generated: '2026-08-04'
method: searched
probe: true
source: https://www.figment.io/.well-known/security.txt
description: >-
  Figment publishes an RFC 9116 security.txt on both the www and apex hosts naming a dedicated
  security operations mailbox. It is a minimal file — a contact and an expiry, nothing more.
policy: []
contact:
- mailto:secops@figment.io
expires: '2027-01-28T05:00:00.000Z'
security_txt:
  url: https://www.figment.io/.well-known/security.txt
  apex_url: https://figment.io/.well-known/security.txt
  http_status: 200
  file: well-known/figment-security.txt
  fields_present: [Contact, Expires]
  fields_absent: [Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical, Hiring, CSAF]
bug_bounty:
  program: none-found
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: No public bug bounty or coordinated-disclosure program found.
disclosure_pages_probed:
- url: https://www.figment.io/security/
  http_status: 404
- url: https://security.figment.io/
  http_status: 0
  note: Host does not resolve independently.
- url: https://trust.figment.io/
  http_status: 200
  note: >-
    Vanta trust center — compliance posture, not a vulnerability-disclosure policy. Captured
    separately in security/figment-trust-center.yml.
gaps:
- >-
  No Policy: field in security.txt and no responsible-disclosure page, so a researcher gets an email
  address but no stated safe-harbour terms, scope, or response commitment.
evidence:
- source: well-known/figment-security.txt
  kind: security.txt
  http_status: 200
- source: https://figment.io/.well-known/security.txt
  kind: security.txt (apex, identical body)
  http_status: 200
x-evidence:
  fetched: '2026-08-04'
  url: https://www.figment.io/.well-known/security.txt
  http_status: 200
  content_type: text/plain