Security and Responsible Disclosure

If you believe you have found a vulnerability in our website, email [email protected] with the subject “Security report — Dax Vector”.

Include the affected page or endpoint, a description of the issue, minimal steps to reproduce it and the potential impact. Remove credentials, personal information and other secrets from screenshots or evidence. Please report privately before sharing sensitive details publicly.

This reporting policy covers the public Dax Vector website and its own application endpoints. It does not authorize testing Cloudflare infrastructure, GitHub, email providers, client systems or other third-party services. Separate authorization is required for any client environment.

Do not access other people’s records, exfiltrate data, alter or delete content, upload harmful material, attempt social engineering, run denial-of-service tests or disrupt availability. Stop if unexpected access exposes personal or confidential information and report the minimum details needed to explain the issue.

This page is a reporting channel, not authorization for intrusive testing or a promise of legal safe harbor. We do not operate a public paid bug-bounty program or promise compensation. Obtain written permission before testing beyond ordinary authorized use.

We assess reports and may contact you for clarification. The investigation and response depend on the severity, reproducibility and systems affected. We do not promise a fixed response or resolution time.

If you suspect your administrator account has been compromised, contact us through the same email address. Never include your password in a report.

Security researchers can also find our reporting address in security.txt. For the reporting scope and boundaries, please use this policy.