generated: '2026-08-19'
method: searched
probe: true
source: https://docs.shieldlabs.ai/security
note: >-
  ShieldLabs publishes a short but genuine responsible-disclosure statement in its docs, with a named
  contact and a good-faith safe-harbour sentence. What it does not have: an RFC 9116 security.txt on
  any host (probed all five, all 404), a bug bounty program on HackerOne, Bugcrowd or Intigriti, a
  dedicated /security policy page on the marketing site, a PGP key, or a stated response SLA. The
  single security address is the same generic contact@shieldlabs.ai used for sales, privacy and
  support, so a report has no separate intake path.
policy:
- https://docs.shieldlabs.ai/security
contact:
- contact@shieldlabs.ai
policy_text: >-
  "If you find a security issue in ShieldLabs, report it privately to contact@shieldlabs.ai. Please
  include enough detail to reproduce it, and give us a reasonable window to confirm and fix before any
  public disclosure. We do not pursue good-faith researchers who follow coordinated disclosure."
safe_harbour: true
bug_bounty: false
bug_bounty_programs: []
security_txt: false
security_txt_probes:
- {url: 'https://shieldlabs.ai/.well-known/security.txt', status: 404}
- {url: 'https://www.shieldlabs.ai/.well-known/security.txt', status: 404}
- {url: 'https://docs.shieldlabs.ai/.well-known/security.txt', status: 404}
- {url: 'https://api.shieldlabs.ai/.well-known/security.txt', status: 404}
- {url: 'https://account.shieldlabs.ai/.well-known/security.txt', status: 404}
response_sla: null
pgp_key: null
evidence:
- source: https://docs.shieldlabs.ai/security
  kind: disclosure page
  http_status: 200
  keywords:
  - responsible disclosure
  - coordinated disclosure
  - security issue
  - report it privately
- source: https://docs.shieldlabs.ai/support
  kind: support page naming a security contact
  http_status: 200