generated: '2026-09-04'
method: searched
source: https://www.browserstack.com/vulnerability-disclosure-program
provider: BrowserStack
providerId: browserstack
program:
  published: true
  name: BrowserStack Vulnerability Disclosure Program
  url: https://www.browserstack.com/vulnerability-disclosure-program
  type: coordinated disclosure (self-hosted policy page)
  bug_bounty_platform: none
  security_txt: false
  security_txt_note: >-
    No /.well-known/security.txt is served on any BrowserStack-controlled host — probed on
    www.browserstack.com, browserstack.com, api.browserstack.com, api-cloud.browserstack.com,
    api-enterprise.browserstack.com, api-accessibility.browserstack.com and
    mcp.browserstack.com, all 404 or 403. The security.txt served at status.browserstack.com
    belongs to Atlassian (Statuspage), is signed by Atlassian, and names
    security@atlassian.com — it is not BrowserStack's. A machine looking for BrowserStack's
    disclosure policy the standard way will not find it; the policy exists only as an HTML
    page.
evidence:
  - url: https://www.browserstack.com/vulnerability-disclosure-program
    status: 200
    fetched: '2026-09-04'
  - url: https://www.browserstack.com/.well-known/security.txt
    status: 404
    fetched: '2026-09-04'
scope:
  in_scope:
    - https://www.browserstack.com
    - https://live.browserstack.com
    - https://app-live.browserstack.com
    - https://automate.browserstack.com
    - https://app-automate.browserstack.com
    - https://api.browserstack.com
    - https://api-cloud.browserstack.com
    - BrowserStack Local binary (Windows, macOS, Linux) — latest released version only
    - '*.percy.io'
  out_of_scope:
    - Subdomains of browserstack.com not explicitly listed in scope
    - blog.percy.io (hosted on Medium)
    - docs.percy.io
    - go.percy.io
    - status.percy.io (Atlassian Statuspage — report to Atlassian)
    - Real devices, emulators and terminals provided by BrowserStack
    - Third-party applications
    - Local language bindings
note: >-
  Both public API hosts an integrator actually calls — api.browserstack.com and
  api-cloud.browserstack.com — are explicitly in scope and are named as "API Testing" targets,
  which is a stronger statement than most disclosure policies make. The policy also states the
  access route a researcher should use (free-trial signup, and a freemium Percy account with
  5,000 snapshots/month), so testing does not require a sales conversation.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com