Secton Api Vulnerability Disclosure

generated: '2026-08-16'
method: searched
source: https://secton.org/security
program:
  exists: true
  name: Secton Security — responsible disclosure
  page: https://secton.org/security
  page_status: 200
  intake: hackerone-embedded-submission-form
  intake_url: https://hackerone.com/b69c37c0-6094-417e-a729-e009b003adc3/embedded_submissions/new?locale=en
  scope_statement: >-
    "If you discover a vulnerability in any of our products, services, or infrastructure, please
    report it responsibly through our HackerOne submission form."
  bounty: false
  bounty_statement: >-
    "We do not offer monetary bounties or rewards. Reports are made on a voluntary basis and are
    deeply appreciated as a contribution to public safety, privacy, and open collaboration."
  safe_harbor_published: false
  response_sla_published: false
  pgp_key_published: false
security_txt:
  served: false
  probed:
    - url: https://secton.org/.well-known/security.txt
      status: 404
    - url: https://console.secton.org/.well-known/security.txt
      status: 404
    - url: https://api.secton.org/.well-known/security.txt
      status: 200
      note: soft-404 — body is `{"message":"The /.well-known/security.txt endpoint doesn't exist!"}`
  gap: >-
    A real disclosure program exists but is not machine-discoverable. RFC 9116 security.txt at
    secton.org/.well-known/security.txt with `Contact:` pointing at the HackerOne form and a
    `Policy:` pointing at https://secton.org/security would close this.
track_record:
  - date: '2025-10-07'
    url: https://secton.org/blog/addressing-what-happened-back-in-june
    title: Addressing What Happened Back in June
    summary: >-
      Public post-incident write-up of three vulnerabilities reported to Secton on 2025-06-23 and
      remediated within 24 hours (by 2025-06-24): a client-side-only rate limit on Copilot guest
      messages that could be bypassed from browser DevTools; a hardcoded public "playground" token
      that granted unlimited access to the chat-completion endpoint; and an unauthenticated
      ai-compute.secton.org endpoint. Secton states there is no evidence of exploitation in the
      wild, and that the generic token was revoked and server-side authentication enforced.
    note: >-
      Recorded because it is first-party evidence that the program actually processes reports and
      publishes outcomes — rarer than a disclosure page. It is also the reason the disclosure page
      exists: the write-up ends by directing future reports through formal channels.
      (The ai-compute.secton.org host no longer resolves as of this pass.)
contacts:
  - purpose: general / product support
    value: https://secton.org/contact
  - purpose: general (site-wide footer)
    value: management@secton.org
  - purpose: legal
    value: legal@secton.org
  - purpose: press
    value: press@secton.org
contacts_source: >-
    Decoded from the Cloudflare email-protection payloads on https://secton.org/,
    https://secton.org/contact and https://secton.org/security — these are the addresses the pages
    render to a browser, not inferred ones.