Vulnerability Disclosure

How to report a security vulnerability in a Foxx Cyber product, and what to expect from us.

If you believe you've found a security vulnerability in a Foxx Cyber product or web property, we want to hear about it. We treat good-faith security research as a favor, not a threat.

How to report

Email support@foxxcyber.com with:

• What you found and where (product, URL, or component)
• Steps to reproduce, or a proof of concept
• The potential impact as you understand it
• How you'd like to be credited, if the report leads to a fix

A machine-readable version of this policy is published at /.well-known/security.txt per RFC 9116.

What to expect from us

1. Acknowledgment — we confirm receipt of your report promptly.
2. Assessment — we validate the finding and keep you informed of the outcome.
3. Remediation — confirmed vulnerabilities are fixed with priority matched to severity; security patches ship in the normal release pipeline and appear in the changelog when they affect the shipped product.
4. Credit — with your permission, we credit reporters for confirmed findings. We do not currently run a paid bug bounty program.

Ground rules (safe harbor)

We will not pursue or support legal action against researchers who:

• Act in good faith and report promptly, giving us a reasonable window to fix the issue before public disclosure (we ask for 90 days, and we'll communicate if we need to coordinate on timing)
• Access only the minimum data necessary to demonstrate the issue — don't view, alter, exfiltrate, or retain data belonging to others
• Don't degrade service for others (no denial-of-service, spam, or resource-exhaustion testing)
• Don't use social engineering, phishing, or physical attacks against Foxx Cyber personnel, customers, or infrastructure

Testing against your own account and data on the platform is in scope. If you accidentally access something you shouldn't, stop, don't save it, and tell us in your report.