Rockbot Vulnerability Disclosure

generated: '2026-08-13'
method: probed
source: live probes of every Rockbot host + web search (2026-08-13)
disclosure_program:
  present: false
  policy_url: null
  contact: null
  bug_bounty: null
  safe_harbor: null
notes: >-
  HONEST ABSENCE — Rockbot publishes no vulnerability disclosure policy. No
  `Security` pointer is wired in apis.yml, because there is nothing to point at.
  This artifact exists to record the negative result so the next round does not
  re-probe, and to document one specific FALSE POSITIVE that a naive probe would
  have credited.
false_positive_rejected:
  url: https://auth.rockbot.com/.well-known/security.txt
  http_status: 200
  content_type: text/plain
  credited: false
  body_summary:
    contact: mailto:security@goauthentik.io
    policy: https://docs.goauthentik.io/security/policy
    expires: 'Mon, 1 Jan 2024 00:00 +0200'
    preferred_languages: 'en, de'
  reason: >-
    This is the authentik identity-server software's SHIPPED DEFAULT security.txt
    (server header X-Authentik-Version: 2026.5.4), served incidentally because
    Rockbot runs authentik at auth.rockbot.com. Every field names the VENDOR, not
    Rockbot: the contact routes to goauthentik.io, the policy links to
    goauthentik.io docs, and the Expires date elapsed on 1 January 2024, which
    makes the file non-conformant with RFC 9116 regardless of whose it is. It is
    a 200 on a Rockbot host that asserts nothing about Rockbot, so it earns
    neither a SecurityTxt nor a Security pointer.
probes:
  - { url: 'https://rockbot.com/.well-known/security.txt', status: 404 }
  - { url: 'https://api.rockbot.com/.well-known/security.txt', status: 404 }
  - { url: 'https://developer.rockbot.com/.well-known/security.txt', status: 404 }
  - { url: 'https://auth.rockbot.com/.well-known/security.txt', status: 200, credited: false }
  - { url: 'https://rockbot.com/security', status: 404 }
  - { url: 'https://rockbot.com/trust', status: 404 }
  - { url: 'https://rockbot.com/legal/security', status: 404 }
searched:
  - source: web search
    query: Rockbot security vulnerability disclosure responsible disclosure
    result: >-
      No Rockbot disclosure or responsible-disclosure page. No HackerOne,
      Bugcrowd, or Intigriti program found under Rockbot's name.
related:
  trust_center: security/rockbot-trust-center.yml
  domain_security: security/rockbot-domain-security.yml