Klue Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: well-known/klue-security.txt
probe_note: >-
  probe-security-programs.py re-ran on 2026-08-14 and wrote a thinner derived
  version over this file; the searched file was restored from git and the new
  incident_disclosure finding merged in by hand. A searched artifact is never
  downgraded by a probe.
policy:
- https://klue.com/privacy
contact:
- mailto:security@klue.com
security_txt:
  url: https://klue.com/.well-known/security.txt
  status: 200
  file: well-known/klue-security.txt
  standard: RFC 9116
  fields:
    canonical: https://klue.com/.well-known/security.txt
    contact: mailto:security@klue.com
    expires: '2030-12-31T12:00:00Z'
    hiring: https://klue.com/careers
    policy: https://klue.com/privacy
    preferred_languages: en
bug_bounty:
  program: null
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program found. Disclosure is handled by
    direct email to security@klue.com as published in security.txt.
penetration_testing:
  external_tests: true
  report_request: mailto:security@klue.com?subject=External Penetration Test Request
  source: https://klue.com/product/security
incident_disclosure:
  published: true
  url: https://klue.com/blog/an-update-on-recent-klue-security-incident
  http_status: 200
  date: '2026-06-18'
  title: An Update on the Recent Klue Security Incident
  fetched: '2026-08-14'
  summary: >-
    Klue published a first-party account of the June 2026 incident in which an
    attacker used a compromised legacy integration credential to obtain OAuth
    tokens for connected third-party platforms including Salesforce. Klue states
    it found no evidence that customer content stored within the Klue platform
    itself was impacted. Recorded here as evidence that Klue's disclosure practice
    extends beyond a security.txt contact address to actual public incident
    reporting on its own domain, naming a detection date, response steps and a
    contact address.
  detail: lifecycle/klue-lifecycle.yml
evidence:
- source: well-known/klue-security.txt
  kind: security.txt
- source: https://klue.com/product/security
  kind: security-page
- source: https://klue.com/blog/an-update-on-recent-klue-security-incident
  kind: incident-disclosure
notes: >-
  The security.txt Policy field points at Klue's privacy page rather than a
  dedicated vulnerability-disclosure policy; the Contact field is a working
  security mailbox. Recorded as published, with the caveat noted.