generated: '2026-07-17'
method: probed
source: DNS TXT (DMARC) + live probe of https://culqi.com/.well-known/security.txt
contact:
- mailto:infosec@culqi.com
securityTxt:
  present: false
  probedUrl: https://culqi.com/.well-known/security.txt
  note: >-
    No RFC 9116 security.txt was served at /.well-known/security.txt; the URL
    returned the marketing homepage (HTTP 200 HTML), not a security.txt file.
evidence:
- source: DNS TXT _dmarc.culqi.com
  kind: DMARC rua/ruf contact (live probe)
  value: >-
    v=DMARC1; p=reject; rua=mailto:infosec@culqi.com; ruf=mailto:infosec@culqi.com
notes: >-
  Culqi does not publish a dedicated public vulnerability disclosure program
  or a security.txt file. The only machine-discoverable security contact is
  infosec@culqi.com, surfaced via the DMARC record's aggregate/forensic
  reporting addresses. Direct-API integrators are also directed to Culqi's
  risk mailbox for PCI DSS SAQ-D submission. Report security issues to
  infosec@culqi.com.