generated: '2026-08-12'
method: searched
source: https://trust.haus.io/
description: >-
  Haus runs a responsible-disclosure intake on its trust center. It is an email
  intake only — there is no RFC 9116 /.well-known/security.txt (www.haus.io
  returns 404 for that path), no published disclosure policy document, no safe
  harbour statement and no bug bounty program on HackerOne, Bugcrowd or
  Intigriti.
program:
  type: responsible-disclosure
  bug_bounty: false
  platform: null
  safe_harbor_published: false
  policy_document: null
policy: []
contact:
- mailto:security@haus.io
contact_mechanism: >-
  A "report a vulnerability" control on trust.haus.io opens a mailto link —
  mailto:security@haus.io?subject=SafeBase%20Responsible%20Disclosure%20Report%20for%20Haus
  — rendered by SafeBase, the trust-center platform Haus uses. The receiving
  mailbox is Haus's own (security@haus.io).
security_txt:
  published: false
  probed:
  - url: https://www.haus.io/.well-known/security.txt
    status: 404
  - url: https://app.haus.io/.well-known/security.txt
    status: 404
  - url: https://trust.haus.io/.well-known/security.txt
    status: 404
related_security_documents:
  note: >-
    The trust center lists these documents behind an NDA/request gate rather
    than serving them publicly. Listed here as published claims, not as fetched
    artifacts.
  listed:
  - SOC 2 Report
  - Application Penetration Testing report
  - Network Diagram
  - Software Development Lifecycle documentation
  - Vulnerability & Patch Management documentation
evidence:
- source: https://trust.haus.io/
  http_status: 200
  fetched: '2026-08-12'
  kind: trust center — responsible disclosure intake
  observed: >-
    Anchor with href
    "mailto:security@haus.io?subject=SafeBase Responsible Disclosure Report for Haus"
    present in the served HTML, alongside the invitation to report a suspected
    vulnerability.
- source: https://www.haus.io/support
  http_status: 200
  fetched: '2026-08-12'
  kind: support page — security contact
  observed: security@haus.io published as the address for reporting security issues.