Vendasta Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.vendasta.com/developers/vulnerability-disclosure-program/
notes: >-
  CORRECTION — the URL this repo carried since 2026-07-21,
  https://www.vendasta.com/security/responsible-disclosure, now returns HTTP 404 (re-probed
  2026-08-13). Vendasta moved the policy under /developers/. The live page is recorded below and the
  apis.yml `Security` pointer has been repointed at it. Vendasta runs its program through HackerOne
  but the program is INVITE-ONLY, not public: researchers must email security@vendasta.com with
  their HackerOne ID to be invited. hackerone.com/vendasta resolves (200) but exposes no public
  program policy. A non-HackerOne submission form is also offered on the developers page. No
  /.well-known/security.txt is served on any Vendasta host (see well-known/vendasta-well-known.yml),
  so the policy is discoverable only by a human reading the site.
policy:
- https://www.vendasta.com/developers/vulnerability-disclosure-program/
contact:
- security@vendasta.com
program:
  platform: HackerOne
  url: https://hackerone.com/vendasta
  public: false
  access: invite-only
  enrollment: Email security@vendasta.com including your HackerOne ID.
  alternate_submission: Form on https://www.vendasta.com/developers/
scope: Vulnerabilities in the Vendasta platform.
safe_harbor: not-published
response_sla: not-published
security_txt: false
evidence:
- {source: https://www.vendasta.com/developers/vulnerability-disclosure-program/, kind: disclosure page, http_status: 200}
- {source: https://hackerone.com/vendasta, kind: bug bounty handle, http_status: 200, note: no public program policy exposed}
- {source: https://www.vendasta.com/security/responsible-disclosure, kind: previous location, http_status: 404, note: dead as of 2026-08-13}
checked: '2026-08-13'