Sparrow Vulnerability Disclosure

generated: '2026-08-28'
method: searched
source: https://sparrow.com/responsible-disclosure/
policy_url: https://sparrow.com/responsible-disclosure/
title: Sparrow Vulnerability Disclosure Policy
published: true
contact:
  email: security@trysparrow.com
  note: >-
    Published on the policy page behind Cloudflare email obfuscation; decoded from the page's own
    cf-email payload. No security.txt is served on any Sparrow host.
security_txt:
  served: false
  note: >-
    /.well-known/security.txt returns 404 on sparrow.com, trysparrow.com, api.trysparrow.com and
    login.trysparrow.com. The 200 on status.trysparrow.com is Atlassian's Statuspage document, not
    Sparrow's.
bounty:
  offered: false
  statement: >-
    "At this time, we do not offer monetary rewards for vulnerability reports. However, we deeply
    appreciate the efforts of the security community and may publicly acknowledge contributors who
    responsibly disclose issues, with their consent."
safe_harbor:
  offered: true
  statement: >-
    "We support good-faith security research and will not pursue legal action against individuals
    who report vulnerabilities in accordance with this policy."
response_commitments:
- Acknowledge receipt of a report promptly, typically within 3 business days.
- Investigate and strive to resolve the issue as quickly as possible.
- Keep the reporter informed of progress throughout the process.
researcher_requirements:
- Do not exploit the vulnerability or access data that is not yours.
- Do not perform actions that could impact availability or integrity (e.g. denial of service).
- Allow a reasonable amount of time to address the issue before public disclosure.
report_should_include:
- A clear description of the vulnerability.
- Steps to reproduce, including relevant URLs, payloads and screenshots.
- The potential impact of the vulnerability.
platform:
  hackerone: false
  bugcrowd: false
  intigriti: false
  note: Reports go to the security@ mailbox directly; no third-party disclosure platform is used.
related:
- https://sparrow.com/security/
- https://sparrow.com/security-policy/
- https://trust.trysparrow.com/
evidence:
- url: https://sparrow.com/responsible-disclosure/
  status: 200
- url: https://sparrow.com/.well-known/security.txt
  status: 404