Responsible disclosure
If you find a security issue in Currixa, tell us first. We take every report seriously and work with you to fix it.
How to report
Write to this address, with “security” in the subject:
- What you found and where: the address, the request, or the screen.
- Steps to reproduce it, and what an attacker could gain.
- The time you tested, and the account or key you used, if any.
- How to reach you. You may stay anonymous.
In scope
- currixa.net and its pages.
- The API at api.currixa.net.
- The workspace and the admin panel after sign-in.
Out of scope
- Denial of service, or load and stress tests.
- Social engineering, or attacks on our staff or users.
- Physical access, or our providers' own systems (Auth0, Cloudflare, our email providers, Better Stack).
- Reports from automated scanners without proof of impact.
- Missing best-practice headers with no exploitable effect.
- Another organisation's data: stop as soon as you see it, and tell us.
While you test
- Use your own accounts and test keys only.
- Do not read, change or delete data that is not yours.
- Do not degrade the service for others.
- Give us reasonable time to fix the issue before you publish anything.
Our response times
- We acknowledge your report within three business days.
- We send our first assessment within ten business days.
- We fix critical issues as fast as we can, and tell you when the fix is live.
Our commitment to you
If you act in good faith and follow this policy, we will not pursue legal action against you, and we will not ask anyone else to. We will treat your research as authorised, work with you to understand and fix the issue, and credit you if you wish.
We do not run a paid bug bounty yet.
/.well-known/security.txt