generated: '2026-08-11'
method: searched
source: https://www.credo.ai/legal/vulnerability-disclosure-policy
program:
  published: true
  name: Credo.ai Vulnerability Disclosure Policy
  policy_url: https://www.credo.ai/legal/vulnerability-disclosure-policy
  contact: security@credo.ai
  submission_channel: email
  anonymous_reports_accepted: true
  bug_bounty: false
  bounty_platform: null
  scope: >-
    Publicly accessible information systems or web properties owned, operated, or
    controlled by Credo.ai.
  safe_harbor_stated: true
security_txt:
  served: false
  probed:
  - url: https://www.credo.ai/.well-known/security.txt
    status: 404
  - url: https://api.credo.ai/.well-known/security.txt
    status: 404
  - url: https://app.credo.ai/.well-known/security.txt
    status: 404
  note: >-
    Credo AI publishes a full vulnerability disclosure policy as an HTML legal
    page but does NOT serve an RFC 9116 /.well-known/security.txt on any of its
    hosts, so an automated scanner cannot find the security@credo.ai contact.
    This is a one-file gap for the provider to close: the Policy: and Contact:
    fields already exist in prose.
evidence:
- url: https://www.credo.ai/legal/vulnerability-disclosure-policy
  status: 200
  fetched: '2026-08-11'
  quote: >-
    "If you have information about a vulnerability, please contact us at
    security@credo.ai." / "We accept vulnerability reports via security@credo.ai.
    Reports may be submitted anonymously."