generated: '2026-08-05'
method: searched
probe: true
source: https://runbuggy.com/security/
summary: RunBuggy publishes a public security page that names a dedicated security
  contact address and describes its product-security program. It does NOT publish an
  RFC 9116 security.txt, a coordinated-disclosure policy, safe-harbor language, or a
  bug bounty program.
contact:
  email: security@runbuggy.com
  label: Contact RunBuggy Security
  source: https://runbuggy.com/security/
program:
  published_page: https://runbuggy.com/security/
  disclosure_policy: false
  safe_harbor: false
  bug_bounty: false
  bug_bounty_platform: null
  security_txt: false
  claims:
  - Secure system development life cycle (SDLC) practices, including OWASP Top 10
  - 24/7 monitoring, vulnerability management, and security assessments
  - Zero-trust architecture — passwords replaced with immutable credentials backed by
    private keys held in the device TPM
gaps:
- no /.well-known/security.txt on runbuggy.com, docs.runbuggy.com, apps.runbuggy.com
  or ng-staging.runbuggy.com (all probed 2026-08-05)
- no published coordinated-disclosure policy or response-time commitment
- no safe-harbor statement for good-faith researchers
evidence:
- source: https://runbuggy.com/security/
  kind: disclosure page
  keywords:
  - vulnerability
  - security@
x-evidence:
  fetched: '2026-08-05'
  probes:
  - url: https://runbuggy.com/security/
    http_status: 200
    note: security page carrying mailto:security@runbuggy.com
  - url: https://runbuggy.com/.well-known/security.txt
    http_status: 200
    note: NOT a hit — WordPress soft-404 returning the site HTML shell; a random control
      path under /.well-known/ returns the same 200 HTML
  - url: https://apps.runbuggy.com/.well-known/security.txt
    http_status: 200
    note: NOT a hit — SPA catch-all returns index.html for every path
  - url: https://ng-staging.runbuggy.com/.well-known/security.txt
    http_status: 404