Kolide Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.kolide.com/security
url: https://www.kolide.com/security
program:
  type: bug bounty
  platform: HackerOne
  public: false
  invitation_required: true
  how_to_join: >-
    Researchers request an invitation to the private HackerOne program by emailing
    security@kolide.co.
  scope:
  - Kolide web application
  - Kolide API (api.kolide.com)
  - The Kolide agent (osquery launcher)
  reward: Described by Kolide as a "generous" bounty; no published reward table.
contact:
  email: security@kolide.co
security_txt:
  published: false
  probed:
  - {url: 'https://www.kolide.com/.well-known/security.txt', status: 404}
  - {url: 'https://kolide.com/.well-known/security.txt', status: 404}
  - {url: 'https://api.kolide.com/.well-known/security.txt', status: 404}
practices:
- Engages professional compliance auditors, penetration testers and independent
  security researchers.
- Automated vulnerability scanning.
- Continuous code review as part of the deployment model.
evidence:
- source: https://www.kolide.com/security
  kind: disclosure page
  keywords:
  - security research
  - bug bounty
  - hackerone
  - security@
gaps:
- No RFC 9116 security.txt on any host — machine discovery of the contact is impossible.
- The HackerOne program is invitation-only with no public program URL.