Limehome · Vulnerability Disclosure

Limehome Vulnerability Disclosure

Vulnerability disclosure

Limehome publishes a valid RFC 9116 security.txt with a dedicated security contact address and a PGP key for encrypted reports. There is no public bug bounty program.

Limehome runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

CompanyConsumerHospitalityTravelReal-EstatePropTechShort-Term RentalAparthotelGermanyEurope

Program: Hackerone security.txt present

Disclosure Policy

Policy

"Declared as the Policy: field of security.txt, but the URL returns the site's 56757-byte Angular SPA shell (the same body served for unknown paths) rather than a published disclosure policy. The policy page appears to be missing or unpublished as of 2026-07-19. Reporters must fall back to the contact address.", "status" => 200, "url" => "https://limehome.com/security", "verified" => false}" target="_blank" rel="noopener">{"note" => "Declared as the Policy: field of security.txt, but the URL returns the site's 56757-byte Angular SPA shell (the same body served for unknown paths) rather than a published disclosure policy. The policy page appears to be missing or unpublished as of 2026-07-19. Reporters must fall back to the contact address.", "status" => 200, "url" => "https://limehome.com/security", "verified" => false}

Security Contact

Contact

mailto:security@limehome.com

Source

Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.limehome.com/.well-known/security.txt
description: >-
  Limehome publishes a valid RFC 9116 security.txt with a dedicated security
  contact address and a PGP key for encrypted reports. There is no public bug
  bounty program.
policy:
- url: https://limehome.com/security
  status: 200
  verified: false
  note: >-
    Declared as the Policy: field of security.txt, but the URL returns the site's
    56757-byte Angular SPA shell (the same body served for unknown paths) rather
    than a published disclosure policy. The policy page appears to be missing or
    unpublished as of 2026-07-19. Reporters must fall back to the contact address.
contact:
- mailto:security@limehome.com
encryption:
- url: https://limehome.com/.well-known/pgp-key.txt
  status: 200
  verified: true
  file: well-known/limehome-pgp-key.txt
  note: A real PGP public key block, harvested verbatim.
preferred_languages:
- en
canonical: https://limehome.com/.well-known/security.txt
expires: '2028-11-27T00:00:00Z'
bug_bounty:
  program: none
  platforms_checked:
  - hackerone
  - bugcrowd
  - intigriti
  result: no public bug bounty or managed disclosure program found
evidence:
- source: well-known/limehome-security.txt
  kind: RFC 9116 security.txt harvested verbatim from https://www.limehome.com/.well-known/security.txt
  status: 200
  content_type: text/plain
- source: well-known/limehome-pgp-key.txt
  kind: PGP public key referenced by the security.txt Encryption field
  status: 200
gaps:
- The Policy URL declared in security.txt does not resolve to a real policy page.
- No CAA records and no DNSSEC on limehome.com (see limehome-domain-security.yml).
- No HSTS on www.limehome.com (see limehome-domain-security.yml).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/limehome-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.