Surfe Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://github.com/Surfe/surfer/blob/main/SECURITY.md
description: >-
  Surfe publishes a written vulnerability-reporting policy — but on its GitHub
  organisation, not on surfe.com. SECURITY.md in the official `surfer` CLI
  repository names a private reporting channel, an acknowledgement target, and
  explicitly extends its scope to the Surfe API itself. There is no
  /.well-known/security.txt on any Surfe host and no bug bounty programme.
policy:
- https://github.com/Surfe/surfer/blob/main/SECURITY.md
contact:
- security@surfe.com
channels:
- type: email
  value: security@surfe.com
  note: Primary reporting channel; the policy asks reporters NOT to open public GitHub issues.
- type: github-private-vulnerability-reporting
  value: https://github.com/Surfe/surfer/security/advisories
  note: GitHub's private vulnerability reporting is enabled as an alternative channel.
scope:
  stated: >-
    "This repository is the `surfer` CLI. Vulnerabilities in the Surfe API
    itself should also be sent to security@surfe.com."
  covers_api: true
response_target:
  acknowledgement: 3 business days
  stated: >-
    "We aim to acknowledge reports within 3 business days and will keep you
    updated on remediation progress."
requested_information:
- A description of the issue and its impact
- Steps to reproduce (proof of concept if possible)
- 'Affected version (`surfer version`) and platform'
bug_bounty:
  program: null
  platform: null
  note: >-
    No HackerOne, Bugcrowd, Intigriti or self-hosted bounty programme was found
    for Surfe on 2026-08-13.
security_txt:
  published: false
  probed:
  - {url: 'https://www.surfe.com/.well-known/security.txt', status: 404}
  - {url: 'https://surfe.com/.well-known/security.txt', status: 404}
  - {url: 'https://developers.surfe.com/.well-known/security.txt', status: 404}
  - {url: 'https://app.surfe.com/.well-known/security.txt', status: 404}
  - {url: 'https://mcp.eu.surfe.com/.well-known/security.txt', status: 404}
  - {url: 'https://api.surfe.com/.well-known/security.txt', status: 401, note: 'blanket auth gate, not a document'}
credential_handling_disclosed:
- OAuth tokens are stored locally at ~/.surfer/tokens.json with 0600 permissions.
- '`surfer --debug` prints full HTTP request/response bodies which may include personal data and bearer tokens; Surfe warns not to share debug output publicly.'
evidence:
- {source: 'https://raw.githubusercontent.com/surfe/surfer/main/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-08-13'}
- {source: 'https://www.surfe.com/security/', kind: security-page, http_status: 200, fetched: '2026-08-13'}
gaps:
- No RFC 9116 security.txt on any host.
- The disclosure policy is discoverable only from a GitHub repository, not from surfe.com or developers.surfe.com.
- No published remediation SLA beyond the 3-business-day acknowledgement.
- No safe-harbour statement for good-faith researchers.