generated: '2026-08-12'
method: searched
source: https://mountain.com/security/
program:
  published: true
  type: security-contact
  page: https://mountain.com/security/
  contact:
    email: security@mountain.com
    statement: "If you think you've discovered a vulnerability, please email security@mountain.com"
  bug_bounty:
    exists: false
    platforms_checked: [HackerOne, Bugcrowd, Intigriti, YesWeHack]
    result: no program found
  safe_harbor:
    published: false
  scope:
    published: false
  response_targets:
    published: false
  pgp_key: null
security_txt:
  served: false
  probes:
  - {url: 'https://mountain.com/.well-known/security.txt', status: 404}
  - {url: 'https://www.mountain.com/.well-known/security.txt', status: 404}
  - {url: 'https://api.mountain.com/.well-known/security.txt', status: 401}
  - {url: 'https://api3.mountain.com/.well-known/security.txt', status: 404}
  - {url: 'https://help.mountain.com/.well-known/security.txt', status: 200, third_party: Intercom, note: "Intercom's own file on the vendor-hosted help subdomain, not MNTN's"}
  note: >-
    MNTN publishes a working disclosure contact on a human-readable page but serves no RFC 9116
    security.txt on any host it controls. The single 200 is the Intercom help-desk vendor's file and
    does not name MNTN. No type: SecurityTxt pointer is wired.
practices_claimed:
  source: https://mountain.com/security/
  items:
  - Data encryption at rest and in transit
  - Annual third-party audits
  - Annual penetration testing
  - Regular access control reviews
  - Intrusion detection system (IDS)
  - 24/7 on-call team rotation
  - Cybersecurity insurance
  - Subprocessor list available
note: >-
  A named, monitored security contact on a first-party page is a genuine disclosure surface, so a
  type: Security pointer is wired in apis.yml. What is missing is everything that makes the program
  machine-actionable: no security.txt, no published scope, no safe-harbor statement, and no stated
  response target.