Linode Vulnerability Disclosure

generated: '2026-09-17'
method: searched
source: https://www.linode.com/.well-known/security.txt, https://hackerone.com/linode
provider: Linode (Akamai Cloud)
providerId: linode
published: true
program:
  type: bug-bounty
  platform: HackerOne
  url: https://hackerone.com/linode
  scope: Akamai Connected Cloud / Linode
  note: Akamai runs separate HackerOne programs per product line; hackerone.com/linode is the one covering Akamai
    Connected Cloud (Linode). hackerone.com/akamai covers the CDN.
contacts:
- channel: email
  value: security@akamai.com
  note: 'Named as Contact: in Linode''s security.txt; an encryption key is offered alongside it.'
- channel: email
  value: abuse@akamai.com
  note: Abuse reports, named in the same security.txt.
security_txt:
  url: https://www.linode.com/.well-known/security.txt
  served: true
  probe_status: 403
  note: Served, but not to us. Every request from this network — browser User-Agent and full Sec-Fetch header set
    included — is turned away by Akamai's own bot manager with a 403. An independent client fetched the same URL
    successfully and it carries the contacts, the HackerOne program links and the preferred language, so the document
    exists and is correct. No verbatim body was captured here, so none is stored and no SecurityTxt pointer is claimed
    on it.
preferred_languages:
- en
evidence:
- url: https://hackerone.com/linode
  status: 200
- url: https://www.linode.com/.well-known/security.txt
  status: 403
  note: bot-manager challenge; confirmed served by an independent fetch
- url: https://www.akamai.com/.well-known/security.txt
  status: 403
  note: Akamai edge Access Denied on the parent-brand host