Ledger Investing Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
status: program-asserted-no-public-policy
policy: []
contact: []
bug_bounty:
  platform: null
  url: null
  found: false
notes: >-
  Korra (the Ledger Investing subsidiary operating the Ledger Analytics API) asserts a
  "Responsible Disclosure" control under App Security in its SafeBase trust center, alongside
  Application Penetration Testing and Code Analysis, and invites contact with its security
  team. However no public disclosure POLICY document, no security@ contact address and no
  bug-bounty program URL are published — the control is asserted, the policy text is gated
  behind the trust center's access request. No /.well-known/security.txt exists on any host
  (see well-known/ledger-investing-well-known.yml). Recorded honestly: the program is
  asserted, the artifacts are not public.
evidence:
- source: https://trust.korra.com
  status: 200
  kind: trust-center-control
  control: Responsible Disclosure
  family: App Security
- source: https://www.ledgerinvesting.com/.well-known/security.txt
  status: 404
  kind: security.txt
- source: https://www.korra.com/.well-known/security.txt
  status: 404
  kind: security.txt
- source: https://api.korra.com/.well-known/security.txt
  status: 404
  kind: security.txt
probed_paths:
- {url: 'https://trust.korra.com', status: 200}
- {url: 'https://status.ledgerinvesting.com', status: 0, note: does not resolve}
- {url: 'https://trust.ledgerinvesting.com', status: 0, note: does not resolve}
gaps:
- Publish /.well-known/security.txt (RFC 9116) on ledgerinvesting.com, korra.com and api.korra.com.
- Publish an ungated responsible-disclosure policy page with a named security contact.