The Atlantic Responsible Disclosure Policy changes — first seen 2026-08-14 (NOTED)

What changed, in plain language

Nothing about the policy changed. The only difference is the scrambled code in the link to The Atlantic's security contact email, which the site regenerates automatically to hide the address from spam bots. The email address itself, the rules for researchers, and the list of off-limits activities are all the same.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDContact email link code refreshed
The Atlantic hides its security contact email behind a scrambled code so spam bots can't read it. That code was regenerated, so the link text changed. The actual email address and everything else in the policy stayed the same.
https://www.theatlantic.com/cdn-cgi/l/email-protection#deadbbbdabacb7aaa79eaab6bbbfaab2bfb0aab7bdf0bdb1b3
https://www.theatlantic.com/cdn-cgi/l/email-protection#6516000610170c111c25110d00041109040b110c064b060a08

Full text changes — 20260813_rev01 to 20260814_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 · Spamming
 · Social engineering (including phishing) of Atlantic Media staff or contractors
 · Any physical attempts against Atlantic Media property or data centers
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#deadbbbdabacb7aaa79eaab6bbbfaab2bfb0aab7bdf0bdb1b3) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#6516000610170c111c25110d00041109040b110c064b060a08) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!