generated: '2026-08-13'
method: probed
source: live probes of sendoso.com, app.sendoso.com, developer.sendoso.com
provider: Sendoso
providerId: sendoso
description: >-
  Recorded absence. Sendoso publishes no vulnerability disclosure policy, no security.txt and
  no bug bounty program that could be found from its own hosts. The only security contact
  reachable from the developer surface is a general support address.
published: false
security_txt:
  served: false
  probes:
    - url: https://sendoso.com/.well-known/security.txt
      status: 404
      note: Host answers every /.well-known/* path with "Invalid .well-known request".
    - url: https://app.sendoso.com/.well-known/security.txt
      status: 404
    - url: https://developer.sendoso.com/.well-known/security.txt
      status: 404
      note: 'Body: "Asset not found".'
  checked: '2026-08-13'
bug_bounty:
  program: null
  platform: null
  searched: [HackerOne, Bugcrowd, Intigriti]
  found: false
disclosure_policy:
  url: null
  found: false
  note: >-
    The Vanta trust center at https://security.sendoso.com/ may carry one, but it renders
    client-side and delivers no readable content — see security/sendoso-trust-center.yml.
contacts_available:
  - address: developers@sendoso.com
    role: Developer support
    note: >-
      The only address the developer documentation gives for security questions: "If you have
      any questions or concerns about the security of the Sendoso API, please contact the
      Sendoso support team at developers@sendoso.com."
    source: https://developer.sendoso.com/rest-api/overview/security
recommendation_for_provider: >-
  A three-line /.well-known/security.txt naming a contact and a policy URL is the cheapest
  fix on this whole profile, and it is the one a researcher looks for first.