Security Policy

SecurityXP is a cybersecurity news publication. We take reports about the security of our own site seriously and welcome good-faith research. This page is the authoritative disclosure policy referenced by our RFC 9116 security.txt.

Reporting a vulnerability

Email security@securityxp.com with the subject line “Vulnerability report”. Include:

• A description of the issue and its potential impact.
• Steps to reproduce, including URLs and any test accounts.
• Proof-of-concept code or screenshots, if available.
• Whether you intend to publish, and your preferred credit name.

Please do not open a public GitHub issue, post details on social media, or contact individual staff members. We do not currently operate a paid bug-bounty program.

Scope

In scope:

• securityxp.com and its subdomains.
• The static site application, its build configuration, and server configuration.
• Interactive tools hosted on this domain (CVSS scorer, password analyzer, ports reference, sandbox).

Out of scope:

• Third-party services we use, including Hostinger, Kit, Web3Forms, and Google Analytics. Report those to the provider directly.
• Social engineering, phishing, or physical attacks against staff.
• Denial-of-service, volumetric testing, or automated scanning that degrades the site.
• Spam, open-redirect chains, or clickjacking on pages with no sensitive actions.
• Missing security headers or cookie flags with no demonstrated impact.
• Outdated dependency versions with no reachable exploit path.

Safe harbor

We will not pursue legal action for research conducted in good faith under this policy. To qualify, you must:

• Test only against accounts and data you own or have explicit permission to use.
• Avoid accessing, modifying, or exfiltrating other people’s data.
• Stop immediately if you encounter sensitive data and report it without retaining copies.
• Give us a reasonable opportunity to fix the issue before public disclosure.

We aim to acknowledge reports within 3 business days, provide an initial assessment within 10 business days, and coordinate disclosure timing with you. Our default disclosure window is 90 days from acknowledgement, or sooner if a fix ships.

Acknowledgements

We are happy to credit researchers who report valid issues, unless you prefer to remain anonymous. Thank you for helping keep SecurityXP and its readers safe.