Permutive Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://docs.permutive.com/governance/security
notes: >-
  Permutive publishes a security-practices page in its developer documentation
  that names a vulnerability-disclosure route and a security contact. The
  program itself is PRIVATE — Permutive states it "operates a private
  vulnerability disclosure and bug bounty program to facilitate responsible
  reporting of security issues" — so there is no public program page on
  HackerOne, Bugcrowd or Intigriti to point at, and no RFC 9116 security.txt is
  served on any Permutive host (probed: permutive.com, api.permutive.com,
  docs.permutive.com — all 404 except SPA shells, see well-known/).
  What IS published and machine-verifiable is the reporting address and the
  policy statement, which is what this artifact records.
policy:
- https://docs.permutive.com/governance/security
contact:
- security@permutive.com
program:
  type: private-bug-bounty
  public_platform: null
  public_program_page: null
  statement: >-
    "Private bug bounty program: Permutive operates a private vulnerability
    disclosure and bug bounty program to facilitate responsible reporting of
    security issues."
  independent_pen_testing: >-
    "External penetration tests are conducted by independent security
    specialists on a regular basis." Reports are made available through the
    Trust Center.
  incident_response: >-
    Documented incident-response processes with defined roles, escalation paths
    and communication procedures.
security_txt:
  served: false
  probed:
  - {url: 'https://permutive.com/.well-known/security.txt', status: 404}
  - {url: 'https://permutive.com/security.txt', status: 404}
  - {url: 'https://api.permutive.com/.well-known/security.txt', status: 404}
  - {url: 'https://docs.permutive.com/.well-known/security.txt', status: 404}
  recommendation: >-
    A single RFC 9116 security.txt on permutive.com naming
    security@permutive.com and the Trust Center policy URL would make this
    posture machine-discoverable. It is currently only readable in prose.
related_contacts:
- {address: 'datarequest@permutive.com', purpose: 'GDPR/CCPA data subject access and erasure requests (14-day SLA)',
   source: 'https://docs.permutive.com/governance/data-subject-requests'}
- {address: 'support@permutive.com', purpose: 'API and product support'}
evidence:
- {source: 'https://docs.permutive.com/governance/security', kind: security-policy-page,
   http_status: 200, keywords: ['private bug bounty program', 'vulnerability disclosure',
     'responsible reporting', 'security@permutive.com', 'penetration testing', 'incident response'],
   fetched: '2026-08-13'}
- {source: 'https://trust.permutive.com/', kind: trust-center, http_status: 200, fetched: '2026-08-13'}