generated: '2026-09-17'
method: searched
probe: true
source: https://bird.com/.well-known/security.txt
policy:
- https://hackerone.com/messagebird
contact:
- mailto:security@bird.com
- https://hackerone.com/messagebird
security_txt:
  url: https://bird.com/.well-known/security.txt
  status: 200
  file: well-known/messagebird-security.txt
  rfc: '9116'
  fields: [Contact, Policy, Expires, Preferred-Languages, Canonical]
  expires: '2027-06-17T00:00:00.000Z'
  canonical: https://bird.com/.well-known/security.txt
  preferred_languages: en
legacy_security_txt:
  url: https://messagebird.com/.well-known/security.txt
  status: 200
  file: well-known/messagebird-legacy-security.txt
  note: The pre-rebrand file. Older shape — Contact and Hiring only, no Policy, Expires or Canonical.
defects:
- finding: The Policy and second Contact URL in Bird's own security.txt is dead.
  url: https://hackerone.com/messagebird
  status: 404
  checked: '2026-09-17'
  detail: >-
    https://hackerone.com/messagebird returns HackerOne's "Page not found" page, and
    https://hackerone.com/bird 404s too. The mailto:security@bird.com contact is the only
    live channel the file names. This is the provider's to fix — either restore the program
    handle or drop the line — and it is the reason the Security pointer in apis.yml targets
    the security.txt itself rather than the HackerOne URL it advertises.
evidence:
- source: https://bird.com/.well-known/security.txt
  kind: security.txt (live probe 2026-09-17)
  status: 200
- source: https://hackerone.com/messagebird
  kind: bug bounty program referenced by security.txt
  status: 404