generated: '2026-08-29'
method: searched
source: https://www.qlik.com/us/trust
description: >-
  Qlik operates a stated responsible-disclosure program with a named security
  contact, but does not expose it through the machine-discoverable channel: no
  RFC 9116 /.well-known/security.txt is served on qlik.dev, qlik.com or
  www.qlik.com (all 404 on 2026-08-29 — see
  well-known/qliksense-well-known.yml), and there is no public bug bounty on
  HackerOne, Bugcrowd or Intigriti.
program:
  exists: true
  type: responsible-disclosure
  policy_url: https://www.qlik.com/us/trust
  trust_center: https://security.qlik.com/
  contact_email: security@qlik.com
  scope_statement: >-
    Qlik states it follows a Responsible Disclosure approach for any
    vulnerability rated High or Critical, publishing security bulletins and
    providing fixes.
  security_bulletins: https://community.qlik.com/
bug_bounty:
  exists: false
  platforms_checked: [hackerone, bugcrowd, intigriti]
  note: No public bounty program was found.
security_txt:
  served: false
  hosts_probed:
    - {host: qlik.dev, path: /.well-known/security.txt, status: 404}
    - {host: www.qlik.com, path: /.well-known/security.txt, status: 404}
    - {host: qlik.com, path: /.well-known/security.txt, status: 404}
  gap: >-
    A one-file fix. Qlik already publishes everything RFC 9116 asks for
    (contact, policy URL); it simply is not served at the well-known path a
    scanner or an agent would look for.