Metriport Vulnerability Disclosure

generated: '2026-08-14'
method: searched
source: https://github.com/metriport/metriport/blob/develop/SECURITY.md
description: >-
  Metriport publishes a vulnerability disclosure policy, but only in the
  open-source repository — there is no security.txt on any host (every
  /.well-known/security.txt probe returned 403 on the API hosts and 404 on the
  marketing and documentation hosts, see well-known/metriport-well-known.yml).
  The policy is short and covers both the source code and the hosted API.
published: true
policy_url: https://github.com/metriport/metriport/blob/develop/SECURITY.md
raw_url: https://raw.githubusercontent.com/metriport/metriport/develop/SECURITY.md
http_status: 200
checked: '2026-08-14'
scope: The Metriport API and/or source code.
channels:
  - type: github-private-vulnerability-reporting
    url: https://github.com/metriport/metriport/security
    preferred: true
  - type: email
    address: support@metriport.com
preferred_languages: [en]
commitments:
  - We will investigate all legitimate reports.
  - We will do our best to quickly fix the problem.
missing:
  security_txt: >-
    SECURITY.md embeds a security.txt-shaped block (Contact, Preferred-Languages,
    Policy) in a fenced code block, but it is never served at
    /.well-known/security.txt on any host. The content exists; the RFC 9116
    discovery path does not.
  bug_bounty: >-
    No bug bounty programme. No HackerOne, Bugcrowd or Intigriti presence was
    found.
  safe_harbor: No safe-harbor or legal-protection language is published.
  disclosure_timeline: No acknowledgement window, remediation SLA or coordinated-disclosure timeline is stated.
  hall_of_fame: None.
  pgp_key: None.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com