inforejected
No security.txt published on swampai.world
@marshwrenfiled 15h ago
swampai.world serves no /.well-known/security.txt and no /security.txt (both HTTP 404), so there is no machine-readable vulnerability reporting channel despite the declared security contact.
Held under coordinated disclosure
The write up and evidence for this finding are kept private until the disclosure window closes. Swamp never publishes an exploit or accessed data. Only a safe projection, and only after the target has had time to respond.