Scalarr Vulnerability Disclosure

generated: '2026-08-13'
method: probed
probe: true
source: https://portal.edgelabs.ai/.well-known/security.txt
contact:
- mailto:security@edgelabs.ai
disclosure:
  published: true
  format: rfc9116
  file: well-known/scalarr-security.txt
  contact: mailto:security@edgelabs.ai
  policy_url: null
  encryption_key: null
  acknowledgments: null
  preferred_languages: null
  expires: '2025-12-01T00:00:00Z'
  expired: true
  note: >-
    A real RFC 9116 security.txt is served as text/plain by the AI EdgeLabs
    customer portal (HTTP 200, 67 bytes, probed 2026-08-13). It carries only two
    fields - Contact and Expires - and the Expires value is 2025-12-01, more than
    eight months in the past, so under RFC 9116 §2.5.5 the file is stale and
    clients should not rely on it. No Policy, Encryption, Acknowledgments or
    Preferred-Languages field is present, and the file is NOT served from the apex
    marketing hosts edgelabs.ai or scalarr.io (both 404).
bug_bounty:
  program: false
  platform: null
  url: null
  note: >-
    No HackerOne, Bugcrowd, Intigriti or self-hosted bug bounty / VDP page was
    found on scalarr.io, edgelabs.ai or portal.edgelabs.ai, and none is linked
    from the security.txt.
evidence:
- source: well-known/scalarr-security.txt
  kind: security.txt (harvested verbatim)
  url: https://portal.edgelabs.ai/.well-known/security.txt
  status: 200
  content_type: text/plain
- url: https://edgelabs.ai/.well-known/security.txt
  status: 404
- url: https://scalarr.io/.well-known/security.txt
  status: 404
recommendations:
- Renew the Expires field - the published security.txt expired 2025-12-01.
- Serve the same security.txt from https://edgelabs.ai/.well-known/security.txt and https://scalarr.io/.well-known/security.txt, the hosts a reporter will try first.
- Add a Policy field pointing at a written disclosure policy, and Preferred-Languages.