Check if they have a security.txt file at the root of their website. They may not offer a bounty program, but if they do, you can be pretty sure that they have

Check if they have a security.txt file at the root of their website. They may not offer a bounty program, but if they do, you can be pretty sure that they have some sort of public statement about it and how to contact them. https://securitytxt.org/ https://securitytxt.org/ https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure