Wasp · Vulnerability Disclosure

Wasp Vulnerability Disclosure

Vulnerability disclosure

Wasp runs a coordinated vulnerability disclosure program on Hackerone. A dedicated security contact is published.

CompanyAi Enterprise SoftwareWeb FrameworkFull StackDeveloper ToolsReactNode.jsTypeScriptOpen SourceAI Coding
Program: Hackerone

Disclosure Policy

Policy
https://github.com/wasp-lang/wasp/blob/main/SECURITY.md

Security Contact

Contact
hi@wasp-lang.dev

Source

Vulnerability Disclosure

wasp-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-07-21'
method: searched
probe: true
source: https://github.com/wasp-lang/wasp/blob/main/SECURITY.md
policy:
- https://github.com/wasp-lang/wasp/blob/main/SECURITY.md
contact:
- hi@wasp-lang.dev
supported_versions: >-
  Pre-production stage: only the latest major release receives security
  updates (per SECURITY.md).
notes: >-
  Wasp publishes a GitHub security policy (SECURITY.md) in the wasp-lang/wasp
  repository asking that vulnerabilities be reported to hi@wasp-lang.dev. The
  website probe found no /.well-known/security.txt and no disclosure pages on
  wasp.sh (probe-security-programs.py: vdp=none trust=none) - the GitHub policy
  is the disclosure surface. The team also publishes public incident reports on
  the blog (e.g. the June 2025 case-insensitive OAuth IDs vulnerability
  write-up), evidencing an active disclosure practice. No bug bounty program
  (HackerOne/Bugcrowd/Intigriti) was found.
evidence:
- source: https://raw.githubusercontent.com/wasp-lang/wasp/main/SECURITY.md
  kind: github-security-policy
  status: 200
- source: https://wasp.sh/blog/2025/06/20/oauth-security-incident
  kind: incident-report