Method Security Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: true
source: https://docs.method.security/platform/security-governance/reporting-security-concerns
policy:
- https://docs.method.security/platform/security-governance/reporting-security-concerns
contact:
- security@method.security
disclosure:
  responsible_disclosure: true
  ack_target: 2 business days
  subject_line: Security Vulnerability Report
  guidelines:
  - Act in good faith; avoid privacy violations, data destruction, or service disruption
  - Provide reasonable time to investigate and remediate before public disclosure
  - Avoid social engineering of employees, contractors, or customers
  - Keep the vulnerability confidential until coordinated disclosure
bug_bounty: null
evidence:
- source: https://docs.method.security/platform/security-governance/reporting-security-concerns
  kind: disclosure-page
  keywords:
  - responsible disclosure
  - security@method.security
  - vulnerability report
notes: >-
  Method publishes a responsible-disclosure process (not a paid bug bounty) via
  its docs security-governance section. No /.well-known/security.txt is served.
  The mechanical probe missed this page because it is under /platform/... rather
  than a standard disclosure path; captured here by search.