Safe Security Vulnerability Disclosure

generated: '2026-08-26'
method: searched
source: https://safe.security/security/
name: SAFE Security vulnerability disclosure
url: https://safe.security/security/
http_status: 200
program:
  published: true
  type: responsible-disclosure
  named_policy: Responsible Disclosure Policy
  policy_url: null
  policy_note: >-
    The Security Statement refers readers to "our Responsible Disclosure Policy" for more
    details, but the phrase carries NO hyperlink anywhere on the page and no such document
    is reachable from the public site. The policy is named but not published.
  contact:
    email: vulnerability_report@safe.security
    obfuscated: true
    obfuscation_note: >-
      The address is not rendered as text - it is a Cloudflare email-protection link whose
      visible content is an SVG image. Neither a human copy-pasting nor a crawler reading
      the DOM text gets an address; it has to be decoded from the /cdn-cgi/l/email-protection
      hex payload. That is a real reporting-friction finding for a security company.
  security_txt: false
  security_txt_note: >-
    No RFC 9116 /.well-known/security.txt is served on any SAFE host, so an automated
    scanner following the standard path finds nothing. safe.security returns the WordPress
    homepage shell for that path (soft 404, HTTP 200) and the safeone.ai application hosts
    return CloudFront AccessDenied. Publishing a security.txt carrying Contact,
    Policy and Preferred-Languages would be a small, high-value fix.
  bug_bounty: false
  bug_bounty_note: >-
    No HackerOne, Bugcrowd or Intigriti program was found, and no bounty, reward or
    safe-harbour language appears on the Security Statement.
  safe_harbour: false
  disclosure_terms:
    coordinated: true
    embargo: indefinite-until-approved
    quote: >-
      "You are prohibited from publicly disclosing the details of the reported
      vulnerability, until the issue has been fixed and you have received prior written
      approval from SAFE to do so. In the event you fail to strictly comply with the
      foregoing confidentiality requirement, we reserve the right to institute appropriate
      legal proceedings."
    assessment: >-
      Strict coordinated disclosure with no stated deadline, no safe harbour, and an
      explicit legal threat. There is no maximum embargo period, so a reporter has no
      guaranteed date on which they may publish. This is materially less researcher-
      friendly than the SOC 2 / ISO 27001 posture on the same page would suggest.
security_program_published:
  url: https://safe.security/security/
  pdf: https://safe.security/wp-content/themes/safe/assets/security/security-statement.pdf
  covers:
  - Secure coding practices (input validation, output encoding, cryptographic practices, session management, access control, authentication and password management, error handling and logging, communication security, system configuration, database security, file management, memory management)
  - Continuous SAST and DAST as part of DevSecOps
  - Manual and automated pre-release business-logic testing by an internal security team
  - Daily vulnerability assessment scans and continuous log/alert monitoring on the AWS production environment
  - Periodic patch management and access review
  - Configuration assessment of all PaaS services
  - Third-party vendor risk assessment using SAFE's own platform, under a 4-tier Vendor Management Policy
  - Security awareness and secure-coding training; background verification of new recruits
evidence:
- url: https://safe.security/security/
  status: 200
  kind: disclosure page
- url: https://safe.security/.well-known/security.txt
  status: 200
  kind: soft-404 - WordPress homepage shell, not a security.txt
- url: https://us.safeone.ai/.well-known/security.txt
  status: 403
  kind: CloudFront AccessDenied
gaps_for_provider:
- Publish /.well-known/security.txt on safe.security and the safeone.ai hosts.
- Publish the Responsible Disclosure Policy the Security Statement already cites by name.
- De-obfuscate or supplement the reporting address so it is machine-readable.
- Consider a stated embargo ceiling and a safe-harbour clause.