generated: '2026-08-13'
method: searched
source: https://spri.ng/about/security
http_status: 200
program:
  exists: true
  type: vulnerability-disclosure-policy
  published_as: HTML page (no /.well-known/security.txt anywhere — see well-known/famous-well-known.yml)
  policy_url: https://spri.ng/about/security
  contact: security.team@spri.ng
  contact_type: email
  reporting_instruction: >-
    "If you believe you have found a security vulnerability, please contact us at
    security.team@spri.ng. Please act in good faith towards our users' privacy and data during this
    process."
  safe_harbour: >-
    The page states Spring does not require a specific disclosure format and commits to working
    with researchers in good faith without legal action for compliant reporting.
  abuse_contact: creatorhelp@spri.ng
  scope_published: false
  response_sla: not published
  disclosure_timeline: not published
bug_bounty:
  exists: false
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti programme is referenced on the page, and none was found on
    any Amaze or Spring host. Reporting is unpaid and by email only.
pgp_key: none published
hall_of_fame: none published
gaps:
- The policy lives on spri.ng only. amaze.co, amazecommerce.com, teespring.com and
  api.teespring.com carry no security page and no security.txt, so a researcher who lands on the
  corporate domain or the API host has no path to the contact.
- No /.well-known/security.txt means no automated scanner or agent can discover the contact.