generated: '2026-08-09'
method: searched
probe: true
status: informal
policy_published: false
source: https://www.reqkey.com/llms.txt
description: >-
  ReqKey publishes no vulnerability-disclosure POLICY and runs no bug-bounty
  program. The only disclosure channel that exists is a single sentence in
  llms.txt naming support@reqkey.com as the address for, among other things,
  "security disclosures" — a shared support mailbox, not a security contact with
  a stated scope, safe-harbour clause or response commitment. Because there is
  no published policy or dedicated security page, this artifact deliberately
  does NOT carry a `type: Security` pointer in apis.yml; recording the mailbox
  as a disclosure program would credit ReqKey with a posture it has not
  published.
policy: []
contact:
  - support@reqkey.com
bug_bounty: null
safe_harbour: false
response_sla: null
pgp_key: null
evidence:
  - source: https://www.reqkey.com/llms.txt
    kind: docs
    http_status: 200
    quote: >-
      "Email support@reqkey.com for integration problems, bug reports, SDK
      requests, security disclosures, and sales."
  - {url: 'https://api.reqkey.com/.well-known/security.txt', http_status: 404, kind: security.txt}
  - {url: 'https://www.reqkey.com/.well-known/security.txt', http_status: 404, kind: security.txt}
  - {url: 'https://reqkey.com/.well-known/security.txt', http_status: 404, kind: security.txt}
  - {url: 'https://www.reqkey.com/security', http_status: 404, kind: disclosure-page}
  - {url: 'https://www.reqkey.com/trust', http_status: 404, kind: trust-page}
  - {url: 'https://www.reqkey.com/compliance', http_status: 404, kind: compliance-page}
  - {url: 'https://security.reqkey.com/', http_status: null, kind: subdomain, note: DNS does not resolve}
  - {url: 'https://trust.reqkey.com/', http_status: null, kind: subdomain, note: DNS does not resolve}
security_statements:
  - source: https://www.reqkey.com/legal/privacy
    quote: >-
      "We protect data with encryption in transit, scoped credentials, and
      least-privilege access internally. No system is perfectly secure — if we
      learn of a breach affecting your data, we will notify you promptly."
    note: >-
      A generic controls statement in the privacy policy, with a breach
      notification commitment but no timeframe. Not a disclosure policy.
gap:
  owner: provider
  recommendation: >-
    An RFC 9116 /.well-known/security.txt with Contact and Policy fields is a
    six-line file and would turn an unstated mailbox into a machine-readable
    disclosure channel. This matters more than usual for ReqKey specifically:
    the product is credential infrastructure, and a company that stores other
    people's API keys is judged on exactly this surface.