Riverlane Vulnerability Disclosure

generated: '2026-08-05'
method: searched
probe: true
source: https://github.com/Deltakit/deltakit/blob/main/docs/SECURITY.md
policy:
- https://github.com/Deltakit/deltakit/blob/main/docs/SECURITY.md
report_channel:
- https://github.com/Deltakit/deltakit/security
contact: []
mechanism: github-private-vulnerability-reporting
bug_bounty:
  program: false
  platforms_checked: [hackerone, bugcrowd, intigriti]
  result: none found
policy_summary: >-
  Deltakit asks that potential vulnerabilities be reported privately through GitHub's
  "Report a Vulnerability" feature on the Deltakit/deltakit repository, and explicitly asks that
  the issue not be discussed in a public GitHub issue, pull request or forum while under
  investigation. Reporters are asked to include a description and exploitation path, a severity
  assessment, reproduction steps, platform/configuration details, and any known exploitation.
  Riverlane commits to immediate acknowledgement, next steps, progress updates, and coordinated
  disclosure with credit to the reporter unless anonymity is preferred.
commitments:
  acknowledgement: immediate
  coordinated_disclosure: true
  credit_offered: true
  safe_harbor_stated: false
  response_sla: not specified
evidence:
- {source: 'https://github.com/Deltakit/deltakit/blob/main/docs/SECURITY.md', kind: security-policy, status: 200}
- {source: 'https://github.com/Deltakit/deltakit/security', kind: github-private-reporting}
gaps:
- >-
  No RFC 9116 /.well-known/security.txt is served on www.riverlane.com,
  deltakit.riverlane.com or deltakit-docs.riverlane.com (all 404), so the policy is not
  machine-discoverable from the API or the corporate domain.
- >-
  The policy covers the Deltakit open-source SDK repository. No separate disclosure route is
  published for the Deltakit Cloud API or for Deltaflow.
- No security@riverlane.com address is published anywhere reachable.
probes:
- {url: 'https://www.riverlane.com/.well-known/security.txt', status: 404}
- {url: 'https://deltakit.riverlane.com/.well-known/security.txt', status: 404}
- {url: 'https://deltakit-docs.riverlane.com/.well-known/security.txt', status: 404}
- {url: 'https://www.riverlane.com/security', status: 403, note: 'Cloudflare bot challenge, not readable'}