Salsify Vulnerability Disclosure

generated: '2026-08-02'
method: searched
probe: true
source: https://www.salsify.com/responsible-disclosure
policy:
- https://www.salsify.com/responsible-disclosure
contact:
- vdp@salsify.com
- security@salsify.com
bug_bounty:
  program: false
  platform: null
  note: Salsify runs a private responsible-disclosure program; no bounty payments are offered.
safe_harbor: true
safe_harbor_text: >-
  "Any activities conducted in a manner consistent with this policy will be considered
  authorized conduct and we will not initiate legal action against you."
scope:
- app.salsify.com
- api.salsify.com
response_targets:
  first_response: 14 days
  time_to_triage: 30 days
  time_to_resolution: dependent on severity
out_of_scope:
- CSRF on unauthenticated forms
- Denial of service
- Outdated browser vulnerabilities
- Social engineering
security_txt: false
evidence:
- source: https://www.salsify.com/responsible-disclosure
  kind: disclosure page
  http_status: 200
  keywords:
  - responsible disclosure
  - safe harbor
  - vdp@salsify.com
- source: https://www.salsify.com/security-and-reliability
  kind: security page
  keywords:
  - security@salsify.com
  - responsible disclosure guidelines