generated: '2026-08-06' method: searched probe: true source: https://www.auditoria.ai/trust/ policy: [] policy_page: https://www.auditoria.ai/trust/ contact: channel: email published_as: >- A "Report a Concern" link inside the "Report a Security Concern" section of the trust page. The address is served through Cloudflare email obfuscation (/cdn-cgi/l/email-protection) rather than as plain text, so it is reachable from a browser but not from a machine-readable fetch. Not decoded or recorded here. security_txt: false bug_bounty: program: null platform: null found: false findings: has_disclosure_invitation: true has_published_policy: false has_security_txt: false has_safe_harbor_language: false has_scope_definition: false has_response_sla: false gaps: - No /.well-known/security.txt on any Auditoria host (RFC 9116) - probed www, app and auth, all 404. - >- The invitation to report is a single sentence and a mailto link; there is no published disclosure policy, no scope statement, no safe-harbor commitment and no response timeline, so a researcher has no stated terms to act under. - No public bug bounty or coordinated-disclosure program on HackerOne, Bugcrowd or Intigriti. evidence: - source: https://www.auditoria.ai/trust/ http_status: 200 kind: disclosure-invitation quote: >- "Report a Security Concern - As a leading software-as-a-service and platform-as-a-service provider, Auditoria is committed to setting the standard in safeguarding our environment and customers' data. Partner with us by reporting any security concerns." - source: https://www.auditoria.ai/.well-known/security.txt http_status: 404 kind: security.txt - source: https://app.auditoria.ai/.well-known/security.txt http_status: 200 kind: security.txt rejected: SPA catch-all returned the 1134-byte HTML application shell, not a security.txt - source: https://auth.auditoria.ai/.well-known/security.txt http_status: 404 kind: security.txt x-evidence: checked: '2026-08-06'