Teads Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.teads.com/security/
description: >-
  Teads runs a coordinated vulnerability disclosure program through HackerOne,
  announced on its public "Security at Teads" page. A machine-readable RFC 9116
  security.txt is served on the Outbrain domain that also hosts the Teads In-Chat
  Recommendations API endpoint (mv.outbrain.com), pointing at the bug bounty
  policy. Outbrain is the same corporate entity — Outbrain Inc. acquired Teads in
  2025 and the combined company operates under the Teads brand — so the Outbrain
  security surface is this provider's own.
program:
  exists: true
  type: bug-bounty
  platform: HackerOne
  policy_url: https://www.outbrain.com/security/bug-bounty/
  disclosure_page: https://www.teads.com/security/
  statement: >-
    "Upholding a strong security posture requires continuous improvement in an
    ever changing technological landscape. With this in mind we run a bug bounty
    program through HackerOne and invite any interested hunters to join."
security_txt:
  served: true
  host: mv.outbrain.com
  url: https://mv.outbrain.com/.well-known/security.txt
  resolves_to: https://www.outbrain.com/.well-known/security.txt
  http_status: 200
  file: ../well-known/teads-security.txt
  fields:
    Contact: https://www.outbrain.com/security/bug-bounty/
    Policy: https://www.outbrain.com/security/bug-bounty/
  gaps:
  - No Expires field (RFC 9116 requires it).
  - No Encryption, Acknowledgments, Preferred-Languages or Canonical fields.
  - Not served on teads.com, developers.teads.com or ca.teads.tv.
policy_terms:
  safe_harbor: true
  safe_harbor_text: >-
    "Any activities conducted in a manner consistent with this policy will be
    considered authorized conduct."
  coordinated_disclosure_required: true
  public_disclosure: >-
    Researchers may not publicly disclose vulnerabilities without explicit
    written permission.
  eligibility_exclusions:
  - Residents of / submissions from US-sanctioned countries
  - Current employees and those who left within the prior 12 months
  - Immediate family of employees
  - Under 14 without guardian permission
  rules_of_engagement:
  - Test only against accounts you own or have permission to test
  - No pivoting to other systems; proof of concept only
  - Sensitive data must not be stored or retained after discovery
  - No social engineering, phishing, physical, brute-force or DoS testing
  testing_guidance:
  - Register accounts with <username>@wearehackerone.com addresses
  - Include your source IP in the report
supporting_controls:
  penetration_testing: annual, independent third parties
  vulnerability_monitoring: continuous with real-time triage
  secure_sdlc: true
  source: https://www.teads.com/security/
other_contacts:
  fraud_phishing: scam@teads.com
evidence:
- url: https://www.teads.com/security/
  status: 200
  keywords: [vulnerability, bug bounty, hackerone]
- url: https://www.outbrain.com/security/bug-bounty/
  status: 200
- url: https://mv.outbrain.com/.well-known/security.txt
  status: 200
- url: https://www.teads.com/.well-known/security.txt
  status: 406
  note: Edge/WAF rejects non-HTML requests on this host; no security.txt served.
- url: https://developers.teads.com/.well-known/security.txt
  status: 404
- url: https://ca.teads.tv/.well-known/security.txt
  status: 404
checked: '2026-08-13'