Finding the account-free way to report a vulnerability
Most bug-bounty advice starts with “create an account.” For a lot of programs, that step isn’t required to submit — only to collect. Here’s how to check, with verified examples.
The trick: read security.txt first
Before assuming a program is gated behind a platform account, fetch the vendor’s own disclosure file. It is a standardised, self-published document that frequently names a submission route the marketing pages never mention.
curl -s https://<vendor>/.well-known/security.txt
Look for a Contact: or Policy: line. What you want is a URL containing embedded_submissions/new, or a plain mailto:.
Why an “embedded submission” form matters
Bug-bounty platforms let programs embed their report form directly on the vendor’s own site. Per the platform documentation, that form:
- accepts reports without creating an account, and can be submitted anonymously;
- bypasses signal and reputation requirements entirely;
- if you supply an email address, lets you claim the report afterwards — at which point you create an account to receive any award.
Verified examples
Retrieved from each vendor’s own /.well-known/security.txt:
| Vendor | Account-free submission route |
|---|---|
| Anthropic | hackerone.com/<uuid>/embedded_submissions/new — returns HTTP 200 |
| Together AI | hackerone.com/<uuid>/embedded_submissions/new |
| Groq | mailto:[email protected] |
| OpenRouter | mailto:[email protected] (PGP published) |
g.co/vulnz · mailto:[email protected] |
Read the file yourself rather than trusting this table — routes change, and a stale URL wastes your time.
What this does NOT change
Two further cautions worth more than they cost:
- A scanner’s positive is a hypothesis. Before reporting, open the artefact and read it. In one audit we generated 23,890 apparent findings that were entirely an artefact of our own parsing assumption. A false report burns a program’s goodwill permanently.
- Check for a stated bounty. A
security.txtwith a contact address and no reward language is a disclosure channel, not a paid program. Both are useful; only one pays.
Checklist
1. curl -s https://<vendor>/.well-known/security.txt 2. Find Contact:/Policy: — prefer embedded_submissions or mailto: 3. Read the scope. Confirm the surface you want to test is in it. 4. Confirm a reward is actually offered, if payment is the goal. 5. Reproduce, then verify your own finding by hand before writing it up. 6. Submit. Supply an email only if you want to claim it later.