Localytics Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.localytics.com/security
note: >-
  Localytics publishes a dated Security Overview (last updated 2026-04-29) that names a security
  contact and describes a vulnerability-management and incident-response program. It does NOT
  publish a coordinated vulnerability disclosure policy, safe-harbour language, a bug-bounty
  program, or an RFC 9116 security.txt. The distinction matters: a researcher can reach Localytics,
  but has no published terms under which to report. Recorded as found, not upgraded.
security_policy:
  url: https://www.localytics.com/security
  title: Localytics Security Overview
  last_updated: '2026-04-29'
  http_status: 200
  probed: '2026-08-13'
contact:
  - address: support@localytics.com
    detail: '"For security inquiries, email: support@localytics.com" — a general support address, not a dedicated security@ alias.'
policy: []
disclosure_program:
  published: false
  bug_bounty: false
  safe_harbour: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  detail: No bug bounty or coordinated disclosure program found for localytics.com.
security_txt:
  published: false
  probed_hosts:
    - { url: 'https://www.localytics.com/.well-known/security.txt', status: 404 }
    - { url: 'https://docs.localytics.com/.well-known/security.txt', status: 404 }
    - { url: 'https://api.localytics.com/.well-known/security.txt', status: 404 }
    - { url: 'https://messaging.localytics.com/.well-known/security.txt', status: 404 }
    - { url: 'https://profile.localytics.com/.well-known/security.txt', status: 404 }
published_program:
  vulnerability_management:
    - Continuous scanning
    - Penetration testing
    - Patch SLAs
  monitoring_and_detection: [CloudWatch, GuardDuty, PagerDuty]
  intrusion_protection: [Intrusion detection systems, AWS network protections]
  incident_response:
    plan: true
    detail: >-
      Incident Response Plan covering detection and escalation, response procedures, communication
      workflows and remediation. Localytics commits to notifying customers of confirmed security
      incidents in accordance with applicable law and contractual obligations.
  secure_development: [Code versioning, Change management, Testing environments, Deployment approvals]
evidence:
  - { source: 'https://www.localytics.com/security', kind: security-policy-page, status: 200, checked: '2026-08-13' }
gaps:
  - No /.well-known/security.txt on any host.
  - No coordinated disclosure policy, reporting terms or safe harbour.
  - No dedicated security@ contact; security reports route through general support.