The Atlantic Responsible Disclosure Policy changes — first seen 2026-08-22 (NOTED)

What changed, in plain language

The only change is the scrambled code in the email-protection link for the security contact address. The policy text itself is identical, so nothing about your rights or the reporting process changed.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDContact email link code refreshed
The obfuscated email link used to hide the security contact address from spam bots was re-encoded. The visible instructions and the policy wording did not change.
please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#90e3f5f3e5e2f9e4e9d0e4f8f5f1e4fcf1fee4f9f3bef3fffd) to report any critical issues you may discover.
please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#186b7d7b6d6a716c61586c707d796c7479766c717b367b7775) to report any critical issues you may discover.

Full text changes — 20260821_rev01 to 20260822_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 · Spamming
 · Social engineering (including phishing) of Atlantic Media staff or contractors
 · Any physical attempts against Atlantic Media property or data centers
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#90e3f5f3e5e2f9e4e9d0e4f8f5f1e4fcf1fee4f9f3bef3fffd) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#186b7d7b6d6a716c61586c707d796c7479766c717b367b7775) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!