Skip to main content

Vulnerability Disclosure Policy (VDP)

v2.0, 09 Oct 2026

Purpose​

Security is a core value at Axinom. The purpose of this Vulnerability Disclosure Policy (VDP) is to provide a clear, secure, and responsible mechanism for external parties to report potential security vulnerabilities found in Axinom products or services, without disclosing them publicly before they are fixed.

Who Can Report​

We welcome reports from security researchers, customers, partners, and anyone else who acts in good faith and follows this policy. Customers may also use their contractual support channels.

We may decline reports that are not specific to Axinom, that are made conditional on a payment or other reward, or that are accompanied by threats or demands.

Scope​

This policy applies to publicly accessible and officially released Axinom products and services, including their software, SaaS offerings, APIs, mobile applications, and the cloud infrastructure that Axinom operates to run them.

Reports about other Axinom websites and supporting services are also welcome; we handle them at our discretion.

The following are out of scope:

  • Third‑party services, platforms, or libraries not under Axinom's control. Please report such issues to the respective vendor.
  • Systems operated by customers, including on‑premises installations of Axinom software.
  • Social‑engineering or physical attacks against Axinom staff, customers, or offices.
  • Testing that degrades or disrupts our services.

If you are unsure whether an asset is in scope, please email us before testing.

What Qualifies as a Vulnerability​

We are interested in vulnerabilities that can realistically be exploited to affect the confidentiality, integrity, or availability of Axinom systems or data. A report should therefore show a concrete attack scenario and its impact.

Reports that describe only deviations from best practices, general configuration observations, theoretical issues, or unverified results of automated tools, without a demonstrated exploit path, are usually treated as informational and may be declined.

Examples (non‑exhaustive):

  • SPF, DKIM, or DMARC misconfigurations without a viable spoofing or phishing scenario.
  • Missing or weak security headers (e.g., HSTS, CSP) that do not lead to an exploit path.
  • Clickjacking on pages with no sensitive actions.
  • Use of outdated browser versions where no Axinom mitigation is bypassed.
  • Denial‑of‑Service via excessive automated requests (unless the technique is novel or results in persistent service impact).

No Bounties​

Axinom operates a non‑monetary program and does not pay bounties, rewards, or fees for reports. Submitting a report does not create any obligation for Axinom.

Reporting a Vulnerability​

What to Include​

To help us assess your report, please include:

  • The affected asset (e.g., URL, product name and version, environment).
  • Step‑by‑step reproduction instructions.
  • A proof of concept (e.g., code or screenshots).
  • The impact and a realistic attack scenario.
  • Your preferred contact information and public PGP key (optional).

Reports without sufficient information to reproduce the issue may be closed.

How to Submit​

Please submit one report per vulnerability. All submissions will be handled under strict confidentiality.

Researcher Guidelines​

To help us triage and fix issues quickly while ensuring legality and safety, please:

  • Test only against assets you know are in scope.
  • Avoid actions that could harm data or disrupt services for other users.
  • Do not access, modify, or destroy data that does not belong to you. If you encounter such data, stop and report it.
  • Do not publicly disclose the vulnerability or any data obtained until we have resolved the issue and mutually agreed on disclosure timing.
  • Comply with all applicable laws.

Safe Harbor Statement​

If you comply in good faith with this policy, Axinom will not pursue legal action or refer the matter to law enforcement, and any DMCA or similar restrictions are waived. If legal action is initiated by a third party against you for lawful research under this policy, Axinom will take steps to make it known that your actions were conducted in compliance with this VDP.

Safe harbor does not apply to activities outside this policy.

How We Communicate​

  1. Acknowledgment. We aim to confirm receipt of your report within 2 business days. This confirmation may be automated.
  2. Assessment. We aim to inform you within 5 business days whether we accept your report and, if so, of our initial severity rating (CVSS), based on our own assessment.
  3. Declined reports. If a report does not meet this policy, we inform you briefly and close it.
  4. Progress updates. For accepted reports, we aim to keep you informed of remediation progress at least every 15 days until resolution.

Our Vulnerability Handling Process​

  1. Triage & Severity Rating. Axinom's Security Team validates the report and assigns a CVSS score and risk category.
  2. Fix Planning. Engineering teams develop remediation steps. For accepted reports, our target timelines, counted from acceptance, are:
    • Critical: fix deployed within 14 days.
    • High: within 30 days.
    • Medium/Low: within 90 days.
  3. Validation. We may ask you to confirm the fix where practical.
  4. Disclosure Coordination. We agree with you on the timing of any public disclosure, usually once a fix or mitigation is available.

Public Disclosure​

We aim for coordinated disclosure. Axinom will notify the reporter when the issue is resolved so they may disclose responsibly. If no response is received from the reporter within 15 days of our fix notice, Axinom may proceed with public disclosure.

Privacy and Data Protection​

All vulnerability information is processed under Axinom's Privacy Policy and retained only as long as necessary for remediation and compliance.

Contact Information​

This policy does not grant permission to perform security testing beyond the scope described. Axinom decides at its own discretion whether a report is accepted. Axinom reserves the right to update or withdraw this policy at any time. Nothing in this document constitutes a waiver of Axinom's rights under applicable law.

Review & Updates​

This VDP is reviewed annually and following significant product or regulatory changes.

Thank you for helping us keep Axinom and our customers safe.

Was this page helpful?