Tackle Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://trust.tackle.io/
policy:
- https://trust.tackle.io/
contact:
- infosec@tackle.io
- security@tackle.io
program:
  type: responsible-disclosure
  bug_bounty: false
  platform: null
  named_policies:
  - Responsible Disclosure
  - Vulnerability Management Policy
  intake: >-
    The SafeBase-hosted trust center carries a "Responsible Disclosure" item under App Security
    and a "Vulnerability Management Policy" under Policies, with a direct mailto intake — "If you
    think you may have discovered a vulnerability, please send us a note" linking
    mailto:infosec@tackle.io with the subject "SafeBase Responsible Disclosure Report for Tackle".
    tackle.io/legal-compliance/ separately publishes mailto:security@tackle.io.
  gating: >-
    The disclosure and vulnerability-management POLICY DOCUMENTS themselves sit behind the trust
    center's "Get access" request flow; the existence of the policies, their names, and the intake
    address are public. No bug-bounty program (HackerOne / Bugcrowd / Intigriti) was found.
evidence:
- {source: 'https://trust.tackle.io/', kind: trust-center, status: 200, keywords: [responsible disclosure, vulnerability management policy, infosec@tackle.io, pentest report]}
- {source: 'https://tackle.io/legal-compliance/', kind: legal-page, status: 200, keywords: [security@tackle.io]}
- {source: 'https://tackle.io/.well-known/security.txt', kind: security.txt, status: 404, finding: 'RFC 9116 security.txt is NOT served on any Tackle host'}
- {source: 'https://developers.tackle.io/.well-known/security.txt', kind: security.txt, status: 404}
- {source: 'https://api.tackle.io/.well-known/security.txt', kind: security.txt, status: 401, finding: 'API gateway rejects every unauthenticated path, including /.well-known/*'}
gap: >-
  Tackle runs a real disclosure program but publishes no /.well-known/security.txt, so an
  automated scanner or agent cannot discover the intake address without rendering the SafeBase
  trust center. Publishing a two-line security.txt naming infosec@tackle.io and
  https://trust.tackle.io/ as the Policy would close it.