Stackadapt Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.stackadapt.com/trust-and-security-center

policy: []
contact:
- security@stackadapt.com
security_policy_url: https://www.stackadapt.com/trust-and-security-center

bug_bounty:
  program: none
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program was found, and StackAdapt's own security page
    does not mention a bounty.

security_txt:
  served: false
  probed:
  - {url: 'https://www.stackadapt.com/.well-known/security.txt', status: 404}
  - {url: 'https://api.stackadapt.com/.well-known/security.txt', status: 404}
  - {url: 'https://docs.stackadapt.com/.well-known/security.txt', status: 404}
  - {url: 'https://mcp.stackadapt.com/.well-known/security.txt', status: 404}

assessment: >-
  StackAdapt publishes a real, first-party security policy page with a named Information
  Security Team contact address, an annual penetration-testing commitment, a documented
  vulnerability and patch management process, and a 48-hour incident notification commitment.
  What it does NOT publish is a coordinated vulnerability disclosure policy: there is no safe
  harbour statement, no scope definition, no expected response timeline for an external
  reporter, no RFC 9116 security.txt, and no bounty. A researcher's only route is to email
  security@stackadapt.com with no published terms. Recorded as a security contact channel,
  not as a VDP.

evidence:
- source: https://www.stackadapt.com/trust-and-security-center
  kind: security-policy-page
  http_status: 200
  fetched: '2026-08-13'
  quote: '"Contact the Information Security Team — Contact us at security@stackadapt.com for any questions you may have."'
- source: https://www.stackadapt.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-13'