generated: '2026-08-13'
method: searched
probe: true
source: https://antavo.com/legals/vulnerability-disclosure-policy/
program: none
accepts_reports: false
policy_published: true
policy: [https://antavo.com/legals/vulnerability-disclosure-policy/]
policy_date: '2025-09-25'
contact: []
bug_bounty: null
security_txt: false
finding: >-
  Antavo publishes a Vulnerability Disclosure Policy page that EXPLICITLY
  DECLINES to operate one. This is a genuine, dated, first-party document and
  the opposite of a disclosure channel, so it is recorded here as a measured
  absence rather than as a security-disclosure surface.
verbatim: >-
  "ANTAVO hereby informs all external parties that ANTAVO does not operate a
  public vulnerability disclosure program and does not, directly or indirectly,
  accept, expect, solicit, or promise or offer to accept vulnerability reports
  from individuals or entities outside the organization. ANTAVO EXPRESSLY
  DISCLAIMS ALL LIABILITY WITH RESPECT TO VULNERABILITY REPORTS FROM INDIVIDUALS
  OR ENTITIES OUTSIDE THE ORGANIZATION. ... Should ANTAVO choose to implement a
  formal vulnerability disclosure framework in the future, relevant procedures
  and contact information will be made available via official company
  communication channels, including but not limited to its corporate website."
pointer_decision: >-
  NO `type: Security` pointer is emitted in apis.yml. The operational
  `security_disclosure` check measures whether a researcher has a published path
  to report a vulnerability; Antavo's page states in terms that no such path
  exists and that unsolicited reports will be treated as "unrequested
  communications". Emitting the pointer would credit Antavo with a surface it
  publicly refuses to provide. `type: VulnerabilityDisclosure` IS emitted,
  because the artifact itself - the measured, dated refusal - is real and useful.
internal_practices:
  note: >-
    Antavo does describe internal security testing on its product security page,
    which is a different claim from an external disclosure channel.
  claims:
  - >-
    "Antavo regularly tests its own codebase and IT infrastructure for
    well-known and 0-day vulnerabilities."
  - >-
    "Antavo works together with independent third-parties to complete
    penetration tests."
  - "Antavo has an appointed information security officer and a DPO."
  source: https://antavo.com/product/loyalty-engine/technology/security/
evidence:
- source: https://antavo.com/legals/vulnerability-disclosure-policy/
  kind: vulnerability-disclosure-policy
  http_status: 200
  fetched: '2026-08-13'
  finding: policy explicitly declines to operate a disclosure program
- source: https://api.antavo.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-13'
- source: https://antavo.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-13'
- source: https://developers.antavo.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
  fetched: '2026-08-13'
support_channel_for_customers:
  url: https://antavo.atlassian.net/servicedesk/customer/portals
  note: >-
    Existing customers reach Antavo through the Jira Service Desk, which
    requires a login. It is a support channel, not a public disclosure channel.