generated: '2026-08-02'
method: searched
probe: true
source: https://security.tensorwave.com/
policy:
- https://security.tensorwave.com/
contact:
- security@tensorwave.com
response_target: 4 business hours (stated on the trust center)
program:
  name: TensorWave Vulnerability Disclosure Policy
  published: '2026-05-07'
  distribution: gated
  distribution_note: 'The policy is listed under Resources on the TensorWave Trust Center as a
    document requiring "Request access"; the policy text itself is not served at a public URL.
    The trust center Updates feed announced it on 2026-05-07 with the note "Security researchers,
    read the policy in it''s entirety before submitting a finding."'
  bug_bounty: false
  bug_bounty_note: No HackerOne, Bugcrowd or Intigriti program was found.
penetration_testing:
  published_summaries:
  - TensorWave External Pentest Executive Summary 2026
  - TensorWave External WebApp Pentest Executive Summary 2026
  - TensorWave Internal Pentest Executive Summary 2026
  announced: '2026-01-09'
  note: Executive summaries are gated behind a trust-center access request.
evidence:
- source: https://security.tensorwave.com/
  kind: trust center resources list
  http_status: 200
  fetched: '2026-08-02'
  observed: TensorWave Vulnerability Disclosure Policy (Policy)
- source: https://security.tensorwave.com/
  kind: trust center contact
  http_status: 200
  fetched: '2026-08-02'
  observed: For any issues, email security@tensorwave.com for assistance within 4 business hours.
- source: https://security.tensorwave.com/
  kind: trust center updates feed
  http_status: 200
  fetched: '2026-08-02'
  observed: The Vulnerability Disclosure Policy is now available! May 7, 2026
negative_findings:
- path: https://tensorwave.com/.well-known/security.txt
  result: not published
  note: 'tensorwave.com answers HTTP 200 with the site''s SPA catch-all HTML for every unmatched
    path, including /.well-known/*. Body length matched the 404 baseline, so this is not a
    security.txt.'
- path: https://tensorwave.com/vulnerability-disclosure
  result: not published
  note: 'SPA catch-all 404 (10,633 bytes against a 10,623-byte baseline for a known-nonexistent
    path). An automated keyword probe scores this as a hit; it is not one. The real policy lives
    on the trust center.'
- path: https://docs.tensorwave.com/.well-known/security.txt
  result: '404'