generated: '2026-09-10'
method: searched
probe: true
source: >-
  https://www.forsta.com/legal-privacy/ links a "Responsible disclosure policy"; the policy itself
  is published by the parent company at https://www.pressganey.com/responsible-disclosure-policy/
domain_note: >-
  The policy lives on pressganey.com because Forsta is the PG Forsta brand of Press Ganey, which
  acquired Forsta in 2022 - the same corporate entity signs Forsta's own legal documents (see
  https://www.forsta.com/legal-privacy/pg-forsta-technical-and-organizational-measures/, titled
  "PG Forsta technical and organizational measures"), and forsta.com's legal-privacy page
  advertises the disclosure policy as its own.
policy:
  - https://www.pressganey.com/responsible-disclosure-policy/
contact:
  - security@pressganey.com
pgp: >-
  A PGP public key is offered on the policy page for encrypting reports; reports touching PHI or
  other confidential data are required to be encrypted.
bug_bounty: false
bug_bounty_note: >-
  No bounty is offered and no HackerOne, Bugcrowd or Intigriti program exists - hackerone.com/forsta,
  hackerone.com/pressganey and bugcrowd.com/forsta all returned 404.
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt on any Forsta host (see well-known/forsta-well-known.yml) and none
  on pressganey.com either (404). A machine cannot discover this policy; only a human reading the
  legal page can.
defect:
  - >-
    forsta.com's own legal-privacy page links its disclosure policy to
    https://www.forsta.com/responsible-disclosure-policy/, which returns HTTP 404. The working copy
    is the pressganey.com URL above. Probed 2026-09-10.
evidence:
  - source: https://www.forsta.com/legal-privacy/
    kind: link to disclosure policy
    status: 200
  - source: https://www.forsta.com/responsible-disclosure-policy/
    kind: the link target that page names
    status: 404
  - source: https://www.pressganey.com/responsible-disclosure-policy/
    kind: responsible disclosure policy with a security@ contact
    status: 200