Listrak Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.listrak.com/privacy-and-terms/responsible-disclosure
notes: >-
  Listrak publishes a named Vulnerability Disclosure Policy as an HTML page in its legal section and
  links to it from its Security Policy page and site footer. It is NOT published as an RFC 9116
  /.well-known/security.txt - that path returns 404 on every Listrak host (see
  well-known/listrak-well-known.yml) - so an automated security.txt probe misses this program
  entirely. Reported by SEARCH of the site footer, then fetched and read.
policy:
- https://www.listrak.com/privacy-and-terms/responsible-disclosure
contact:
- security@listrak.com
program:
  type: responsible-disclosure
  bug_bounty: false
  bounty_note: >-
    The policy states monetary rewards are not guaranteed for validated submissions. There is no
    HackerOne, Bugcrowd or Intigriti program.
  safe_harbor: not-stated
  intake: email
  acknowledgement: >-
    Listrak commits to acknowledging an emailed report, assigning resources to investigate and
    confirm the issue, and addressing potential problems as appropriate. Reporters are asked to keep
    findings confidential.
in_scope:
- OWASP Top 10 class vulnerabilities
- Authentication and authorization flaws
- Information disclosure
- Business logic weaknesses
out_of_scope:
- Automated scanning tools
- Social engineering
- Physical attacks
- Testing third parties
- Denial of service
- Unauthorized access to data
- Anything that may degrade platform performance or availability
security_program:
  url: https://www.listrak.com/privacy-and-terms/security-policy
  controls_published:
  - SAML-based single sign-on (customer IdP)
  - Two-factor authentication, cannot be disabled
  - Failed-attempt lockout and password complexity policy
  - One-way encryption of user passwords; two-way encryption of integration credentials
  - Password reset requires out-of-band phone identification
  - TLS 1.2 for admin portal and API communications
  - AES-256 encryption at rest
  - Badge access, video surveillance and third-party audits at all physical locations
  - Real-time platform log monitoring and audit logs
  - Monthly vulnerability scans across all networks
  - Annual security and privacy audits by three separate third parties
  certifications_named: []
  certifications_note: >-
    The Security Policy page describes annual third-party audits but names no certification
    framework (no SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim appears anywhere on the public
    site). Do not infer one.
evidence:
- source: https://www.listrak.com/privacy-and-terms/responsible-disclosure
  http_status: 200
  kind: disclosure-policy-page
  fetched: '2026-08-13'
- source: https://www.listrak.com/privacy-and-terms/security-policy
  http_status: 200
  kind: security-policy-page
  fetched: '2026-08-13'
- source: https://www.listrak.com/.well-known/security.txt
  http_status: 404
  kind: security.txt-absent
  fetched: '2026-08-13'