Authorization comes first
This policy does not grant permission to test any system. Obtain explicit authorization from the system owner and stay within its scope. Avoid service disruption and access to data that is not your own.
What to include
Identify the affected product or organization, describe the technical issue and its potential impact, and provide minimal, non-destructive reproduction steps. Include contact information for coordination. Redact secrets and personal information.
Protect sensitive findings
Use the reporting form only when the channel is shown as available. Do not send malicious files or unrelated material. File uploads are not supported. A secure evidence-transfer method can be agreed during coordination.
Review and coordination
Submissions are reviewed and may be coordinated with affected organizations. Do not publicly disclose unresolved vulnerabilities without appropriate coordination. Acknowledgment, remediation timing, attribution, and publication are determined case by case; no response deadline or bounty is promised.
Report a vulnerability · Contact Exploitex · Infrastructure acceptable use