Langai Vulnerability Disclosure

generated: '2026-07-19'
method: probed
probe: true
status: contact-only
summary: >-
  Lang.ai publishes no vulnerability disclosure policy, responsible-disclosure page or
  bug bounty program, and serves no /.well-known/security.txt — every path on lang.ai
  301-redirects to the Capacity landing page. The only machine-readable security contact
  found is the RFC 8659 CAA iodef record in lang.ai DNS.
policy: []
contact:
- mailto:security@lang.ai
bug_bounty: null
security_txt: null
evidence:
- source: 'DNS CAA record for lang.ai'
  kind: caa-iodef
  value: '0 iodef "mailto:security@lang.ai"'
  note: >-
    RFC 8659 iodef is the address a CA reports certificate-issuance incidents to; it is a
    published security contact but not a disclosure policy.
- source: https://lang.ai/.well-known/security.txt
  kind: security.txt
  http_status: 301
  result: >-
    Redirects to https://capacity.com/lang/?company=lang.ai and returns the marketing
    page as HTML 200 — no security.txt is served.
- source: https://capacity.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
- source: https://capacity.com/security/
  kind: security-page
  http_status: 200
  result: >-
    Describes encryption, compliance and access controls, but contains no responsible
    disclosure process, bug bounty, or security reporting address.
gaps:
- No /.well-known/security.txt on either lang.ai or capacity.com.
- No responsible-disclosure or vulnerability-disclosure policy page.
- No bug bounty program found on HackerOne, Bugcrowd or Intigriti.