Zocdoc Vulnerability Disclosure

generated: '2026-08-15'
method: probed
probe: true
program: none
policy: []
contact:
  - value: action-informationsecurity@zocdoc.com
    source: DNS CAA iodef record on zocdoc.com
    note: >-
      A real, Zocdoc-published security reporting address — but published in
      DNS, where a researcher looking for a disclosure policy will not find it.
      It is an incident-reporting contact for certificate authorities
      (RFC 8659 iodef), not a vulnerability disclosure policy.
evidence:
  - url: https://www.zocdoc.com/.well-known/security.txt
    status: 403
    finding: Bot challenge — no security.txt retrievable.
  - url: https://api-developer.zocdoc.com/.well-known/security.txt
    status: 404
  - url: https://auth.zocdoc.com/.well-known/security.txt
    status: 404
  - url: https://api-docs.zocdoc.com/.well-known/security.txt
    status: 404
  - url: https://hackerone.com/zocdoc
    status: 200
    finding: >-
      NOT a Zocdoc-run program. The page carries HackerOne's
      `spec-external-unclaimed` marker and describes itself as a
      "community-curated security page"; hackerone.com/zocdoc.json returns 404,
      confirming no claimed team exists.
  - url: https://bugcrowd.com/zocdoc
    status: 404
  - url: https://www.zocdoc.com/about/security/
    status: 403
    finding: Bot challenge — Zocdoc's own security page could not be read.
  - source: security/zocdoc-domain-security.yml
    kind: dns-caa
    finding: '0 iodef "mailto:action-informationsecurity@zocdoc.com"'
note: >-
  No published vulnerability disclosure program was verified. No security.txt on
  any host, no claimed HackerOne or Bugcrowd program, and Zocdoc's own security
  page is unreachable to any non-browser client. Recorded as an honest absence:
  NO `Security` or `VulnerabilityDisclosure` pointer is wired into apis.yml,
  because a pointer would assert a surface Zocdoc does not demonstrably serve.
  The one thing Zocdoc does publish machine-readably is the CAA iodef address
  above.