Uphold Vulnerability Disclosure

generated: '2026-08-05'
method: searched
probe: true
source: https://uphold.com/.well-known/security.txt
policy:
- https://app.intigriti.com/programs/Uphold/upholdcom/detail
contact:
- mailto:security@uphold.com
security_page: https://uphold.com/en-us/get-started/security
bug_bounty:
  platform: Intigriti
  url: https://app.intigriti.com/programs/Uphold/upholdcom/detail
  program: Uphold / uphold.com
security_txt:
  file: well-known/uphold-security.txt
  url: https://uphold.com/.well-known/security.txt
  http_status: 200
  rfc: '9116'
  fields:
    Policy: https://app.intigriti.com/programs/Uphold/upholdcom/detail
    Contact: mailto:security@uphold.com
    Preferred-Languages: en
    Encryption: https://cdn.uphold.com/security/uphold_security_public.asc
    Expires: '2026-12-31T00:00:00.000Z'
    Hiring: https://uphold.com/resources/careers
  note: PGP public key published for encrypted reports; the file states it expires every 365 days.
evidence:
- source: https://uphold.com/.well-known/security.txt
  kind: security.txt
  http_status: 200
- source: https://uphold.com/en-us/get-started/security
  kind: security page
  http_status: 200
  note: Names the Intigriti bug bounty program alongside the SOC 2 Type 2 / ISO 27001 / PCI DSS claims.
gaps:
- Only the corporate apex host serves security.txt. developer.uphold.com returns 404,
  api.uphold.com returns 404 and api.enterprise.uphold.com returns 503.