Rybbit Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://rybbit.com/security
description: >-
  Rybbit runs an email-based responsible-disclosure program with no monetary
  rewards. It is documented in three consistent places: a served RFC 9116
  security.txt, a SECURITY.md in the public repository with a supported-version
  table and a 72-hour acknowledgement commitment, and a "Vulnerability
  Disclosure" section on the security page. There is no bug bounty and no
  HackerOne / Bugcrowd / Intigriti presence.
policy:
  - https://rybbit.com/security
  - https://github.com/rybbit-io/rybbit/blob/master/SECURITY.md
contact:
  - mailto:hello@rybbit.com
security_txt:
  url: https://rybbit.com/security.txt
  mirror: https://rybbit.io/security.txt
  file: well-known/rybbit-security.txt
  fields:
    Canonical: https://rybbit.com/.well-known/security.txt
    Contact: mailto:hello@rybbit.com
    Preferred-Languages: en
    Expires: '2027-01-01T00:00:00Z'
  deviation: >-
    Served at /security.txt, not at the RFC 9116 well-known location. The
    Canonical URL the file declares
    (https://rybbit.com/.well-known/security.txt) returns 404, so a compliant
    scanner will not find it. Worth reporting to the provider.
bounty:
  offered: false
  quote: 'We accept vulnerability reports. We do not offer monetary or bug bounty rewards.'
commitments:
  acknowledgement: within 72 hours (SECURITY.md)
  disclosure: coordinated — reporters asked to allow reasonable time before public disclosure
  credit: public acknowledgement of the reporter unless they prefer anonymity
supported_versions:
  supported: ['2.x']
  unsupported: ['0.1.x', '1.x']
  source: https://github.com/rybbit-io/rybbit/blob/master/SECURITY.md
evidence:
  - {source: 'https://rybbit.com/security.txt', kind: security.txt, http_status: 200, content_type: 'text/plain'}
  - {source: 'https://raw.githubusercontent.com/rybbit-io/rybbit/master/SECURITY.md', kind: security policy, http_status: 200}
  - {source: 'https://rybbit.com/security', kind: disclosure page, http_status: 200, keywords: [vulnerability, responsible disclosure, report]}
evidence_fetched: '2026-08-13'