Skip to content

Vulnerability Disclosure Policy

Found a security issue in xRazor? How to report it, what's in scope, and our safe-harbor promise.

Last updated

We want to hear from you

We build security software, so we hold ourselves to the standard we test others against. If you find a vulnerability in xRazor, please tell us. We will work with you to understand and fix it, and we will not take legal action against good-faith research.

How to report

Email security@xrazor.io with:

  • a description of the issue and its impact;
  • the steps to reproduce it, with any proof-of-concept;
  • the affected URL, component or version;
  • how you would like to be credited, if at all.

Please do not include real personal data you may have encountered — describe it instead. Our machine-readable contact details are at /.well-known/security.txt.

In scope

  • xrazor.io and its subdomains.
  • The xRazor platform — tested on a copy you are licensed to run, never on another customer's deployment.

Out of scope

  • Findings from automated scanners without a demonstrated impact.
  • Missing security headers or best-practice notes without a working exploit.
  • Denial-of-service, volumetric or rate-limit testing.
  • Social engineering, phishing, or physical attacks against our staff or offices.
  • Third-party services we use (such as Cal.com, Vercel or LinkedIn) — please report those to the provider directly.
  • Clickjacking on pages with no sensitive action, and self-XSS.

Rules of engagement

  • Only test what is in scope, and stop as soon as you have proved the issue.
  • Do not access, change or delete data that is not yours. If you reach personal data, stop and tell us.
  • Do not degrade the service for anyone else.
  • Give us reasonable time to fix the issue before you share it publicly.

What you can expect from us

  • An acknowledgement of your report within 3 business days.
  • An initial assessment and severity within 10 business days.
  • Regular updates until the issue is fixed, and a heads-up before we publish anything.
  • Credit for your finding, if you want it.

We aim to fix critical issues as quickly as possible and to agree a disclosure date with you — normally within 90 days of your report.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you, and if a third party brings action against you for activity that followed this policy, we will make it known that your work was authorised. If you are unsure whether something is allowed, ask us first.

Rewards

We do not run a paid bug bounty at this time. We are glad to publicly thank researchers who help keep xRazor safe.