generated: '2026-08-13'
method: probed
source: >-
  https://api.getdrip.com/.well-known/security.txt (HTTP 200, text/plain,
  PGP-signed) and https://www.getdrip.com/.well-known/security.txt (HTTP 200,
  byte-identical). Probed 2026-08-13. The document itself is saved verbatim at
  well-known/drip-security.txt.
description: >-
  Drip publishes a machine-readable vulnerability disclosure contact via
  RFC 9116 security.txt, served from both the API host and the application
  host, and clearsigned with a PGP key it also publishes. That is a real
  disclosure surface — but a thin and stale one: there is no Policy field
  pointing at disclosure terms, no Acknowledgments, no bug bounty program, and
  crucially no `Expires` field, which RFC 9116 makes REQUIRED. The PGP
  signature timestamp puts the document's last signing in 2020.
program:
  published: true
  type: security-contact
  bug_bounty: false
  bounty_platform: null
  safe_harbor_stated: false
security_txt:
  url: https://api.getdrip.com/.well-known/security.txt
  canonical: https://www.getdrip.com/.well-known/security.txt
  http_status: 200
  content_type: text/plain
  file: well-known/drip-security.txt
  signed: true
  signature: PGP clearsigned (SHA256)
  fields:
    Contact: mailto:security@drip.com
    Preferred-Languages: en
    Canonical: https://www.getdrip.com/.well-known/security.txt
    Encryption: https://www.getdrip.com/security-pgp-key.txt
  missing_fields:
    - Expires
    - Policy
    - Acknowledgments
    - Hiring
  rfc9116_conformant: false
  rfc9116_note: >-
    RFC 9116 section 2.5.5 makes `Expires` a MUST. Without it a finder cannot
    tell whether the contact is still monitored. The clearsign block dates to
    2020, which suggests the document has not been re-issued since.
contacts:
  - type: email
    value: security@drip.com
    source: security.txt Contact field
encryption:
  pgp_key_url: https://www.getdrip.com/security-pgp-key.txt
  pgp_key_http_status: 200
  note: >-
    The key referenced by the security.txt Encryption field is served and
    returned 200 on 2026-08-13. The signature block itself was not verified
    against the key by this pass.
hosts_serving:
  - https://api.getdrip.com
  - https://www.getdrip.com
hosts_not_serving:
  - host: https://developer.drip.com
    status: 404
  - host: https://www.drip.com
    status: 403
    note: 'Cloudflare bot challenge (cf-mitigated: challenge); no conclusion drawn.'
x-evidence:
  fetched: '2026-08-13'
  probes:
    - url: https://api.getdrip.com/.well-known/security.txt
      http_status: 200
      content_type: text/plain
    - url: https://www.getdrip.com/.well-known/security.txt
      http_status: 200
      content_type: text/plain
    - url: https://developer.drip.com/.well-known/security.txt
      http_status: 404
    - url: https://www.drip.com/.well-known/security.txt
      http_status: 403