generated: '2026-08-13'
method: searched
source: https://www.act.com/act-and-security/vulnerability-disclosure-policy/
probed:
  url: https://www.act.com/act-and-security/vulnerability-disclosure-policy/
  http_status: 200
  fetched: '2026-08-13'
description: >-
  Act! LLC publishes a full Vulnerability Disclosure Policy with a named
  reporting address, an acknowledgement commitment, a safe-harbour statement,
  and explicit scope and test-method rules. It is linked from the site footer
  ("Report a suspected vulnerability here"). There is no bug bounty and no
  /.well-known/security.txt.
program:
  type: vulnerability-disclosure-policy
  bug_bounty: false
  platform: null
  policy_url: https://www.act.com/act-and-security/vulnerability-disclosure-policy/
  contact_email: vulnerabilityreport@act.com
  contact_formats: [plain text, rich text, HTML]
  acknowledgement_sla: within three business days
  safe_harbour: >-
    "If you make a good faith effort to comply with this policy during your
    security research, we will consider your research to be authorized, we will
    work with you to understand and resolve the issue quickly, and we will not
    recommend or pursue legal action related to your research."
  commitments:
    - Acknowledge receipt within three business days.
    - Endeavor to timely validate submissions.
    - Implement corrective actions if appropriate.
    - Inform researchers of the disposition of reported vulnerabilities.
  prohibited:
    - Testing any system outside the published scope.
    - Disclosing vulnerability information outside the reporting/disclosure sections.
    - Physical testing of facilities or resources.
    - Social engineering.
    - Unsolicited email to Act! users/customers, including phishing.
    - Denial of Service or Resource Exhaustion attacks.
    - Introducing malicious software.
    - Testing that could degrade, disrupt or disable Act! systems.
    - Testing third-party applications or services that integrate with Act!.
    - Deleting, altering, sharing, retaining or destroying Act! data.
    - Exfiltrating data, establishing command-line access or persistence, or pivoting.
  permitted:
    - View or store Act! nonpublic data only as far as necessary to document a potential vulnerability.
  required_of_researchers:
    - Cease testing and notify Act! immediately on discovering a vulnerability.
    - Cease testing and notify Act! immediately on discovering exposure of nonpublic data.
    - Purge any stored Act! nonpublic data on reporting.
  report_contents: >-
    A detailed technical description of the steps to reproduce, including tools
    needed; screen captures and other attachments accepted; proof-of-concept
    code may be included.
security_txt:
  served: false
  probed:
    - url: https://www.act.com/.well-known/security.txt
      http_status: 404
    - url: https://act.com/.well-known/security.txt
      http_status: 404
    - url: https://developer.act.com/.well-known/security.txt
      http_status: 404
    - url: https://apimta.act.com/.well-known/security.txt
      http_status: 404
  finding: >-
    The policy exists and names a contact, but there is no RFC 9116
    security.txt on any Act! host, so an automated scanner cannot find it. This
    is the cheapest available fix on Act!'s whole security surface: one static
    file with Contact: mailto:vulnerabilityreport@act.com and Policy: the URL
    above.
related_findings:
  - >-
    The public Act! Premium Cloud API host returns full .NET stack traces to
    anonymous callers (observed HTTP 500 on
    https://apimta.act.com/act.web.api/api/contacts, 2026-08-13) — see
    errors/act-problem-types.yml. That is exactly the class of issue this policy
    exists to receive.
scope_note: >-
  The policy's Scope section renders as a "Systems" table on the page and did
  not extract as text to an unauthenticated fetch, so the specific in-scope
  hostnames are not reproduced here. The policy states that any service not
  explicitly listed is excluded.