The Atlantic Responsible Disclosure Policy changes — first seen 2026-08-24 (NOTED)

What changed, in plain language

The only change is a rotated Cloudflare email-protection code in the contact link. The obfuscated string that hides the security contact's email address was regenerated, which happens automatically on many pages. No policy wording, rules, or user rights changed.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDContact link's scrambled email code was regenerated
The email address for reporting security issues is hidden behind a Cloudflare scrambling code. That code was swapped for a new one, which is a routine automatic change. The policy text around it is identical, and the address it points to still works the same way.
https://www.theatlantic.com/cdn-cgi/l/email-protection#e09385839592899499a094888581948c818e948983ce838f8d
https://www.theatlantic.com/cdn-cgi/l/email-protection#ee9d8b8d9b9c879a97ae9a868b8f9a828f809a878dc08d8183

Full text changes — 20260823_rev01 to 20260824_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 · Spamming
 · Social engineering (including phishing) of Atlantic Media staff or contractors
 · Any physical attempts against Atlantic Media property or data centers
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#e09385839592899499a094888581948c818e948983ce838f8d) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#ee9d8b8d9b9c879a97ae9a868b8f9a828f809a878dc08d8183) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!