The Atlantic Responsible Disclosure Policy changes — first seen 2026-08-21 (NOTED)

What changed, in plain language

Nothing changed in the substance of The Atlantic's Responsible Disclosure Policy. The only difference is the scrambled code in the link behind the contact email address, which Cloudflare rotates automatically to hide the address from spam bots. The policy text, rules, and exclusions are identical.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDEmail protection link code changed
The website uses a Cloudflare tool that scrambles email addresses so spam bots can't read them. That scrambled code was regenerated, so the link looks different. The email address it points to and everything else on the page are unchanged.
https://www.theatlantic.com/cdn-cgi/l/email-protection#780b1d1b0d0a110c01380c101d190c1419160c111b561b1715
https://www.theatlantic.com/cdn-cgi/l/email-protection#90e3f5f3e5e2f9e4e9d0e4f8f5f1e4fcf1fee4f9f3bef3fffd

Full text changes — 20260820_rev01 to 20260821_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 · Spamming
 · Social engineering (including phishing) of Atlantic Media staff or contractors
 · Any physical attempts against Atlantic Media property or data centers
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#780b1d1b0d0a110c01380c101d190c1419160c111b561b1715) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#90e3f5f3e5e2f9e4e9d0e4f8f5f1e4fcf1fee4f9f3bef3fffd) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!