generated: '2026-08-13'
method: searched
source: https://github.com/newfold-labs/.github/blob/main/SECURITY.md
policy_url: https://newfold.com/disclosure
published: true
program:
  type: vulnerability-disclosure-policy
  bug_bounty: false
  bug_bounty_note: No HackerOne, Bugcrowd or Intigriti program was found, and none
    is referenced from the security policy or the org SECURITY.md.
  scope_statement: 'Newfold accepts vulnerability reports from all sources — independent
    security researchers, industry partners, vendors, customers and consultants — and
    defines a security vulnerability as an unintended weakness or exposure that could
    be used to compromise the integrity, availability or confidentiality of its products
    and services.'
  stated_principles: mutual trust, respect, transparency and common good between Newfold
    and security researchers
  intake: '"Report Ethical Hacking" link on newfold.com/disclosure. No security contact
    email address and no PGP key are published, and no safe-harbor language was visible
    on the disclosure page.'
security_txt:
  served: false
  probed:
  - url: https://newfold.com/.well-known/security.txt
    status: 403
    note: Cloudflare interactive challenge, not a provider answer.
  - url: https://hiive.cloud/.well-known/security.txt
    status: 404
  note: 'Newfold publishes a real disclosure policy but does not advertise it at the
    RFC 9116 location, so a scanner that only checks /.well-known/security.txt will
    conclude there is no program. This is the single cheapest fix available to them.'
evidence:
- url: https://github.com/newfold-labs/.github/blob/main/SECURITY.md
  status: 200
  what: 'Org-wide security policy: "Newfold''s full vulnerability disclosure policy
    can be found on our website" → https://www.newfold.com/disclosure'
- url: https://www.newfold.com/disclosure
  status: 200
  what: Disclosure policy page, read through a JS-capable fetch (plain HTTP GET returns
    the Cloudflare 403 challenge).
gaps:
- No security.txt at the RFC 9116 path.
- No named security contact address or PGP key.
- No published safe-harbor commitment.
- No bug bounty.