Limehome Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.limehome.com/.well-known/security.txt
description: >-
  Limehome publishes a valid RFC 9116 security.txt with a dedicated security
  contact address and a PGP key for encrypted reports. There is no public bug
  bounty program.
policy:
- url: https://limehome.com/security
  status: 200
  verified: false
  note: >-
    Declared as the Policy: field of security.txt, but the URL returns the site's
    56757-byte Angular SPA shell (the same body served for unknown paths) rather
    than a published disclosure policy. The policy page appears to be missing or
    unpublished as of 2026-07-19. Reporters must fall back to the contact address.
contact:
- mailto:security@limehome.com
encryption:
- url: https://limehome.com/.well-known/pgp-key.txt
  status: 200
  verified: true
  file: well-known/limehome-pgp-key.txt
  note: A real PGP public key block, harvested verbatim.
preferred_languages:
- en
canonical: https://limehome.com/.well-known/security.txt
expires: '2028-11-27T00:00:00Z'
bug_bounty:
  program: none
  platforms_checked:
  - hackerone
  - bugcrowd
  - intigriti
  result: no public bug bounty or managed disclosure program found
evidence:
- source: well-known/limehome-security.txt
  kind: RFC 9116 security.txt harvested verbatim from https://www.limehome.com/.well-known/security.txt
  status: 200
  content_type: text/plain
- source: well-known/limehome-pgp-key.txt
  kind: PGP public key referenced by the security.txt Encryption field
  status: 200
gaps:
- The Policy URL declared in security.txt does not resolve to a real policy page.
- No CAA records and no DNSSEC on limehome.com (see limehome-domain-security.yml).
- No HSTS on www.limehome.com (see limehome-domain-security.yml).