SPOTIO · Vulnerability Disclosure

Spotio Vulnerability Disclosure

Vulnerability disclosure

SPOTIO runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served.

Field SalesSales EngagementTerritory ManagementCRMLead TrackingOutside SalesSales EnablementRoute OptimizationGeospatialWebhookMCPDoor to Door

Program: Hackerone security.txt present

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

generated: '2026-08-13'
method: probed
probe: true
source: live probe of SPOTIO's security.txt paths, disclosure pages and bug-bounty platforms

published: false
policy: []
contact: []
bug_bounty: none

detail: >-
  SPOTIO publishes no vulnerability-disclosure programme. /.well-known/security.txt
  returns 404 on api.spotio2.com, app.spotio2.com, developer.spotio2.com and
  support.spotio.com, and 403 from the edge on spotio.com. The security and compliance
  page - which does describe SOC 2 Type II, GDPR, encryption, Azure hosting and
  Cloudflare WAF in detail - names no security contact address, no responsible-disclosure
  process and no bug-bounty programme. No SPOTIO programme was found on HackerOne,
  Bugcrowd or Intigriti. A researcher who found a flaw in SPOTIO today has no published
  route to report it other than general support.

  NO Security or VulnerabilityDisclosure pointer is emitted in apis.yml. This file
  records a verified absence, and an absence must not be scored as a presence.

evidence:
- {source: 'https://api.spotio2.com/.well-known/security.txt', status: 404}
- {source: 'https://app.spotio2.com/.well-known/security.txt', status: 404}
- {source: 'https://developer.spotio2.com/.well-known/security.txt', status: 404}
- {source: 'https://support.spotio.com/.well-known/security.txt', status: 404}
- {source: 'https://spotio.com/.well-known/security.txt', status: 403, note: edge blocks every /.well-known/* path}
- {source: 'https://spotio.com/features/security-compliance/', status: 200, finding: 'no security contact, no disclosure policy, no bounty'}

what_is_published_instead:
  url: https://spotio.com/features/security-compliance/
  controls:
  - SOC 2 Type II across all five Trust Services Criteria, report available under NDA
  - GDPR commitment with EU data centres for residency
  - TLS 1.2+ in transit, enterprise-grade encryption at rest
  - Microsoft Azure hosting with multi-region redundancy
  - Cloudflare WAF and DDoS mitigation
  - role-based access control with automated audit logs
  artifact: security/spotio-trust-center.yml

recommendation_for_provider: >-
  Publishing an RFC 9116 /.well-known/security.txt on spotio.com and api.spotio2.com with
  a Contact and Policy line would close this gap in an afternoon, and is the single
  cheapest security-posture improvement available to SPOTIO.

checked: '2026-08-13'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/spotio-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.