Vanta trust portals use a JavaScript single-page application that doesn't expose direct PDF download links in the HTML. The PDF URL is only revealed through network traffic when the page loads.

I used Puppeteer to intercept network requests with content-type: application/pdf:

page.on('response', async response => {
  const contentType = response.headers()['content-type'] || '';
  if (contentType.includes('pdf')) {
    console.log('Found PDF:', response.url());
  }
});

When the page loads, it fetches the PDF for its viewer, revealing the actual URL with these parameters:

• rid - the document's internal ID
• r - the trust report slug (from the HTML's data-slugid attribute)
• view=true - returns the PDF content