Vulnerability Disclosure Policy

1. Scope

This policy covers Auxillo-operated website and product applications, APIs, accounts and the release/update paths of Aux Command and Aux Proton Drive Bridge. It does not authorise testing customer systems or third-party providers such as Stripe, Cloudflare, Hetzner or Proton.

2. Testing boundaries

• Use accounts and data you control. Do not access, alter or delete another person’s data.
• Use the minimum demonstration necessary; stop and report if unrelated personal data becomes visible.
• Do not perform denial-of-service, social engineering, physical attacks, destructive exploitation or testing that degrades service.
• Ask for written agreement before automated vulnerability scanning or any activity outside these boundaries.

3. Reporting

Email [email protected] with the affected URL or component, reproduction steps, impact and a minimal proof of concept. Redact secrets and personal data. If sensitive evidence needs a protected transfer, contact us first to agree the method.

We aim to acknowledge a report within three business days and provide an initial assessment within ten business days. Remediation timing depends on severity and complexity. We will keep you informed and can credit you with your permission.

4. Coordinated disclosure

Please allow a reasonable opportunity to investigate and fix the issue before publishing exploit details. We request a coordinated disclosure period of up to 90 days, with earlier disclosure or an extension discussed in light of risk and progress. Do not publish other people’s data or working credentials.

5. Good-faith research

We will not pursue legal action against good-faith research that follows this policy and stays within assets and authority we control. This undertaking cannot bind third parties, law enforcement or a court, and does not authorise harm or access beyond the stated scope. If you are unsure whether an activity is covered, ask [email protected] before proceeding.