Hey Product Hunt 👋 I'm Casey — I founded Bugcrowd and run disclose.io. A problem I've hit a thousand times: you find a vulnerability in something — a domain, an npm package, some random IP, a mobile app — and then you hit the real wall: who do I even tell? Finding the right security contact often takes longer than finding the bug, and that friction is why so many vulns never get reported. Lookup fixes that. Paste any asset and it chains a dozen strategies — security.txt, the disclose.io directory, WHOIS/RDAP, DNS, bug bounty platforms, package registries, GitHub SECURITY.md — to tell you who owns it and the right way to report. 16 input types, confidence-ranked, with the source for every answer. Free, open-source, with an API and an MCP server. Would love your feedback — especially cases where it should find a contact and doesn't. That's the data that makes it better. 🙏

Lookup by disclose.io

Find who owns any internet asset and who to report bugs to

Find who owns any internet asset and who to report bugs to