Slalom Vulnerability Disclosure

generated: '2026-08-28'
method: searched
probe: true
source: https://www.slalombuild.com/.well-known/security.txt
name: Slalom vulnerability disclosure
description: >-
  Slalom publishes no vulnerability disclosure policy, bug bounty program or security contact on its
  corporate site (www.slalom.com). The only disclosure surface found on any Slalom-controlled host is
  an RFC 9116 security.txt served on the Slalom Build brand site, www.slalombuild.com. It is served
  and parseable, but every supporting document it references is missing and its Contact address is on
  a third-party domain rather than slalom.com.
channels:
- kind: security.txt
  url: https://www.slalombuild.com/.well-known/security.txt
  status: 200
  content_type: text/plain; charset=utf-8
  file: well-known/slalom-security.txt
  fields:
    contact: rj@turnstyle.studio
    expires: '2027-08-28T11:26:43-07:00'
    encryption: https://www.slalombuild.com/pgp-key.txt
    policy: https://www.slalombuild.com/security-policy
    acknowledgements: https://www.slalombuild.com/hall-of-fame
policy:
- url: https://www.slalombuild.com/security-policy
  status: 404
  live: false
contact:
- rj@turnstyle.studio
bug_bounty: none-found
findings:
- >-
  The security.txt Contact is rj@turnstyle.studio — a domain Slalom does not appear to own
  (turnstyle.studio, HTTP 200, an independent studio site). No slalom.com security address is
  published anywhere probed.
- >-
  All three optional URLs the file advertises are dead: Policy (/security-policy) 404, Encryption
  (/pgp-key.txt) 404, Acknowledgements (/hall-of-fame) 404. A researcher following the file reaches
  no policy and no key.
- >-
  www.slalom.com — the corporate domain and the one a researcher would try first — serves no
  security.txt at all (HTTP 404).
evidence:
- url: https://www.slalombuild.com/.well-known/security.txt
  status: 200
- url: https://www.slalombuild.com/security-policy
  status: 404
- url: https://www.slalombuild.com/pgp-key.txt
  status: 404
- url: https://www.slalombuild.com/hall-of-fame
  status: 404
- url: https://www.slalom.com/.well-known/security.txt
  status: 404
- url: https://turnstyle.studio/
  status: 200
checked: '2026-08-28'