Malwarebytes Vulnerability Disclosure

generated: '2026-08-04'
method: searched
source: https://www.malwarebytes.com/secure/guidelines
summary: >-
  Malwarebytes runs a paid bug bounty on HackerOne alongside a published responsible
  disclosure policy and an RFC 9116 security.txt that points at both. CVEs for
  confirmed findings are assigned and published on a first-party CVE listing page.
program:
  published: true
  type: bug-bounty
  paid: true
  platform: HackerOne
  platform_url: https://hackerone.com/malwarebytes
  policy_url: https://www.malwarebytes.com/secure/guidelines
  contact_url: https://www.malwarebytes.com/secure/
  cve_listing: https://www.malwarebytes.com/secure/cves
  evidence: '"Malwarebytes offers cash bug bounties for the most interesting bugs."'
security_txt:
  published: true
  file: well-known/malwarebytes-security.txt
  hosts:
  - https://www.malwarebytes.com/.well-known/security.txt
  - https://cloud.malwarebytes.com/.well-known/security.txt
  fields:
    contact: https://www.malwarebytes.com/secure/
    expires: '2037-04-07T23:59:59.000Z'
    preferred_languages: en
    policy: https://www.malwarebytes.com/secure/guidelines
    hiring: https://jobs.malwarebytes.com/
  rfc9116_grade: minimal
  missing_fields:
  - Encryption
  - Acknowledgments
  - Canonical
  - CSAF
disclosure_terms:
  coordinated_disclosure_required: true
  embargo: >-
    Reporters agree they "will never disclose functioning exploit code (including
    binaries of that code) for the applicable vulnerability to any other entity until
    after the fix is acknowledged."
  prohibited: >-
    Public disclosure of proof-of-concept exploit code, or releasing vulnerability
    details before a fix is available, is treated as non-responsible disclosure.
gaps:
- >-
  No safe-harbor / authorized-testing legal language is stated on the public policy
  page; researchers must rely on the HackerOne program terms.
- >-
  No direct security contact email and no PGP/encryption key are published; the
  security.txt Contact field is a web form URL, and the Encryption field is absent.
- >-
  No response or triage SLA is published on the first-party page.
- >-
  security.txt Expires is set to 2037 — roughly eleven years out. RFC 9116 recommends
  an expiry under one year so the file is re-attested rather than left to rot.
- >-
  The ThreatDown business domains (threatdown.com, support.threatdown.com,
  api.threatdown.com) serve no security.txt of their own; a researcher looking at the
  API surface has no in-band path to the disclosure program.
x-evidence:
  fetched: '2026-08-04'
  urls:
  - url: https://www.malwarebytes.com/secure/guidelines
    http_status: 200
  - url: https://www.malwarebytes.com/.well-known/security.txt
    http_status: 200
    content_type: text/plain; charset=utf-8
  - url: https://hackerone.com/malwarebytes
    http_status: 200
  - url: https://www.malwarebytes.com/secure/cves
    http_status: 200
  - url: https://threatdown.com/.well-known/security.txt
    http_status: 404