Responsible Disclosure

Send security reports to info@asyrx.com with the subject line “Security Vulnerability Report.” Asyrx does not operate a paid bug-bounty program. If Asyrx publishes a PGP key or dedicated reporting portal in the future, that information will be added here.

Please include, where available:

• Affected domain, endpoint, API route, feature, or component.
• A clear description of the issue and expected security impact.
• Steps to reproduce using the minimum access necessary.
• Proof-of-concept requests, screenshots, logs, or code that do not expose unrelated customer data.
• Any conditions required for exploitation.
• Your contact information if you want a response or recognition.

Good-faith research should be limited to the Asyrx-owned systems listed below.

• https://www.asyrx.com and its public web pages
• The Asyrx web application and authenticated control plane hosted on asyrx.com
• The Asyrx public API endpoints served under https://asyrx.com/api
• Asyrx Enterprise Sandbox environments that have been provisioned to you in writing

• Customer-owned Salesforce, Shopify, GitHub, cloud, database, SaaS, or other third-party environments.
• Third-party infrastructure providers except to the extent an issue is directly caused by Asyrx configuration and can be demonstrated without testing the provider itself.
• Employee personal accounts, personal devices, or home networks.
• Systems not owned or controlled by Asyrx.

• Denial-of-service, distributed denial-of-service, stress testing, or activity likely to degrade service availability.
• Social engineering, phishing, vishing, smishing, physical intrusion, or targeting employees, customers, or vendors.
• Destructive testing, deletion or alteration of production data, ransomware, persistence, or malware deployment.
• Accessing, downloading, modifying, or retaining more customer or personal data than strictly necessary to demonstrate the issue.
• Testing third-party customer systems or attempting to cause a real customer agent to execute a high-impact action.
• Automated scanning at a volume that materially affects service or violates published rate limits.
• Public disclosure before Asyrx has had a reasonable opportunity to investigate and remediate a validated issue.

If you encounter personal information, Customer Data, credentials, secrets, or other non-public information, stop accessing it as soon as you have enough information to demonstrate the issue. Do not retain, redistribute, or use the information for any other purpose. Include only the minimum necessary evidence in your report.

Asyrx considers research to be in good faith when it is conducted to identify and report a security issue, follows this policy, avoids harm, respects privacy, and does not seek to extort, threaten, or misuse access. For good-faith research that complies with this policy, Asyrx does not intend to initiate legal action solely because you tested an in-scope Asyrx system. This statement does not authorize violations of law, third-party rights, or contracts that Asyrx cannot waive.

• We generally aim to acknowledge a credible report within five business days, but response times are not guaranteed.
• We will investigate validated issues based on severity, exploitability, and customer impact.
• We may ask for additional information or coordinate testing of a proposed fix.
• We will try to keep reporters reasonably informed about remediation progress when practical.
• We may recognize researchers publicly with permission, but Asyrx does not operate a cash bug-bounty program unless expressly announced in writing.

Please give Asyrx a reasonable opportunity to investigate and remediate a validated vulnerability before public disclosure. If you believe immediate public disclosure is necessary because of active exploitation or exceptional public-interest concerns, tell us so we can coordinate an appropriate response.

We prioritize issues based on practical impact. Examples of potentially high-severity issues include cross-tenant access, authentication bypass, exposure of API secrets, remote code execution, unauthorized access to Customer Data, or vulnerabilities that could materially compromise Action Assessment integrity.

• Missing features or product suggestions.
• A risk score or recommendation you disagree with absent a security flaw.
• Rate-limit differences that do not create a security impact.
• Clickjacking or security-header observations without a meaningful exploit path, depending on context.
• Reports produced solely by automated scanners without validation or reproduction.
• Known third-party vulnerabilities that do not affect the Asyrx deployment.

Questions about whether planned research is in scope may be sent to info@asyrx.com before testing. Do not send sensitive customer data through ordinary email unless necessary; request a secure transfer method if the report requires sensitive evidence.