Nativo Vulnerability Disclosure

generated: '2026-08-26'
method: probed
source: https://life360.com/.well-known/security.txt
name: Nativo
program_published: true
published_by: parent
summary: >-
  Nativo itself publishes NO vulnerability disclosure route — no security.txt on any nativo.com
  host, no /security page, no disclosure policy in its docs, and no security@nativo.com address
  anywhere on its public surface. The route that DOES exist belongs to its parent: Life360 serves
  an RFC 9116 security.txt at life360.com, and since the Life360 acquisition closed on 2026-01-05
  the Nativo corporate site IS ads.life360.com, so the parent's policy is the applicable channel
  for a Nativo finding. This is recorded as parent-published, not Nativo-published, so the
  distinction survives.
contacts:
- type: url
  value: https://hackerone.com/life360
  note: >-
    Listed in the Life360 security.txt. The HackerOne page itself returns 404 to an anonymous
    fetch (probed 2026-08-26), which is the normal shape of a PRIVATE, invitation-only HackerOne
    program — the program exists but its page is not public.
- type: email
  value: responsibledisclosure@life360.com
  note: The directly usable channel; requires no HackerOne account.
evidence:
- source: https://life360.com/.well-known/security.txt
  kind: security.txt (live probe)
  status: 200
  note: >-
    Retrieved by the pipeline probe. A follow-up re-fetch from this workstation was answered with
    a Cloudflare 403 bot challenge, which is an edge policy against our crawler and not evidence
    the document is absent.
- source: https://nativo.com/.well-known/security.txt
  kind: negative probe
  status: 404
- source: https://api.nativo.com/.well-known/security.txt
  kind: negative probe
  status: 404
- source: https://api-docs.nativo.com/.well-known/security.txt
  kind: negative probe
  status: 404
- source: https://ads.life360.com/.well-known/security.txt
  kind: negative probe
  status: 404
  note: >-
    Notable — the Nativo corporate site does NOT itself serve the parent's security.txt. A
    researcher who lands on ads.life360.com has no in-band pointer to the disclosure channel.
- source: https://hackerone.com/life360
  kind: program page
  status: 404
bug_bounty:
  platform: HackerOne
  handle: life360
  public: false
  paid: unknown
security_posture_reference:
  note: >-
    Nativo's own published security controls — including two third-party black-box penetration
    tests per year against the web application AND API, covering OWASP Top 10, ASVS and business
    logic — are recorded in conformance/nativo-conformance.yml under compliance_program, sourced
    from the Technical and Organizational Security Measures page.
  url: https://ads.life360.com/legal/technical-organizational-measures
gap:
  finding: >-
    No security.txt on any Nativo-controlled host, and no disclosure contact on the Nativo
    corporate site. A researcher who finds a bug in api.nativo.com has no published, in-band way
    to report it — they have to know about the parent company and go look at life360.com.
  remedy: >-
    Serve /.well-known/security.txt on nativo.com, api.nativo.com and ads.life360.com pointing at
    the existing Life360 policy and responsibledisclosure@life360.com. The program already exists;
    only the pointer is missing.