generated: '2026-08-05'
method: searched
probe: true
source: https://redcanary.com/responsible-disclosure/
policy:
- https://redcanary.com/responsible-disclosure/
contact:
- security@redcanary.com
- grc@redcanary.com
bug_bounty:
  present: false
  platform: null
  paid: false
  statement: >-
    "While we appreciate reports, we do not have a formal bug bounty at this time, and
    do not provide financial compensation for vulnerability reports."
program:
  name: Red Canary Vulnerability Disclosure Program
  safe_harbor: >-
    Not explicit. The policy sets researcher obligations (comply with applicable law,
    avoid privacy violations, do not destroy or modify data, do not degrade availability)
    but does not contain explicit legal safe-harbor language indemnifying researchers.
  commitments:
  - prompt acknowledgement of receipt
  - transparent coordination and open dialogue
  - confirmation of the vulnerability where feasible
  - updates on remediation progress including obstacles
  disclosure: coordinated — Red Canary requests non-disclosure until the issue is resolved
  required_report_fields:
  - name
  - email
  - phone
  - vulnerability description
  - vulnerability category
  - steps to validate
  - affected parameters
  - attack payload
  pgp_key: null
security_txt:
  present: false
  note: >-
    Red Canary serves no /.well-known/security.txt on redcanary.com,
    docs.redcanary.com or support.redcanary.com (all 404). The 200 at
    status.redcanary.com/.well-known/security.txt is Atlassian's Statuspage platform
    file (Canonical: https://www.atlassian.com/.well-known/security.txt) and is not
    attributable to Red Canary. Publishing an RFC 9116 security.txt pointing at
    https://redcanary.com/responsible-disclosure/ would be a one-line win for a company
    whose business is security.
evidence:
- source: https://redcanary.com/responsible-disclosure/
  kind: disclosure page
  http_status: 200
  keywords:
  - responsible disclosure
  - security@redcanary.com
- source: https://redcanary.com/trust-center/
  kind: trust-center link to VDP
  http_status: 200
- source: https://redcanary.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
x-evidence:
  fetched: '2026-08-05'