Responsible Disclosure

Found a vulnerability in HackEx?

Tell us before anyone else. Email [email protected] with a description, reproduction steps and impact. Screenshots or a proof-of-concept help us triage faster.

Our commitments

• Acknowledgement within 72 hours
• A triage assessment within 7 days
• No legal action against researchers who act in good faith, stay in scope and protect user data
• Credit where you want it, or anonymity where you don't

Scope

In scope: the HackEx platform, dashboard, APIs, agent installer and agent protocol. Out of scope: customer infrastructure connected to HackEx (that's their property, not ours; test only what you own), social engineering of our staff, and denial-of-service testing that degrades service for others.

Good-faith rules

Don't access, alter or exfiltrate data that isn't yours. Don't pivot past the proof you need. Stop testing and report the moment you hit something sensitive. Give us reasonable time to fix before going public.