generated: '2026-08-12'
method: probed
probe: true
source: DNS CAA record for embrace.io, plus live probes of the usual disclosure paths
description: >-
  Embrace publishes a security contact, but no vulnerability disclosure policy. The only
  machine-readable contact found is the iodef entry in the domain's CAA record. There is no
  security.txt on any Embrace host, no responsible-disclosure page, and no bug bounty program on
  HackerOne or Bugcrowd. Recorded as a partial hit: a researcher can find an address, but not the
  terms under which to use it.
policy: []
policy_published: false
contact:
  - security@embrace.io
contact_source: DNS CAA iodef record — '0 iodef "mailto:security@embrace.io"' on embrace.io
support_contact: support@embrace.io
bug_bounty:
  program: null
  platforms_checked: [hackerone, bugcrowd]
security_txt:
  served: false
  hosts_probed:
    - {host: embrace.io, path: /.well-known/security.txt, status: 404}
    - {host: mcp.embrace.io, path: /.well-known/security.txt, status: 404}
    - {host: dash-api.embrace.io, path: /.well-known/security.txt, status: 404}
    - {host: get.embrace.io, path: /.well-known/security.txt, status: 404}
    - {host: api.embrace.io, path: /.well-known/security.txt, status: 403}
    - {host: api-us1.embrace.io, path: /.well-known/security.txt, status: 403}
    - {host: api-eu1.embrace.io, path: /.well-known/security.txt, status: 403}
    - {host: dash.embrace.io, path: /.well-known/security.txt, status: 200, document: false, rejected: spa-html-shell}
evidence:
  - {source: 'dig CAA embrace.io', kind: caa-iodef, value: 'mailto:security@embrace.io'}
  - {source: 'https://embrace.io/responsible-disclosure/', kind: probe, status: 404}
  - {source: 'https://embrace.io/security/responsible-disclosure/', kind: probe, status: 404}
  - {source: 'https://embrace.io/vulnerability-disclosure/', kind: probe, status: 404}
  - {source: 'https://embrace.io/security/', kind: probe, status: 404}
  - {source: 'https://hackerone.com/embrace', kind: probe, status: 404}
  - {source: 'https://bugcrowd.com/embrace', kind: probe, status: 404}
related_docs:
  - https://embrace.io/docs/ios/6x/best-practices/security-considerations/
  - https://embrace.io/docs/web/best-practices/security-considerations/
  - https://embrace.io/docs/product/settings/service-accounts/   # token handling guidance
note: >-
  No 'Security' pointer is emitted in apis.yml. That check asserts a published security or
  disclosure policy page, and Embrace has none — serving a /.well-known/security.txt naming the
  contact already present in DNS would be the cheapest fix available to this provider.