Wasp · Vulnerability Disclosure

Wasp Vulnerability Disclosure

Vulnerability disclosure

Wasp runs a coordinated vulnerability disclosure program on Hackerone. A dedicated security contact is published.

CompanyAi Enterprise SoftwareWeb FrameworkFull-StackDeveloper ToolsReactNode.jsTypeScriptOpen-SourceAI Coding

Program: Hackerone

Disclosure Policy

Policy

https://github.com/wasp-lang/wasp/blob/main/SECURITY.md

Security Contact

Contact

hi@wasp-lang.dev

Source

Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: true
source: https://github.com/wasp-lang/wasp/blob/main/SECURITY.md
policy:
- https://github.com/wasp-lang/wasp/blob/main/SECURITY.md
contact:
- hi@wasp-lang.dev
supported_versions: >-
  Pre-production stage: only the latest major release receives security
  updates (per SECURITY.md).
notes: >-
  Wasp publishes a GitHub security policy (SECURITY.md) in the wasp-lang/wasp
  repository asking that vulnerabilities be reported to hi@wasp-lang.dev. The
  website probe found no /.well-known/security.txt and no disclosure pages on
  wasp.sh (probe-security-programs.py: vdp=none trust=none) - the GitHub policy
  is the disclosure surface. The team also publishes public incident reports on
  the blog (e.g. the June 2025 case-insensitive OAuth IDs vulnerability
  write-up), evidencing an active disclosure practice. No bug bounty program
  (HackerOne/Bugcrowd/Intigriti) was found.
evidence:
- source: https://raw.githubusercontent.com/wasp-lang/wasp/main/SECURITY.md
  kind: github-security-policy
  status: 200
- source: https://wasp.sh/blog/2025/06/20/oauth-security-incident
  kind: incident-report

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/wasp-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.