Kondukto Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.invicti.com/.well-known/security.txt
notes: >-
  kondukto.io serves Invicti's canonical RFC 9116 security.txt following the acquisition, so the
  security contact for the Kondukto/Invicti ASPM product is Invicti's product security team. The
  document is well-formed: it carries a Canonical URI, a Contact address, an unexpired Expires
  field, a PGP public key for encrypted reports, and a Preferred-Languages field.
contact:
- mailto:security@invicti.com
canonical: https://www.invicti.com/.well-known/security.txt
expires: '2029-01-16T11:00:00.000Z'
encryption: inline PGP public key block (see well-known/kondukto-security.txt)
preferred_languages: [en]
policy: []
policy_published: false
bug_bounty:
  program: null
  platform: null
  note: >-
    No public bug-bounty or coordinated-disclosure policy page was found for kondukto.io or
    invicti.com. The security.txt provides a Contact address but no Policy URI. Invicti's marketing
    pages mention bug-bounty and VDP programs only as training data for their risk-scoring model,
    not as a program they operate.
evidence:
- source: https://kondukto.io/.well-known/security.txt
  kind: security.txt
  status: 200
  note: 301 redirect to https://www.invicti.com/.well-known/security.txt
  file: well-known/kondukto-security.txt
- source: well-known/kondukto-security.txt
  kind: security.txt (harvested)
- source: https://docs.kondukto.io/.well-known/security.txt
  kind: security.txt
  status: 404
checked:
- url: https://www.invicti.com/security/
  status: 404
- url: https://www.invicti.com/compliance/
  status: 200
  note: compliance posture only, no disclosure policy
related:
  well_known: well-known/kondukto-well-known.yml
  trust_center: security/kondukto-trust-center.yml