Responsible Disclosure Policy

Security researchers help keep systems safe. This policy explains how to report a vulnerability in systems operated by Quantix, how reports are coordinated, and what Quantix commits to in return. It also describes how Quantix itself discloses vulnerabilities it finds in other people’s code.

In scope.

• This website, on the domain it is served from, including its pages, generated documents and downloads.
• The website’s server code: the form endpoint, PDF generation and the token scanner’s server-side requests.
• Any other system or published code that Quantix operates or maintains.

Handled separately. Findings against the protocols in Quantix research programmes are submitted through the researcher portal under each programme’s rules.

Out of scope.

• Systems of the website’s service providers (hosting, email delivery, storage, RPC providers). Report those to the provider.
• Denial-of-service or load testing, and any test that degrades the website for others.
• Social engineering, phishing or physical attempts against people or premises.
• Automated scanner output without a demonstrated, exploitable impact.
• Reports that depend on a compromised device, browser or extension of the victim.

• Test only against your own accounts and data, and access no more information than you need to show the issue.
• If you encounter personal data, credentials or someone else’s submission, stop, do not keep a copy, and report it.
• Keep request rates low. The form endpoint is rate-limited; do not try to bypass the limit at volume.
• Do not make persistent changes, plant files, or leave test content that others could see.
• Do not use a vulnerability beyond the minimum needed to confirm it, and never to move or lock digital assets.
• Keep the details confidential until disclosure has been coordinated with Quantix.

Choose the route that matches what you found. The vulnerability reporting guide explains what to include, step by step, with severity guidance.

Reports are received through the contact form with the topic “Responsible disclosure”, which routes them to the people who handle security reports.

Do not include working exploits for live systems or any secret material in a first message; share them once a secure channel is agreed.

Every report moves through the same stages, and you are kept informed at each one.

1. 01

   Acknowledge

   The report is logged under a reference number and a named coordinator confirms receipt.

2. 02

   Triage and validate

   A reviewer reproduces the issue, rates it on the Quantix severity rubric and shares the rating and reasoning with you.

3. 03

   Remediate

   The owner of the affected system develops a fix or mitigation. Timelines are set by severity and complexity and agreed with you.

4. 04

   Verify

   The fix is reviewed against your reproduction steps. You are invited to confirm it.

5. 05

   Disclose and credit

   Details are published on a date agreed with you, with credit in the form you choose, or none if you prefer.

How long each stage takes depends on severity, complexity and who owns the affected code, so this policy does not promise fixed response or fix times. Instead, the coordinator agrees milestones with you after triage and tells you promptly if they change. If a fix cannot be made, the disclosure plan is discussed with you openly.

If you make a good-faith effort to follow this policy, Quantix:

• will not pursue or support legal action against you for that research, and will not refer it to law enforcement;
• considers that research authorised under the website’s Terms of Use;
• will, if you ask, confirm in writing that your activity followed this policy.

If you are unsure whether something is allowed, ask through the disclosure channel before testing. This commitment covers Quantix only. It cannot authorise testing of systems that belong to others, including the website’s service providers.

With your consent, valid reports are credited by name or handle when the issue is disclosed. This policy does not include a reward programme. Research programmes on the researcher portal describe their own recognition.

When Quantix research finds a vulnerability in third-party code or infrastructure, it follows the same principles in reverse:

• the maintainer is told privately first, through their published security contact where one exists;
• details are shared only with people who need them to fix the issue;
• publication waits until a fix or mitigation is available or a date has been agreed with the maintainer;
• original discoverers are credited, and others’ work is never presented as Quantix’s.

If a maintainer cannot be reached, Quantix may contact the relevant ecosystem’s security coordinators before any publication.

Reports are handled as described in the Privacy Policy. Your identity is shared only with the people coordinating the fix, and never with a third party without your consent unless the law requires it.

This policy may be updated. Reports are handled under the version in force when they were submitted.