generated: '2026-08-05'
method: probed
probe: true
source: https://api.1fort.com/.well-known/security.txt

contact:
  - mailto:security@1fort.com
policy: []
bug_bounty:
  program: null
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program found; no /responsible-disclosure,
    /vulnerability-disclosure or /security/responsible-disclosure page on 1fort.ai (all 404).

security_txt:
  present: true
  hosts: [api.1fort.com, app.1fort.com, auth.1fort.com]
  file: well-known/1fort-security.txt
  fields:
    Contact: mailto:security@1fort.com
    Expires: '2026-01-31T12:00:00Z'
  expired: true
  spec: RFC 9116
  gap: >-
    The file is past its own Expires date and carries no Policy: field, so there is a reachable
    security contact but no published disclosure policy, scope, or safe-harbour statement.

published_practices:
  url: https://1fort.ai/security
  vulnerability_management: >-
    1Fort states it "conducts red team testing both internally and with third parties to best
    identify security gaps" and maintains a structured vulnerability management process.
  pentest_report: listed on the trust center, release request-gated

evidence:
  - source: https://api.1fort.com/.well-known/security.txt
    kind: security.txt
    status: 200
  - source: https://app.1fort.com/.well-known/security.txt
    kind: security.txt
    status: 200
  - source: https://auth.1fort.com/.well-known/security.txt
    kind: security.txt
    status: 200
  - source: https://1fort.ai/security
    kind: security page
    status: 200
  - source: https://1fort.ai/.well-known/security.txt
    kind: security.txt
    status: 404