Optinmonster Vulnerability Disclosure

generated: '2026-08-12'
method: searched
source: https://optinmonster.com/security/
note: >-
  OptinMonster publishes a "Security and Reliability Safeguards" page carrying a role-address
  security contact. That is a real, published intake channel, so this artifact is written and a
  `Security` pointer is wired in apis.yml. It is however the weakest form of the surface: there is
  no policy text, no safe-harbour statement, no scope, no response-time commitment, no PGP key, and
  no RFC 9116 security.txt at any well-known location on any host (all probed — see
  well-known/optinmonster-well-known.yml). There is no bug bounty program: HackerOne, Bugcrowd and
  Intigriti carry no OptinMonster or Awesome Motive program.
disclosure:
  channel: email
  contact: security@optinmonster.com
  contact_source: >-
    Published on https://optinmonster.com/security/ under "If you have any security concerns or
    questions feel free to contact us". The address is obfuscated on the page by Cloudflare email
    protection; decoded from the page's own `data-cfemail` attribute.
  policy_published: false
  policy_url: null
  safe_harbor: false
  scope_defined: false
  response_sla: null
  pgp_key: false
  encryption: false
  preferred_languages: null
security_txt:
  served: false
  rfc9116: false
  probes:
  - url: https://optinmonster.com/.well-known/security.txt
    http_status: 404
  - url: https://api.optinmonster.com/.well-known/security.txt
    http_status: 301
  - url: https://app.optinmonster.com/.well-known/security.txt
    http_status: 301
  - url: https://api.omwpapi.com/.well-known/security.txt
    http_status: 301
  fetched: '2026-08-12'
bug_bounty:
  exists: false
  platform: null
  programs_checked:
  - hackerone
  - bugcrowd
  - intigriti
  note: No public program found for OptinMonster or its parent, Awesome Motive.
published_safeguards:
  note: >-
    Recorded verbatim as vendor claims from the security page. These are infrastructure assertions,
    not audited controls, and none is backed by a named certification.
  claims:
  - 256-bit SSL encryption for data in transit
  - Sucuri vulnerability monitoring and scanning
  - Amazon infrastructure for redundant storage and servers
  - Pagely hosting (Amazon partner)
  - Bunny.net CDN
  - Geographic data replication across multiple locations
certifications:
  soc2: false
  iso27001: false
  pci_dss: false
  hipaa: false
  fedramp: false
  note: >-
    No named certification appears anywhere on the security page, the GDPR page, or the site. No
    trust center exists — trust.optinmonster.com returns 501 and optinmonster.com/trust/ is a
    product review article, not a compliance surface. No `Compliance` or `TrustCenter` pointer is
    emitted.
x-evidence:
  fetched: '2026-08-12'
  url: https://optinmonster.com/security/
  http_status: 200
gaps:
- No RFC 9116 security.txt on any host.
- No written disclosure policy, scope, or safe-harbour statement.
- No response-time commitment for reported vulnerabilities.
- No PGP key or encrypted submission channel.
- No bug bounty or coordinated disclosure program.
- No named security certification and no trust center.