Whisper Security · Vulnerability Disclosure

Whisper Online Vulnerability Disclosure

Vulnerability disclosure

Whisper Security publishes a vulnerability disclosure policy for reporting security issues. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

Agent IdentityAgentsIPv6DNSDNSSECThreat IntelligenceSecurityEgressA2AMCPRDAPTransparency LogGraph DatabaseAgent-NativeNetherlands

Program: security.txt present

Disclosure Policy

Policy

https://whisper.online/.well-known/disclosure-policy.txt

Policy

https://as219419.net/.well-known/disclosure-policy.txt

Security Contact

Contact

mailto:security@whisper.security

Contact

https://www.whisper.security/contact-us

Source

Vulnerability Disclosure

generated: '2026-09-19'
method: searched
probe: true
source: https://whisper.online/.well-known/security.txt
docs:
- https://whisper.online/.well-known/security.txt
- https://whisper.online/.well-known/disclosure-policy.txt
- https://whisper.online/.well-known/security-acknowledgments.txt
- https://whisper.online/.well-known/openpgp-key.txt
- https://whisper.online/trust
policy:
- https://whisper.online/.well-known/disclosure-policy.txt
- https://as219419.net/.well-known/disclosure-policy.txt
contact:
- mailto:security@whisper.security
- https://www.whisper.security/contact-us
encryption: https://whisper.online/.well-known/openpgp-key.txt (fingerprint EFF1 663D 9925 3968 2106 A5EA D0F7 0908 CF3B 7929)
acknowledgments: https://whisper.online/.well-known/security-acknowledgments.txt ("(none yet, so be the first)")
program:
  type: coordinated vulnerability disclosure (no bug bounty platform)
  policy_title: Coordinated Vulnerability Disclosure Policy — Whisper Security · viaGraph b.v. · the Whisper platform
  last_updated: '2026-09-17'
  scope_in: [whisper.online and its subdomains and the agent-facing discovery documents, the control plane and graph API, the identity plane as infrastructure (allocation, registration, resolution, RDAP, certificate and DNSSEC machinery), the CLI, SDKs and MCP server and their release and signing path, the endpoint sensor and enrollment, the console and its authentication]
  scope_out: [individual agent /128 hosts in 2a04:2a01::/32 and their traffic, customer tenants and data, third parties and egress destinations, DoS/volumetric testing, social engineering and physical attacks, findings with no security impact]
  safe_harbour: 'If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research.'
  acknowledgement: best-effort during RIPE-region business hours ("We are not a 24x7 NOC"); abuse reports acknowledged within one business day (trust page)
  disclosure_timeline: typically up to 90 days, sooner for low-risk issues, longer by mutual agreement
  credit: with consent, via the Acknowledgments file
  other_contacts: {abuse: security@whisper.security (RIPE abuse-c), peering: peering@whisper.security, noc: noc@whisper.security}
  separate_files:
  - {host: whisper.online, canonical: 'https://whisper.online/.well-known/security.txt', expires: '2027-09-17', signed: PGP}
  - {host: www.whisper.security, canonical: 'https://www.whisper.security/.well-known/security.txt', expires: '2027-09-18', signed: PGP, note: corporate site; points at the platform policy}
  - {host: as219419.net, canonical: 'https://as219419.net/.well-known/security.txt', expires: '2027-06-19', signed: PGP, note: the network layer has its own policy and key}
  - {host: mcp.whisper.security, canonical: 'https://mcp.whisper.security/.well-known/security.txt', expires: '2027-03-03', signed: false, note: 'Policy field points at the corporate privacy policy rather than the CVD policy'}
evidence:
- source: https://whisper.online/.well-known/security.txt
  kind: security.txt (live probe)
  http_status: 200
  fetched: '2026-09-19'
- source: https://whisper.online/.well-known/disclosure-policy.txt
  kind: CVD policy (live probe)
  http_status: 200
  fetched: '2026-09-19'
- source: https://whisper.online/.well-known/security-acknowledgments.txt
  http_status: 200
  fetched: '2026-09-19'
- source: https://whisper.online/.well-known/openpgp-key.txt
  http_status: 200
  fetched: '2026-09-19'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/whisper-online-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.