Typesafe Ai Vulnerability Disclosure

generated: '2026-09-19'
method: probed
source: https://console.typesafe.ai/.well-known/security.txt
checked: '2026-09-19'
summary: >-
  TypeSafe serves a valid, unexpired RFC 9116 security.txt naming a dedicated security address and a
  PGP key. It does NOT publish a disclosure policy, a safe-harbour statement, a bug bounty, or a
  scope/out-of-scope list — so there is a way to reach the security team and no published process
  once you do.
published: true
rfc9116:
  served: true
  url: https://console.typesafe.ai/.well-known/security.txt
  file: ../well-known/typesafe-ai-security.txt
  status: 200
  expires: '2027-02-26T00:00:00.000Z'
  expired: false
  fields_present: [Contact, Encryption, Expires, Canonical, Preferred-Languages]
  fields_absent: [Policy, Acknowledgments, Hiring, CSAF]
  host_note: >-
    Served ONLY on console.typesafe.ai. https://typesafe.ai/.well-known/security.txt and
    https://api.typesafe.ai/.well-known/security.txt both 404, which is where a researcher looks
    first. The Canonical field correctly names the console host, but the registrable domain does
    not redirect or duplicate it.
contact:
- mailto:security@typesafe.ai
encryption:
- https://console.typesafe.ai/.well-known/pgp-key.asc
preferred_languages: [en]
policy:
  published: false
  url: null
  note: >-
    No Policy: field in the security.txt and no /security, /security/disclosure, /trust or
    /vulnerability-disclosure page on typesafe.ai (all 404). A reporter gets an address and a PGP
    key but no stated response time, no safe harbour, and no in-scope/out-of-scope definition.
bug_bounty:
  published: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: none found
safe_harbour:
  published: false
trust_center:
  present: true
  url: https://trust.typesafe.ai/
  artifact: security/typesafe-ai-trust-center.yml
evidence:
- url: https://console.typesafe.ai/.well-known/security.txt
  status: 200
  content_type: text/plain; charset=UTF-8
  bytes: 223
- url: https://typesafe.ai/.well-known/security.txt
  status: 404
- url: https://api.typesafe.ai/.well-known/security.txt
  status: 404
- url: https://docs.typesafe.ai/.well-known/security.txt
  status: 404
- url: https://typesafe.ai/security
  status: 404