generated: '2026-08-27'
method: searched
probe: true
source: >-
  https://api.elastic-cloud.com/.well-known/security.txt (HTTP 200,
  text/plain, saved verbatim as well-known/elk-stack-security.txt) and
  https://www.elastic.co/product-security (HTTP 200, reached via a 307 from
  https://www.elastic.co/community/security).
program: Elastic Vulnerability Disclosure Program
policy:
- https://www.elastic.co/product-security
- https://www.elastic.co/cloud/security
contact:
- security@elastic.co
pgp:
  fingerprint: 1224D1A572A73755B61A377B14D65EE0D2AE61D2
  source: security.txt Encryption field (openpgp4fpr) and the product-security page
bug_bounty:
  exists: true
  platform: HackerOne
  url: https://hackerone.com/elastic
  status: 200
  note: >-
    Email reports sent directly to security@elastic.co are accepted but are
    ineligible for a bounty — the HackerOne program is the paid channel.
disclosure_policy:
  model: Coordinated Vulnerability Disclosure
  detail: >-
    Elastic asks reporters not to publish details until it has researched and
    responded through its own channels. No formal safe-harbour legal language
    appears on the product-security page.
cve_numbering_authority: true
cve_note: Elastic is an authorized CVE Numbering Authority and issues its own CVE IDs.
advisories:
  format: Elastic Security Advisories (ESA)
  contents:
  - CVE ID
  - CVSS severity
  - affected versions
  - remediation
  forum: https://discuss.elastic.co/c/announcements/security-announcements/31
  rss: https://discuss.elastic.co/c/announcements/security-announcements.rss
security_txt:
  served: true
  host: api.elastic-cloud.com
  path: /.well-known/security.txt
  status: 200
  file: well-known/elk-stack-security.txt
  fields:
  - Contact
  - Encryption
  - Hiring
  - Policy
  rfc9116_gaps:
  - >-
      No `Expires` field. RFC 9116 makes it mandatory, so this file is a partial
      implementation.
  - >-
      Not served on www.elastic.co (404) or the apex elastic.co (404) — only on
      the Elastic Cloud control-plane host, which is the host a researcher is
      least likely to check first.
evidence:
- source: https://api.elastic-cloud.com/.well-known/security.txt
  status: 200
- source: https://www.elastic.co/product-security
  status: 200
- source: https://hackerone.com/elastic
  status: 200
- source: https://www.elastic.co/.well-known/security.txt
  status: 404