Upgrade Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: false
source: https://www.upgrade.com/security/
policy:
  - https://www.upgrade.com/security/
contact:
  - security-reports@upgrade.com
program: coordinated-vulnerability-disclosure
bug_bounty: false
notes: >-
  Upgrade maintains a coordinated / responsible vulnerability disclosure
  program: "Upgrade is committed to maintaining the security of our systems and
  our customers' information. We appreciate and encourage security researchers
  to contact us to report potential vulnerabilities." Reports go to
  security-reports@upgrade.com and must comply with HackerOne's Terms and
  Conditions, Code of Conduct, and Disclosure Guidelines, but "Upgrade does not
  operate a public bug bounty program ... we make no offer of reward or
  compensation." Brute-forcing user accounts and denial-of-service testing are
  out of scope. No /.well-known/security.txt is published on www.upgrade.com
  (HTTP 404, probed 2026-07-21).
evidence:
  - {source: 'https://www.upgrade.com/security/', kind: disclosure-page}