generated: '2026-08-12'
method: searched
source: https://spotwise.ai/security
note: >-
  Spotwise publishes a named security contact on its own data & privacy page, which is
  the entry point a reporter would use. It does NOT publish a vulnerability-disclosure
  policy, safe-harbour language, response-time commitment, scope statement, or a bug
  bounty programme, and it serves no RFC 9116 security.txt (404 on every host).

rating_pointer_note: >-
  No `type: Security` pointer is emitted. The `security_disclosure` check asserts the
  provider publishes a vulnerability-disclosure/security policy; Spotwise publishes a
  data & privacy posture page that happens to carry a security address, which is not
  the same thing. Emitting the pointer would credit a policy that does not exist.

program:
  published: false
  type: security-contact-only
  policy_url: null
  safe_harbour: false
  response_sla: false
  scope_statement: false

contacts:
- kind: email
  value: security@spotwise.ai
  source: https://spotwise.ai/security
- kind: email
  value: hello@spotwise.ai
  source: https://spotwise.ai/faq
  note: general contact, not security-specific

bug_bounty:
  present: false
  platforms_checked:
  - HackerOne
  - Bugcrowd
  - Intigriti
  result: no Spotwise programme found

security_txt:
  served: false
  hosts_checked:
  - spotwise.ai
  - app.spotwise.ai
  - spotwise-attribution-api-bmexgmdgfqhgepc5.germanywestcentral-01.azurewebsites.net
  status: 404
  recommendation: publishing /.well-known/security.txt (RFC 9116) with Contact and
    Policy fields would make the existing security@spotwise.ai address machine-discoverable

evidence:
- url: https://spotwise.ai/security
  status: 200
- url: https://spotwise.ai/.well-known/security.txt
  status: 404
- url: https://app.spotwise.ai/.well-known/security.txt
  status: 404