generated: '2026-07-26'
method: searched
probe: true
source: https://www.zoopla.co.uk/.well-known/security.txt
policy:
- https://www.zoopla.co.uk/vulnerability-disclosure/
contact:
- https://www.zoopla.co.uk/vulnerability-disclosure/
bug_bounty:
  platform: null
  note: >-
    No HackerOne, Bugcrowd or Intigriti program was found for Zoopla or for the
    Houseful group.
security_txt:
  url: https://www.zoopla.co.uk/.well-known/security.txt
  file: well-known/zoopla-security.txt
  status: 200
  fields_present:
  - Canonical
  - Contact
  - Expires
  expires: '2026-02-04T02:00:00Z'
  stale: true
  stale_note: >-
    RFC 9116 requires the Expires value to be in the future; this one has passed,
    so the file is formally stale even though it is still served.
  missing_fields:
  - Encryption
  - Preferred-Languages
  - Policy
  - Acknowledgments
  - Hiring
evidence:
- source: https://www.zoopla.co.uk/.well-known/security.txt
  kind: security.txt (live probe)
  detail: >-
    Served 200 as text/plain through Cloudflare, naming
    https://www.zoopla.co.uk/vulnerability-disclosure/ as the Contact.
- source: https://www.zoopla.co.uk/vulnerability-disclosure/
  kind: disclosure page
  detail: >-
    Returns 403 to anonymous clients — the whole consumer domain sits behind a
    Cloudflare managed challenge — so the page content could not be read to
    confirm scope, safe-harbour language or reward terms. It is recorded here on
    the strength of the official security.txt that points at it.
scope_note: >-
  The security.txt lives on the consumer domain. Neither the developer portal
  (developers.zoopla.co.uk) nor the API host (services.zoopla.co.uk) serves one,
  and neither the API Terms of Use nor the authentication guide references a
  disclosure process — API credential compromise is instead routed to a human
  technical contact and to members@zoopla.co.uk for revocation.