Nylas Vulnerability Disclosure

generated: '2026-08-20'
method: provider-published
authored_by: Nylas
source: https://www.nylas.com/security/
trust_center: https://trust.nylas.com/public
contact: security@nylas.com
programs:
- type: Vulnerability Disclosure Program
  status: published
  route: security@nylas.com
- type: Bug bounty
  status: private
  note: Invitation-based rather than a public programme.
- type: Independent penetration testing
  status: annual
  reports_available: true
  access: via the Trust Center at https://trust.nylas.com/public
description: >-
  Nylas publishes a Vulnerability Disclosure Program on its security page, runs a
  private bug bounty, and commissions independent penetration testing annually,
  with the resulting reports available through the Trust Center. Reports are
  routed to security@nylas.com.
evidence:
- source: https://www.nylas.com/security/
  kind: disclosure page
  found:
  - Vulnerability Disclosure Program
  - private Bug Bounty
  - independent penetration testing conducted annually
  - security@nylas.com
notes: >-
  Nylas does not currently serve /.well-known/security.txt on any host; the
  disclosure route is published on the security page and as the contact address
  above.