xalgorixvulnerability disclosure program
Found a bug?
Tell us the safe way.
We build offensive security tooling, so we hold our own platform to the same bar. If you've found a vulnerability in Xalgorix, this program is how to report it — with a clear scope, rules of engagement, and safe harbor for good-faith research.
In scope
Only the individual targets listed below are in scope. We keep the list explicit and grow it over time — there is intentionally no *.xalgorix.com wildcard.
Marketing site and the Xalgorix SaaS dashboard (auth, billing/credits, scan orchestration, referrals).
Canonical host for the same application as xalgorix.com.
Public API surface, where exposed. Report against documented endpoints only.
The application logic served from the hosts above: authentication and sessions, billing and the credit ledger, the referral system, scan creation/orchestration, and report/finding access controls.
Code-level vulnerabilities in the official Xalgorix engine and supporting repositories — e.g. auth/authorization flaws, injection, SSRF, or insecure defaults in the shipped code.
Examples of qualifying issues
- Authentication or session flaws (auth bypass, fixation, privilege escalation).
- Broken access control / IDOR — reaching another workspace's scans, findings, reports, or billing data.
- Injection (SQL, command, template), SSRF, or deserialization with real impact.
- Stored or reflected XSS that runs in another user's authenticated context.
- Billing / credit-ledger integrity issues — obtaining credits without a corresponding paid transaction, or bypassing the referral qualifying-purchase rules.
- Leakage of secrets, API keys, PII, or scan evidence across tenant boundaries.
Out of scope
Reports on the following are not eligible and, in some cases, are actively prohibited (see the rules of engagement).
- *.xalgorix.com as a wildcard, and any host not explicitly listed in scope above (this includes customer scanner instances, staging/preview hosts, and vendor-hosted subdomains).
- Self-hosted or customer-operated Xalgorix deployments. Code issues belong in the open-source repository; a specific operator's server does not.
- Third-party services and sub-processors and their infrastructure (e.g. Supabase, Cloudflare, the payment provider, email delivery). Report those to the respective vendor.
- Denial of service (DoS/DDoS), volumetric or stress testing, and resource-exhaustion attacks.
- Social engineering or phishing of Xalgorix staff, users, or contractors; and any physical attack.
- Automated scanner output with no demonstrated, reproducible security impact.
- Best-practice / informational findings without impact: missing security headers, SPF/DKIM/DMARC, cookie flags, TLS configuration, version or banner disclosure, clickjacking on pages with no sensitive action, self-XSS, tabnabbing, or absence of rate limiting.
- Issues requiring a rooted/jailbroken device, an outdated or end-of-life browser, or a man-in-the-middle position.
- Theoretical vulnerabilities or CVSS scores without a working proof of concept.
Rules of engagement
Test like the systems belong to someone else — because they do.
How disclosure works
Email security@xalgorix.com with the affected host/endpoint, vulnerability class, step-by-step reproduction, a proof of concept, and the impact. Encrypt sensitive details with our PGP key from /.well-known/security.txt.
We confirm receipt within 2 business days and assign a point of contact.
Within 5 business days we validate, assign a severity, and share next steps and an expected remediation window.
We remediate and coordinate disclosure with you — up to 90 days — keeping you updated throughout. With your consent we credit you publicly.
Safe harbor
Good-faith research that follows this policy is authorized. We will not pursue or support legal action against you, and we'll work with you if a third party does. If you're unsure whether something is allowed, ask us first at security@xalgorix.com.
Report a vulnerability
Send your proof of concept to security@xalgorix.com. We respond within two business days and credit you for confirmed, in-scope findings.