generated: '2026-08-12'
method: searched
probe: true
source: well-known/sharpspring-security.txt
note: >-
  SharpSpring does publish a vulnerability-disclosure surface, but it is split across two artifacts
  that disagree with each other. The RFC 9116 security.txt served on api.sharpspring.com,
  app.sharpspring.com and marketingautomation.services names an obfuscated contact address
  ("security [ at ] sharpspring.com") and points Policy: at the privacy notice over plain http://,
  which is not a disclosure policy. Separately, sharpspring.com/legal/security-how-to-report-a-
  vulnerability/ still resolves and 301s to https://www.constantcontact.com/disclosure — the parent
  company's real responsible-disclosure page, which is the URL wired as the `Security` pointer. That
  page could not be read directly: constantcontact.com returns HTTP 403 to every automated client we
  tried, so the presence of a bug bounty, a named platform (HackerOne/Bugcrowd/Intigriti), scope or
  safe-harbor language is UNVERIFIED and is not asserted here.
policy:
- https://www.constantcontact.com/disclosure
- http://sharpspring.com/legal/privacy/
policy_note: >-
  The second URL is the value published in the provider's own security.txt Policy: field. It points at
  a privacy notice, not a vulnerability policy, and it is served over http://. Recorded verbatim
  because it is what the provider publishes, not because it is a correct policy reference.
contact:
- security [ at ] sharpspring.com
contact_note: >-
  Written obfuscated in the security.txt rather than as the mailto: URI RFC 9116 requires, so it is
  not machine-actionable as published. Presumed to be security@sharpspring.com; not verified.
encryption: https://sharpspring.com/.well-known/sharpspring.gpg.txt
encryption_status: 404 — the PGP key the provider's own security.txt points to no longer exists
bug_bounty:
  program: unknown
  platform: null
  note: not verified — the disclosure page is WAF-blocked to automated clients
safe_harbor: unknown
expires_field: absent
signed: false
hosts_serving_security_txt:
- https://api.sharpspring.com/.well-known/security.txt
- https://app.sharpspring.com/.well-known/security.txt
- https://marketingautomation.services/.well-known/security.txt
hosts_not_serving_security_txt:
- https://sharpspring.com/.well-known/security.txt
excluded:
- host: https://status.sharpspring.com/.well-known/security.txt
  reason: >-
    Serves Atlassian's own PGP-signed Statuspage security.txt (Canonical https://www.atlassian.com/
    .well-known/security.txt). A vendor document on a vendor-hosted subdomain — not a SharpSpring
    artifact, and deliberately not credited.
evidence:
- source: well-known/sharpspring-security.txt
  kind: security.txt (harvested verbatim)
- source: https://api.sharpspring.com/.well-known/security.txt
  kind: live probe
  status: 200
- source: https://sharpspring.com/legal/security-how-to-report-a-vulnerability/
  kind: disclosure page
  status: 301
  location: https://www.constantcontact.com/disclosure
- source: https://www.constantcontact.com/disclosure
  kind: disclosure page
  status: 403
  note: blocked to automated clients; content unverified
- source: https://sharpspring.com/.well-known/sharpspring.gpg.txt
  kind: PGP key referenced by security.txt
  status: 404
x-evidence:
  fetched: '2026-08-12'