Sendoso · Vulnerability Disclosure

Sendoso Vulnerability Disclosure

Vulnerability disclosure

Recorded absence. Sendoso publishes no vulnerability disclosure policy, no security.txt and no bug bounty program that could be found from its own hosts. The only security contact reachable from the developer surface is a general support address.

Sendoso runs a coordinated vulnerability disclosure program on Hackerone.

Corporate GiftingDirect MailSales EngagementMarketing AutomationCRM IntegrationeGiftsSwag and MerchandiseFulfillmentEmployee RecognitionAccount Based MarketingSCIM ProvisioningWebhook
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-13'
method: probed
source: live probes of sendoso.com, app.sendoso.com, developer.sendoso.com
provider: Sendoso
providerId: sendoso
description: >-
  Recorded absence. Sendoso publishes no vulnerability disclosure policy, no security.txt and
  no bug bounty program that could be found from its own hosts. The only security contact
  reachable from the developer surface is a general support address.
published: false
security_txt:
  served: false
  probes:
    - url: https://sendoso.com/.well-known/security.txt
      status: 404
      note: Host answers every /.well-known/* path with "Invalid .well-known request".
    - url: https://app.sendoso.com/.well-known/security.txt
      status: 404
    - url: https://developer.sendoso.com/.well-known/security.txt
      status: 404
      note: 'Body: "Asset not found".'
  checked: '2026-08-13'
bug_bounty:
  program: null
  platform: null
  searched: [HackerOne, Bugcrowd, Intigriti]
  found: false
disclosure_policy:
  url: null
  found: false
  note: >-
    The Vanta trust center at https://security.sendoso.com/ may carry one, but it renders
    client-side and delivers no readable content — see security/sendoso-trust-center.yml.
contacts_available:
  - address: developers@sendoso.com
    role: Developer support
    note: >-
      The only address the developer documentation gives for security questions: "If you have
      any questions or concerns about the security of the Sendoso API, please contact the
      Sendoso support team at developers@sendoso.com."
    source: https://developer.sendoso.com/rest-api/overview/security
recommendation_for_provider: >-
  A three-line /.well-known/security.txt naming a contact and a policy URL is the cheapest
  fix on this whole profile, and it is the one a researcher looks for first.