generated: '2026-08-16'
method: searched
source: https://floatfinancial.com/security (HTTP 200), plus probes of the standard disclosure paths and platforms
disclosure_channel:
  published: true
  type: email
  contact: security@floatfinancial.com
  page: https://floatfinancial.com/security
  verbatim: >-
    "Float is always open to feedback, questions and suggestions. Email us at security@floatfinancial.com."
  note: >-
    A real, published, human-reachable security address on Float's own public security page — the disclosure
    channel a researcher would actually use. Recorded honestly for what it is: a contact, not a program. Float
    publishes no vulnerability disclosure POLICY, no scope statement, no safe-harbour language, no response-time
    commitment and no bug bounty.
formal_policy:
  published: false
  safe_harbour: false
  scope_statement: false
  response_sla: false
bug_bounty:
  program: none
  probes:
  - url: https://hackerone.com/floatfinancial
    status: 404
  - url: https://bugcrowd.com/floatfinancial
    status: 404
security_txt:
  published: false
  probes:
  - url: https://floatfinancial.com/.well-known/security.txt
    status: 404
  - url: https://floatfinancial.com/security.txt
    status: 404
  - url: https://api.floatfinancial.com/.well-known/security.txt
    status: 404
  - url: https://docs.floatfinancial.com/.well-known/security.txt
    status: 404
  - url: https://app.floatfinancial.com/.well-known/security.txt
    status: 200
    document: false
    note: SPA HTML shell, not an RFC 9116 document. Rejected.
  note: >-
    Publishing an RFC 9116 security.txt at https://floatfinancial.com/.well-known/security.txt with
    `Contact: mailto:security@floatfinancial.com` and `Policy:` would be a one-file fix that makes this
    already-existing channel machine-discoverable.
other_disclosure_paths_probed:
- url: https://floatfinancial.com/responsible-disclosure
  status: 404
- url: https://floatfinancial.com/vulnerability-disclosure
  status: 404
- url: https://floatfinancial.com/bug-bounty
  status: 404
related_practices:
  penetration_testing: Annual, with an external audit firm (vendor not named)
  vulnerability_scanning: Periodic network scanning, software dependency scanning, IDS/IPS
  source: https://floatfinancial.com/security
trust_center: https://trust.floatfinancial.com/