generated: '2026-08-07'
method: searched
probe: true
source: https://www.bloomandwild.com/.well-known/security.txt
description: >-
  Bloom & Wild Group publishes a machine-readable security contact under RFC 9116
  at the canonical path on every group storefront (bloomandwild.com,
  bloomandwild.de, bloomon.nl, bloomon.be, bloomon.dk). It is a security contact,
  not a full disclosure programme — there is no published Policy URL, no safe-harbour
  statement, no scope definition, no bounty, and no `Expires` field.
program:
  published: true
  kind: security-contact
  channel: security.txt
  policy_url: null
  safe_harbour: unstated
  scope: unstated
  bounty: false
contact:
- mailto:security-tech@bloomandwild.com
preferred_languages:
- en
- fr
- de
canonical: https://www.bloomandwild.com/.well-known/security.txt
hiring: https://www.bloomandwild.com/careers
gaps:
- field: Expires
  required_by: RFC 9116 §2.5.5
  present: false
  impact: >-
    Without Expires a consumer cannot tell whether the contact is still
    maintained; RFC 9116 makes this field REQUIRED.
- field: Policy
  required_by: RFC 9116 §2.5.7 (optional)
  present: false
  impact: >-
    No published disclosure policy, so a researcher has no stated scope, no
    disclosure timeline and no safe-harbour commitment.
- field: Encryption
  required_by: RFC 9116 §2.5.4 (optional)
  present: false
  impact: No published key for encrypting a report.
bug_bounty:
  present: false
  checked:
  - url: https://hackerone.com/bloomandwild
    status: 404
  - url: https://bugcrowd.com/bloomandwild
    status: 404
evidence:
- url: https://www.bloomandwild.com/.well-known/security.txt
  status: 200
  content_type: text/plain; charset=UTF-8
  fetched: '2026-08-07'
  file: well-known/bloom--wild-security.txt
- url: https://www.bloomandwild.de/.well-known/security.txt
  status: 200
  fetched: '2026-08-07'
- url: https://www.bloomon.nl/.well-known/security.txt
  status: 200
  fetched: '2026-08-07'
notes:
- >-
  https://www.bloomandwild.com/security and /responsible-disclosure both return
  HTTP 200, but so does every invalid path on this host — the storefront serves a
  single Angular SPA shell for everything. A rendering fetch of a nonsense-path
  control returns the same document, so neither URL is evidence of a disclosure
  page and neither is recorded as one.