Mailerlite Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.mailerlite.com/legal/responsible-disclosure-program
notes: >-
  MailerLite publishes a Responsible Disclosure Program with a bug bounty, found
  via the legal index at https://www.mailerlite.com/legal (fetched 2026-08-13,
  HTTP 200). It is NOT discoverable from any /.well-known/security.txt —
  MailerLite serves no security.txt on any host (see
  well-known/mailerlite-well-known.yml), and it is not linked from the developer
  portal, so a machine looking in the conventional places will miss it entirely.

policy:
  - https://www.mailerlite.com/legal/responsible-disclosure-program
contact:
  - security@mailerlite.com

program:
  name: Responsible Disclosure Program
  url: https://www.mailerlite.com/legal/responsible-disclosure-program
  http_status: 200
  self_hosted: true
  platform: none
  platform_note: >-
    Not on HackerOne, Bugcrowd or Intigriti — hackerone.com/mailerlite and
    bugcrowd.com/mailerlite both return 404 (probed 2026-08-13). Reports go
    directly to security@mailerlite.com.
  rewards: true
  rewards_detail: >-
    Bounties are offered for severe vulnerabilities meeting stated criteria
    (researcher aged 15+, legal compliance, non-employee). Paid by PayPal or
    wire transfer, "granted solely at the exclusive discretion of the service
    provider" — no published reward table or minimum.
  safe_harbor: false
  safe_harbor_detail: >-
    No explicit good-faith safe-harbor clause. The program instead warns that
    "if you do not follow the terms of the Responsible Disclosure Program, we
    may initiate a lawsuit or law enforcement investigation against you."
    Researchers get discretionary rewards but no stated legal protection.
  out_of_scope:
    - vulnerabilities in third-party tools
    - outdated browsers
    - email spoofing via DMARC/SPF
    - issues requiring unlikely user interaction

security_txt:
  served: false
  hosts_probed:
    - {host: www.mailerlite.com, status: 429, note: "edge throttled during the probe run — unknown, not a confirmed absence"}
    - {host: connect.mailerlite.com, status: 403}
    - {host: api.mailerlite.com, status: 403}
    - {host: developers.mailerlite.com, status: 404}
    - {host: mcp.mailerlite.com, status: 404}
  recommendation: >-
    Publishing an RFC 9116 /.well-known/security.txt with
    `Policy: https://www.mailerlite.com/legal/responsible-disclosure-program`
    and `Contact: mailto:security@mailerlite.com` would make an existing,
    real program machine-discoverable. The program is the hard part and it is
    already done.

evidence:
  - {source: https://www.mailerlite.com/legal, kind: legal-index, status: 200, fetched: '2026-08-13'}
  - {source: https://www.mailerlite.com/legal/responsible-disclosure-program, kind: disclosure-policy, status: 200, fetched: '2026-08-13'}
  - {source: https://hackerone.com/mailerlite, kind: bounty-platform-probe, status: 404, fetched: '2026-08-13'}
  - {source: https://bugcrowd.com/mailerlite, kind: bounty-platform-probe, status: 404, fetched: '2026-08-13'}

maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com