Responsible Disclosure & Safe Harbor

Vulnerability Disclosure & Bug Bounty

We deeply value the whitehat security research community. If you discover a vulnerability in CodeXox systems, we offer safe harbor protection and competitive monetary bug bounties.

Safe Harbor Guaranteed

·Bounties up to \$10,000 USD·PSIRT Response < 12 Hours

Legal Safe Harbor Guarantee

If you conduct vulnerability research in good faith and adhere to these guidelines, CodeXox considers your research authorized under the Computer Fraud and Abuse Act (CFAA), the DMCA, and related anti-hacking statutes. We will not pursue legal action against researchers acting in accordance with this policy.

Bounty Reward Matrix

Severity Tier	CVSS Score	Bounty Payout	Example Impact
Critical	9.0 - 10.0	$2,500 – $10,000	Remote Code Execution (RCE), SQL injection, tenant data leakage, auth bypass.
High	7.0 - 8.9	$1,000 – $2,500	Server-Side Request Forgery (SSRF), privilege escalation, stored XSS.
Medium	4.0 - 6.9	$250 – $1,000	CSRF on sensitive mutations, subdomain takeover, sensitive token leaks.
Low	0.1 - 3.9	$100 – $250	Information disclosure, missing defensive security headers.

CodeXox PSIRT PGP Public Key

Encrypt sensitive Proof-of-Concept exploits before sending to security@codexox.com.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP v2.1.0
Comment: CodeXox Product Security Incident Response Team (PSIRT)

mQGNBGZ9k...
Key ID: 0x9B4E21C8
Fingerprint: 4E91 B21A 778F 390A C124  5B81 D209 E481 9B4E 21C8
Email: security@codexox.com
-----END PGP PUBLIC KEY BLOCK-----

Encrypted Vulnerability Submission

Directly notify our on-call security engineers. We will validate and assign a CVSS score within 12 hours.