generated: '2026-08-22'
method: derived
source:
- openapi/hacknotice-openapi.yml
- mcp/hacknotice-mcp-tools.json
- https://api-docs.hacknotice.com
- https://hacknotice.zendesk.com/hc/en-us
note: 'No published compliance program was found. Probes of trust.hacknotice.com,
  security.hacknotice.com and hacknotice.com/security all failed (DNS non-resolution or a Cloudflare
  challenge with no indexed page behind it), and probe-security-programs.py returned vdp=none
  trust=none. No SOC 2, ISO 27001, HIPAA, PCI DSS or FedRAMP claim was located on any HackNotice
  surface. No common[].type Compliance or TrustCenter pointer is emitted, because there is no
  published compliance page for one to point at — notable for a vendor whose own product sells
  third-party security assessments to other companies.'
standards:
- id: oauth2
  conforms: false
  evidence: 'No oauth2 securityScheme anywhere. Three apiKey-in-header schemes only. /.well-known/oauth-authorization-server returns 404 on api.hacknotice.com and on the MCP host.'
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on api.hacknotice.com.
- id: rfc6750-bearer
  conforms: false
  evidence: 'Uses the literal prefix "JWT " in the Authorization header rather than "Bearer ", which HackNotice calls out explicitly in its own documentation.'
- id: rfc7519-jwt
  conforms: true
  evidence: 'POST /auth/sign_in issues a JWT; the documented token structure is a standard three-part JWS carrying email, customer_id, _id, iat and exp claims.'
- id: rfc9457-problem-details
  conforms: false
  evidence: 'Error responses are a flat {"message": "..."} object with no type/title/status/detail/instance members and no application/problem+json media type.'
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on api.hacknotice.com and on hacknotice.com.
- id: rfc8594-sunset-header
  conforms: false
  evidence: 'No Sunset or Deprecation header support documented, despite a "Deprecated" folder existing in the published collection.'
- id: rfc8615-well-known
  conforms: false
  evidence: 'No document served at any /.well-known/ path on any HackNotice host. See well-known/hacknotice-well-known.yml.'
- id: json-api
  conforms: false
  evidence: No JSON:API media type or document structure.
- id: odata
  conforms: false
  evidence: No $metadata surface.
- id: scim2
  conforms: false
  evidence: 'No urn:ietf:params:scim:schemas:* URN and no /Users or /Groups resource, despite the platform managing end-user rosters. Active Directory sync is described in the help centre as a product feature, not a SCIM endpoint.'
- id: mcp
  conforms: true
  version: '2024-11-05'
  evidence: 'Live JSON-RPC 2.0 Streamable-HTTP MCP server at https://mcp.hacknotice.com:13330/mcp. initialize returns protocolVersion 2024-11-05 and serverInfo {name: hacknotice, version: 0.1.0}; tools/list returns 80 tools each carrying a JSON Schema draft-07 inputSchema. Verified by anonymous probe, HTTP 200.'
- id: json-schema-draft-07
  conforms: true
  evidence: 'Every MCP tool inputSchema declares $schema: http://json-schema.org/draft-07/schema#.'
- id: a2a
  conforms: false
  evidence: 'No agent card. /.well-known/agent-card.json and /.well-known/agent.json return 404 on api.hacknotice.com and on the MCP host, and only SPA/soft-404 catch-all 200s on app.hacknotice.com and api-docs.hacknotice.com.'
- id: openapi
  conforms: false
  evidence: 'HackNotice publishes no OpenAPI. Its machine-readable contract is a Postman Collection v2.1 at api-docs.hacknotice.com; openapi/hacknotice-openapi.yml is an API Evangelist derivation of it, not a provider artifact.'
- id: postman-collection-v2
  conforms: true
  evidence: 'HackNotice-API collection published at https://api-docs.hacknotice.com (301 to documenter.getpostman.com/view/806684/2sBXiri7pT), 262 requests across 8 top-level areas.'
- id: saml2
  conforms: true
  evidence: 'SAML SSO documented for Microsoft Entra ID and Okta — https://hacknotice.zendesk.com/hc/en-us/articles/16860907619860-Microsoft-Azure-AD-EntraID-SAML-SSO-Integration and .../16860841528724-OKTA-SAML-Integration. Platform sign-in, not an API-level assertion.'
domain_standards:
  market: cyber threat intelligence / third-party risk
  note: 'REWARD-ONLY CHECK, HONESTLY UNMET. The threat-intelligence market has real interchange
    standards — STIX 2.1 and TAXII 2.1 for indicator exchange, MISP for community sharing, OpenC2
    for response, and the CVE/CVSS/CWE identifier schemes. HackNotice''s contract declares NONE of
    them: there is no TAXII collection endpoint, no STIX bundle media type, no MISP event export,
    and no CVE or CVSS field in any of the 262 documented requests or the 80 MCP tool inputSchemas.
    Its alert objects are a proprietary shape. This is recorded as an unmet opportunity, not a
    penalty — a buyer who already speaks STIX/TAXII will need a bespoke connector for HackNotice.'
  candidates_probed:
  - {id: stix-2.1, declared: false, evidence: No STIX object types or bundle media type in the contract.}
  - {id: taxii-2.1, declared: false, evidence: No /taxii2/ discovery route, no collections endpoint.}
  - {id: misp, declared: false, evidence: No MISP event/attribute export route.}
  - {id: openc2, declared: false, evidence: No OpenC2 command surface.}
  - {id: cve-cvss, declared: false, evidence: No CVE identifier or CVSS score field documented on any alert or assessment object.}