Meredith Vulnerability Disclosure

generated: '2026-08-12'
method: searched
probe: true
source: https://people.com/.well-known/security.txt
description: |
  People Inc (formerly Dotdash Meredith) runs a PRIVATE, invitation-only
  HackerOne program for coordinated vulnerability disclosure. It is advertised
  the correct way — an RFC 9116 /.well-known/security.txt served at HTTP 200
  as text/plain from the consumer brand domains — but the program itself is
  not publicly enumerable.

program:
  vendor: HackerOne
  visibility: private
  self_declared: true
  declaration: |
    "Dotdash uses a private HackerOne program for responsible disclosure.
    If you wish to report an issue, please use the URL below:"
  note: |
    The security.txt still says "Dotdash", the pre-2021 corporate name, three
    corporate rebrands later (Dotdash -> Dotdash Meredith -> People Inc,
    July 31 2025). The file has not been revised since the rebrand.

policy:
  - url: https://hackerone.com/dotdashmeredith
    http_status: 404
    reachable: false
    note: |
      The Policy: URI published in security.txt is a HackerOne program page
      that returns 404 to an anonymous visitor. This is expected for a private
      program — HackerOne does not render an unlisted program to the public —
      but it means the DECLARED policy document is not actually readable by
      the researcher the file is addressed to. RFC 9116 §2.5.4 expects Policy
      to resolve.

contact:
  - url: https://hackerone.com/b6bf1613-5ba4-4ce3-b371-ac47e4507b5d/embedded_submissions/new
    http_status: 200
    reachable: true
    kind: HackerOne embedded submission form
    note: |
      This DOES resolve. An unauthenticated researcher can file a report
      through the embedded form without a HackerOne account invitation, so
      the intake path works even though the policy page does not.

fields:
  contact: true
  expires: false
  encryption: false
  acknowledgments: false
  preferred_languages: en
  canonical: false
  policy: true
  hiring: false
  csaf: false

rfc9116_conformance:
  spec: RFC 9116
  grade: near-conformant
  deviations:
    - id: no-expires
      severity: required
      detail: |
        RFC 9116 §2.5.5 makes the Expires field REQUIRED. It is absent, so a
        consumer cannot tell whether this file is current or abandoned.
    - id: policy-uri-404
      severity: advisory
      detail: The Policy URI resolves 404 to anonymous clients (private program).
    - id: no-canonical
      severity: optional
      detail: No Canonical field, so the file cannot be self-attested per host.
    - id: not-signed
      severity: optional
      detail: Not OpenPGP-signed.

coverage:
  served_on:
    - people.com
    - www.allrecipes.com
    - www.investopedia.com
    - www.bhg.com
  identical_bytes: 292
  not_served_on:
    - host: www.people.inc
      http_status: 404
      detail: |
        The CORPORATE domain — the one a security researcher would try first,
        and the one carrying the company's current name — does not serve
        security.txt. Only the consumer brand domains do.

bug_bounty:
  present: true
  public: false
  platform: HackerOne
  scope_published: false
  rewards_published: false
  safe_harbor_published: false
  note: |
    None of scope, reward table, or safe-harbour language is publicly
    readable, because the program page is private. Recorded as present but
    unverifiable in its terms.

evidence:
  - url: https://people.com/.well-known/security.txt
    status: 200
    content_type: text/plain
    fetched: '2026-08-12'
  - url: https://www.allrecipes.com/.well-known/security.txt
    status: 200
    content_type: text/plain
    fetched: '2026-08-12'
  - url: https://www.investopedia.com/.well-known/security.txt
    status: 200
    content_type: text/plain
    fetched: '2026-08-12'
  - url: https://www.bhg.com/.well-known/security.txt
    status: 200
    content_type: text/plain
    fetched: '2026-08-12'
  - url: https://www.people.inc/.well-known/security.txt
    status: 404
    fetched: '2026-08-12'
  - url: https://hackerone.com/dotdashmeredith
    status: 404
    fetched: '2026-08-12'
  - url: https://hackerone.com/b6bf1613-5ba4-4ce3-b371-ac47e4507b5d/embedded_submissions/new
    status: 200
    fetched: '2026-08-12'
  - source: well-known/meredith-security.txt
    kind: security.txt (harvested verbatim this round)