Mosaic Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://www.acosta.group/security/
scope: parent-company
scope_note: >-
  Mosaic is one of the pillar agencies of Acosta Group and serves its own Policies links
  (terms, privacy, accessibility, "Security Compliance") from www.acosta.group — both in
  the mosaic.com footer and in the company-authored https://www.mosaic.com/llms.txt.
  The policy itself states it applies to "Acosta Inc. and its subsidiaries (collectively
  ... 'Acosta Group')", so Mosaic is explicitly in scope. Mosaic serves no security.txt
  and no disclosure page of its own on www.mosaic.com — every /.well-known/ path 404s
  (see well-known/mosaic-well-known.yml).
policy:
  - https://www.acosta.group/security/
  - https://www.acosta.group/wp-content/uploads/2026/04/Acosta-Group-Vulnerability-Disclosure-Policy-March-31-2026.pdf
contact:
  - AskCompliance@acosta.com
security_txt: false
bug_bounty: false
bug_bounty_note: No HackerOne, Bugcrowd or Intigriti program found; reporting is by email to the compliance team.
policy_detail:
  title: Vulnerability Disclosure Policy
  publisher: Acosta Inc. (Acosta Group)
  published: '2026-03-31'
  format: pdf
  in_scope:
    - Public facing websites and applications owned or operated by the Company
    - Public APIs and associated services
    - Cloud hosted infrastructure and assets under our direct control
  out_of_scope:
    - Social engineering (phishing, vishing, impersonation)
    - Physical security testing
    - Denial-of-Service (DoS) or stress testing
    - Use of automated scanners that may impact system stability
    - Third-party platforms or services not owned by us
  acknowledgement_sla: 5 business days
  safe_harbor: true
  safe_harbor_note: >-
    Good-faith research conducted within the policy is considered authorized; the company
    commits to not initiating legal action and to optional public credit once resolved.
  encrypted_reporting: PGP key available on request
  hall_of_fame: mentioned (Security Hall of Fame page) — no public URL published
evidence:
  - source: https://www.acosta.group/security/
    kind: disclosure-page
    status: 200
    keywords: [vulnerability disclosure policy, responsibly report, security team]
  - source: https://www.acosta.group/wp-content/uploads/2026/04/Acosta-Group-Vulnerability-Disclosure-Policy-March-31-2026.pdf
    kind: policy-document
    status: 200
    content_type: application/pdf
    bytes: 342879
  - source: https://www.mosaic.com/llms.txt
    kind: provider-authored-index
    status: 200
    note: Policies section lists "Security Compliance" pointing at acosta.group
  - source: https://www.mosaic.com/.well-known/security.txt
    kind: negative-probe
    status: 404