generated: '2026-08-19'
method: searched
probe: true
source: https://www.cisco.com/.well-known/security.txt
description: >-
  Cisco PSIRT is the team that OPERATES this API, so the disclosure programme and
  the product being catalogued are the same organisation. Cisco serves a real,
  PGP-clear-signed RFC 9116 security.txt at the corporate root whose Contact is
  psirt@cisco.com and whose Policy is the Cisco Security Vulnerability Policy, and
  the API's own GitHub repo carries a SECURITY.md with 24x7 emergency contact
  details.
policy:
  - https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
  - https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
contact:
  - mailto:psirt@cisco.com
encryption:
  - https://cscrdr.cloudapps.cisco.com/cscrdr/security/center/files/Cisco_PSIRT_PGP_Public_Key.asc
canonical: https://www.cisco.com/.well-known/security.txt
expires: '2027-01-01T00:00:00.000Z'
signed: true
signature: PGP clear-signed (SHA256)
csaf: https://www.cisco.com/.well-known/csaf/provider-metadata.json
bug_bounty:
  program: null
  platform: null
  note: >-
    Cisco runs no public HackerOne / Bugcrowd / Intigriti bounty for this surface.
    Disclosure is direct to PSIRT by email or phone.
emergency_support:
  phone:
    - '+1 877 228 7302 (toll-free within North America)'
    - '+1 408 525 6532 (international direct-dial)'
  hours: 24 hours a day, 7 days a week
  source: https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
nonemergency_support:
  email: psirt@cisco.com
  acknowledgement: Typically acknowledged within 48 hours.
advisories: https://www.cisco.com/go/psirt
evidence:
  - source: https://www.cisco.com/.well-known/security.txt
    kind: security.txt
    http_status: 200
    fetched: '2026-08-19'
    file: well-known/cisco-psirt-security.txt
  - source: https://github.com/CiscoPSIRT/openVulnAPI/blob/master/SECURITY.md
    kind: repo-security-policy
    http_status: 200
    fetched: '2026-08-19'
  - source: https://www.cisco.com/.well-known/csaf/provider-metadata.json
    kind: csaf-provider-metadata
    http_status: 200
    fetched: '2026-08-19'
    file: well-known/cisco-psirt-csaf-provider-metadata.json
note: >-
  The automated probe (0-working/probe-security-programs.py) returned
  vdp=none because it only reaches the hosts named in apis.yml
  (developer.cisco.com), which serves no security.txt. This file is the SEARCHED
  upgrade: the document is served from www.cisco.com, which the security.txt itself
  names as its Canonical URI.