Syft Data Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://www.syftdata.com/dpa
summary: >-
  Syft Data names a dedicated security contact in its Data Processing Addendum
  and points to trust.syftdata.com as the location of its Security Policy. There
  is no published vulnerability disclosure policy page, no safe-harbour language
  and no bug bounty program; the security address is the only documented intake.
program:
  published_policy: false
  bug_bounty: false
  platform: null
  safe_harbor_documented: false
contacts:
  - type: security
    email: security@syftdata.com
    label: Provider Security Contact
    source: https://www.syftdata.com/dpa
  - type: privacy
    email: privacy@syftdata.com
    label: Privacy contact for Syft Data, Inc.
    source: https://www.syftdata.com/dpa
security_txt:
  served: false
  probed:
    - url: https://www.syftdata.com/.well-known/security.txt
      status: 404
    - url: https://app.syftdata.com/.well-known/security.txt
      status: 404
    - url: https://docs.syftdata.com/.well-known/security.txt
      status: 404
  checked: '2026-08-13'
security_policy:
  url: https://trust.syftdata.com
  status: 200
  note: >-
    Referenced from the DPA as "Security Policy available at: https://trust.syftdata.com".
    The page is a JS-rendered "Trust Vault" that exposes no content anonymously.
  see: security/syft-data-trust-center.yml
gaps:
  - No /.well-known/security.txt on any host.
  - No published disclosure policy, scope statement, response SLA or safe harbour.
  - No bug bounty or coordinated-disclosure platform listing (HackerOne, Bugcrowd, Intigriti all absent).