generated: '2026-08-08'
method: searched
source: https://vdp.botkeeper.com/
name: Botkeeper Vulnerability Disclosure Program
program:
  published: true
  type: vulnerability-disclosure-policy
  bug_bounty: false
  paid: false
  url: https://vdp.botkeeper.com/
  linked_from: https://trust.botkeeper.com/
  contact: vdp@botkeeper.com
  submission: >-
    Reports are accepted through a form linked from the policy page. Reports may
    be submitted anonymously.
  safe_harbor: >-
    Good-faith research conducted under the policy is considered authorized;
    Botkeeper states it will not recommend or pursue legal action, and will make
    the authorization known if a third party initiates legal action.
  acknowledgement_sla: 3 business days when contact information is shared
  status_update_sla: 7 business days to acknowledge receipt of a report
  hall_of_fame: true

scope:
  in_scope:
    - '*.firm.ai'
    - '*.botkeeper.com'
    - '*.botkeeper.me'
  out_of_scope:
    - host: status.botkeeper.com
      reason: third-party hosted domain (Atlassian Statuspage)
    - host: any connected service not expressly listed
      reason: not authorized for testing
    - host: vendor systems
      reason: report directly to the vendor under its own policy
  prohibited_test_methods:
    - Network denial of service (DoS/DDoS) or any test that impairs access to or damages a system or data
    - Physical testing (office access, tailgating)
    - Social engineering (phishing, vishing) and other non-technical testing

researcher_expectations:
  - Notify Botkeeper as soon as a real or potential issue is discovered
  - Avoid privacy violations, UX degradation, production disruption, and data destruction or manipulation
  - Use exploits only to the extent needed to confirm the vulnerability; no data exfiltration, no persistence, no pivoting
  - Stop testing and notify immediately on encountering sensitive data (PII, financial, proprietary)
  - Allow reasonable time to remediate before public disclosure
  - No high-volume, low-quality report submissions
  - Reports should describe location, impact, and reproduction steps; English preferred

no_security_txt:
  note: >-
    Botkeeper publishes a full disclosure policy but does NOT publish an RFC 9116
    security.txt on any of its own hosts, so automated scanners and agents cannot
    discover the program. Adding
    https://www.botkeeper.com/.well-known/security.txt with Contact,
    Policy (https://vdp.botkeeper.com/) and Expires fields would make an already
    good program machine-discoverable.
  probed:
    - url: https://www.botkeeper.com/.well-known/security.txt
      status: 404
    - url: https://botkeeper.com/.well-known/security.txt
      status: 404

x-evidence:
  fetched: '2026-08-08'
  probes:
    - url: https://vdp.botkeeper.com/
      status: 200
      content_type: text/html; charset=UTF-8
    - url: https://trust.botkeeper.com/
      status: 200
      content_type: text/html