generated: '2026-08-12'
method: searched
probe: true
source: https://www.defakto.security/security/
contact: security@defakto.security
policy_url: https://www.defakto.security/security/
note: >-
  Defakto publishes a responsible-disclosure address on its security page and commits to
  handling reports there. What it does not do is make that reachable by machine: there is no
  RFC 9116 security.txt on any host — /.well-known/security.txt returns 404 on
  www.defakto.security, defakto.security and d.defakto.security — so an automated scanner or
  agent has no way to find the address without parsing marketing HTML. For a security vendor
  whose entire product is machine-readable identity, a four-line security.txt is the single
  cheapest fix available in this profile.
  No bug bounty program was found on HackerOne, Bugcrowd or Intigriti, and no CVE/advisory
  feed or GitHub Security Advisory stream is published for the shipped components — notable
  because the release notes DO name specific upstream CVEs and state reachability in Defakto's
  own deployment context, which is better practice than most. That analysis exists; it is just
  not published anywhere a subscriber could watch.
program:
  type: responsible-disclosure
  bug_bounty: false
  platform: null
  paid: false
  safe_harbor: unknown
  hall_of_fame: false
security_txt:
  published: false
  probed:
  - url: https://www.defakto.security/.well-known/security.txt
    status: 404
  - url: https://defakto.security/.well-known/security.txt
    status: 404
  - url: https://d.defakto.security/.well-known/security.txt
    status: 404
published_security_practices:
  source: https://www.defakto.security/security/
  claims:
  - Hardware-backed security keys for internal access
  - Keyless / secretless authentication internally
  - Code audits
  - Threat monitoring
  - Production alerting
  note: >-
    Self-described internal practices, not third-party attested. No SOC 2, ISO 27001, PCI DSS,
    HIPAA or FedRAMP report is published — see conformance/defakto-security-conformance.yml.
vulnerability_handling_in_releases:
  practice: >-
    Release notes for spirl-server name the specific upstream CVEs picked up by a dependency
    bump and state whether each was reachable in Defakto's deployment context. Example
    (0.34.0, 2026-05-13): of the 11 CVEs the Go security team published on 2026-05-07,
    CVE-2026-33814 was reachable in the agent's Sigstore image-signature verification and the
    customer-configured webhook extension code paths; the other 10 were assessed as not
    affecting spirl-server.
  url: https://d.defakto.security/releases/spirl-server.md
  feed: null
evidence:
- source: https://www.defakto.security/security/
  http_status: 200
  kind: disclosure page
  keywords:
  - responsible disclosure
  - security@