Zazzle Vulnerability Disclosure

generated: '2026-08-05'
method: searched
probe: true
policy:
- https://www.zazzle.com/.well-known/security.txt
contact:
- security@zazzle.com
acknowledgments:
- https://www.zazzle.com/hackers.txt
bug_bounty:
  active: false
  note: >-
    Zazzle's own policy page states the company has transitioned away from operating a public bug
    bounty program and no longer offers monetary rewards. No HackerOne, Bugcrowd or Intigriti program
    was found.
program:
  accepts_reports: true
  submission_requirements:
  - clear technical details
  - affected assets
  - reproducible steps
  - supporting evidence
  triage_basis: technical merit, potential impact, and ability to be reproduced
  recognition: >-
    Researchers whose verified reports lead to significant security improvements may be acknowledged
    on the Zazzle acknowledgments page.
  safe_harbor: not-stated
  disclosure_timeline: not-published
  scope: not-published
format:
  rfc9116: false
  note: >-
    The document served at the RFC 9116 canonical path /.well-known/security.txt is an HTML policy
    page, not a machine-readable security.txt. There are no Contact:, Expires: or Policy: fields for
    a scanner to parse — a security tool doing standards-compliant discovery on Zazzle will find
    nothing, even though a human-readable policy exists at exactly the right URL. Publishing the
    plain-text RFC 9116 form at that path is a one-file fix.
evidence:
- source: https://www.zazzle.com/.well-known/security.txt
  kind: disclosure-page
  http_status: 200
  content_type: text/html
  fetched: '2026-08-05'
  keywords:
  - vulnerability
  - responsible disclosure
  - security@zazzle.com
- source: https://www.zazzle.com/hackers.txt
  kind: acknowledgments
  http_status: 200
  fetched: '2026-08-05'
- source: 'DNS CAA record for zazzle.com'
  kind: corroborating
  value: '0 iodef "mailto:security@zazzle.com"'
  fetched: '2026-08-05'
  note: >-
    The zazzle.com CAA record independently names the same security mailbox as the incident contact,
    corroborating security@zazzle.com as a live, monitored address.
- source: https://www.zazzle.com/llms.txt
  kind: control
  http_status: 404
  fetched: '2026-08-05'
  note: >-
    Control probe. Proves the security.txt 200 is a real distinct page and not a blanket soft-200
    from an SPA catch-all.