Disclosure Program
  type: coordinated-disclosure
  bug_bounty: false
  rewards: false
  safe_harbor: true
  safe_harbor_detail: >-
    Kentico commits not to pursue legal action against good-faith reporters who
    avoid malicious activity before, during, or after reporting.
  confidentiality_required: true
  confidentiality_detail: >-
    Researchers may not publicly disclose a vulnerability or share it with third
    parties without explicit written permission from Kentico.
  response_sla: none published ("aim to respond as promptly as possible")
  submission_requirements: >-
    Complete, detailed reports with a proof-of-concept demonstration.
    Incomplete submissions may not receive attention.
  pgp_key: null
  third_party_platform: null
evidence:
  - source: https://www.kentico.com/vulnerability-disclosure-program
    kind: disclosure policy page
    http_status: 200
    fetched: '2026-08-13'
  - source: https://www.kentico.com/.well-known/security.txt
    kind: security.txt (live probe)
    http_status: 200
    fetched: '2026-08-13'
    content: "Contact: mailto:security@kentico.com"
    gap: >-
      The served security.txt carries only a Contact line. RFC 9116 requires an
      Expires field, and the file does not point at the published disclosure
      policy with a Policy: field even though that page exists.