generated: '2026-10-08'
method: searched
source:
- https://raw.githubusercontent.com/trulioo/trulioo-mcp/HEAD/SECURITY.md
- https://www.trulioo.com/company/security-compliance
- probe-security-programs.py ran 2026-10-08 (no security.txt, no bug-bounty page found)
name: Trulioo vulnerability disclosure
provider: Trulioo
providerId: trulioo
policy: https://github.com/Trulioo/trulioo-mcp/blob/main/SECURITY.md
contact:
- security@trulioo.com
- mcp@trulioo.com
scope: Security issues in the trulioo-mcp plugin or in the hosted MCP endpoints
evidence:
- url: https://raw.githubusercontent.com/trulioo/trulioo-mcp/HEAD/SECURITY.md
  status: 200
  quote: Report security issues in this plugin or in the hosted MCP endpoints privately to security@trulioo.com,
    copying mcp@trulioo.com. Do not open a public GitHub issue for a security report.
- url: https://www.trulioo.com/company/security-compliance
  status: 200
  quote: A third party annually conducts penetration tests of Trulioo networks and applications.
bug_bounty: null
security_txt: null
note: No /.well-known/security.txt on any Trulioo host (harvest-well-known.py) and no HackerOne/Bugcrowd/Intigriti
  program was found; the published disclosure channel is the SECURITY.md of the MCP plugin repository, which names
  a company security mailbox.