generated: '2026-08-12'
method: searched
probe: true
probe_note: >-
  0-working/probe-security-programs.py returned vdp=none — its path list and keyword threshold
  did not fire on this site. A manual read of https://segmetrics.io/security/ (HTTP 200) found a
  real, named disclosure practice and a security contact, quoted below. This file is
  method: searched and must not be overwritten by a later probe pass.
policy:
- https://segmetrics.io/security/
contact:
- security@segmetrics.io
bug_bounty:
  program: false
  paid: false
  statement: >-
    Verbatim — "We do not currently operate a formal bug bounty program or pay for vulnerability
    reports, but we appreciate responsible disclosure and will work in good faith with
    researchers to confirm and remediate confirmed issues."
disclosure_practice:
  intake: 'email security@segmetrics.io with details'
  commitment: 'We review every report we receive.'
  constraints: >-
    Researchers are asked not to test for vulnerabilities against production in a way that
    risks Customer data or service availability.
  safe_harbor_published: false
  response_sla_published: false
security_txt:
  served: false
  path_probed: /.well-known/security.txt
  status: 404
  note: >-
    A published security contact with no RFC 9116 security.txt is the gap here — a scanner or
    agent cannot discover security@segmetrics.io mechanically. No SecurityTxt pointer is
    emitted.
evidence:
- {source: 'https://segmetrics.io/security/', kind: security-page, status: 200}
- {source: 'https://segmetrics.io/.well-known/security.txt', kind: security.txt, status: 404}
x-evidence:
  fetched: '2026-08-12'