generated: '2026-08-29'
method: probed
source: >-
  Probes of /.well-known/security.txt on sqream.com, www.sqream.com and docs.sqream.com, plus a read
  of https://sqream.com/security-policy/, 2026-08-29.
published: false
note: >-
  SQream publishes a Security Policy page describing its security posture, but NO vulnerability
  disclosure program: no security.txt (404 on every host), no Policy or Contact field, no dedicated
  security@ address on the policy page, and no HackerOne, Bugcrowd or Intigriti program found. A
  researcher with a finding has only the general contact form. This is a recorded absence, not an
  unchecked field.
probes:
- url: https://sqream.com/.well-known/security.txt
  status: 404
- url: https://www.sqream.com/.well-known/security.txt
  status: 404
- url: https://docs.sqream.com/.well-known/security.txt
  status: 404
- url: https://sqream.com/security-policy/
  status: 200
  finding: >-
    Security posture page. States SQream is working toward GDPR and SOC-2 Type II compliance and that
    ISO/IEC 27001 is on its roadmap. No disclosure process, no reporting address, no safe-harbour
    language, no certification held.
security_contact: null
bug_bounty: null
policy_url: https://sqream.com/security-policy/