generated: '2026-09-04'
method: searched
source: https://www.workera.ai/legal/responsible-vulnerability-disclosure-program
program:
  name: Responsible Vulnerability Disclosure Program
  url: https://www.workera.ai/legal/responsible-vulnerability-disclosure-program
  url_status: 200
  contact: security@workera.ai
  bug_bounty: false
  bounty_note: >-
    Explicitly not a bug bounty. Workera does not guarantee payment for submitted vulnerabilities; any
    reward is at Workera's sole discretion based on severity, impact and novelty.
  safe_harbor: not_stated
  pgp_key: null
scope:
  included:
  - Workera services and associated domains, systems and APIs
  vulnerability_classes:
  - OWASP Top 10 (injection, cross-site scripting, authorization flaws)
  - privacy weaknesses
  - AI/LLM-specific risks including prompt injection
response_commitments:
  acknowledgement: within 1 week of receipt
  critical_remediation_target: within 10 business days of acknowledgement
  note: Workera states actual timelines may vary.
security_txt:
  served: false
  probed:
  - url: https://www.workera.ai/.well-known/security.txt
    status: 404
  - url: https://skills.workera.ai/.well-known/security.txt
    status: 404
  note: >-
    Workera publishes a disclosure policy page and a security@ contact but does NOT serve an RFC 9116
    /.well-known/security.txt on any host probed. Publishing one would make the same contact
    machine-discoverable.
evidence:
- url: https://www.workera.ai/legal/responsible-vulnerability-disclosure-program
  status: 200
- url: https://www.workera.ai/legal/security
  status: 200