Mediamath Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://apidocs.mediamath.com/guides/security-best-practices
program:
  published: true
  type: security-contact
  contact: mailto:security@mediamath.com
  policy_url: https://apidocs.mediamath.com/guides/security-best-practices
  statement: >-
    "If you believe you have identified a vulnerability in the MediaMath platform
    please contact security@mediamath.com."
  bug_bounty: false
  bounty_platform: null
  safe_harbor: null
  scope: null
  response_sla: null
security_txt:
  served: false
  probed:
    - url: https://apidocs.mediamath.com/.well-known/security.txt
      status: 404
    - url: https://api.mediamath.com/.well-known/security.txt
      status: 404
    - url: https://www.mediamath.com/.well-known/security.txt
      status: 404
    - url: https://infillion.com/.well-known/security.txt
      status: 404
  note: >-
    A disclosure contact IS published, but only in prose on a docs page. No RFC
    9116 security.txt is served from any MediaMath or Infillion host, so an
    automated scanner cannot find it. Publishing
    /.well-known/security.txt with Contact and Policy fields would make the
    existing program machine-discoverable at essentially zero cost.
related_security_guidance:
  - topic: MFA
    detail: Platform supports SMS and TOTP; docs strongly recommend TOTP over SMS.
  - topic: password policy
    detail: Password policy follows NIST guidance; account sharing is prohibited by docs.
  - topic: credential rotation
    detail: >-
      API Usage Terms and the auth guide both require application owners to
      protect client IDs/secrets and to be prepared to rotate them on compromise.
x-evidence:
  fetched: '2026-08-13'
  url: https://apidocs.mediamath.com/guides/security-best-practices.md
  http_status: 200