The Atlantic Responsible Disclosure Policy changes — first seen 2026-09-03 (NOTED)

What changed, in plain language

The only change is to an obfuscated contact email link — the scrambled code in the URL was updated. No policy terms changed.

This change appears to be cosmetic (formatting, typos, or contact details).

± CHANGEDContact email link code updated
The security contact email is hidden behind a scrambling system to block spam bots. The scrambled code in that link was refreshed. The email address it points to and everything else in the policy stay the same.
https://www.theatlantic.com/cdn-cgi/l/email-protection#c9baacaabcbba0bdb089bda1aca8bda5a8a7bda0aae7aaa6a4
https://www.theatlantic.com/cdn-cgi/l/email-protection#f380969086819a878ab3879b9692879f929d879a90dd909c9e

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 · Spamming
 · Social engineering (including phishing) of Atlantic Media staff or contractors
 · Any physical attempts against Atlantic Media property or data centers
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#c9baacaabcbba0bdb089bda1aca8bda5a8a7bda0aae7aaa6a4) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!
+While we currently do not have a formal vulnerability reporting system in place at this time, please reach out to [\[email protected\]](https://www.theatlantic.com/cdn-cgi/l/email-protection#f380969086819a878ab3879b9692879f929d879a90dd909c9e) to report any critical issues you may discover. Thank you for helping keep The Atlantic and our users safe!