Prismic Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://prismic.io/legal/security
url: https://prismic.io/legal/security
contact:
  - security@prismic.io
contact_evidence: >-
  A live mailto:security@prismic.io link on https://prismic.io/legal/security
  (HTTP 200, fetched 2026-08-13), under "Anything else you'd like to know — about
  security or else? Send us an email."
policy: []
policy_note: >-
  There is a security CONTACT but no responsible-disclosure POLICY. Prismic
  publishes no vulnerability disclosure program, no safe-harbour statement, no
  scope definition, no response-time commitment and no coordinated-disclosure
  timeline. The security@ address is framed as a general enquiry channel, not as
  a reporting endpoint for researchers.
bug_bounty:
  program: none
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: no program found
security_txt:
  served: false
  probed: '2026-08-13'
  hosts_probed: [prismic.io, prismic-main.cdn.prismic.io, customtypes.prismic.io, asset-api.prismic.io,
    migration.prismic.io, mcp.prismic.io]
  results: 404 on prismic.io, migration.prismic.io and mcp.prismic.io; 403 on the AWS-fronted
    API hosts
  artifact: well-known/prismic-well-known.yml
  note: >-
    No RFC 9116 security.txt on any Prismic host. A researcher who finds a
    vulnerability has to locate the legal/security page and infer that the
    general security@ address is the right place to send it.
related_practices:
  penetration_tests: yearly, external contractors
  vulnerability_scanning: continuous
  detail: security/prismic-trust-center.yml
evidence:
  - {source: 'https://prismic.io/legal/security', kind: security policy page, http_status: 200,
     fetched: '2026-08-13', found: [mailto security@prismic.io, vulnerability scanning,
      penetration tests, incident response plan]}
  - {source: 'https://prismic.io/.well-known/security.txt', http_status: 404, fetched: '2026-08-13'}