Responsible Disclosure
How to report a security vulnerability in this website, and what we ask of you when you do.
Contents
Summary
If you have found a weakness in this website, write to our security address with enough detail for us to reproduce it. Please do not access other people's data, disrupt the site or tell others before we have had a chance to fix it.
What this covers
This page applies to security vulnerabilities in the XONIK website and the systems that serve it. It does not cover our clients' systems, or other companies' services that the site links to; report those to their owners. If you are not sure whether something is in scope, send the report anyway and say what you were looking at, and we will tell you where it belongs.
How to report
Write to the security address below. The same contact is published in the site's security.txt file, in the standard location, so that automated tools and researchers can find it. Please tell us what you found, the address or page where it occurs, the steps to reproduce it, and what you think its effect could be. Screenshots or a short proof help. If you want a reply, include a way to reach you.
What we ask of you
Test only against this website, and stop as soon as you have shown the problem. Do not read, change or keep data that belongs to other people. Do not overload the site, use social engineering against our staff or others, or test physical security. Do not tell anyone else about the problem until we have had reasonable time to fix it.
What we will do
We will read every report, and we will fix what we can confirm. We will tell you that we received it, ask for more detail if we need it, and tell you when it is fixed. We treat a report made in good faith under this page as help and not as an attack.
Report a vulnerability
Send your report to hello@xonik.com
Questions about this policy?
Write to us and a person replies. For a security issue, use the responsible disclosure page.