Legal

Responsible Disclosure Policy

Last updated: July 2026

Note: This document is a working draft. Have it reviewed by legal counsel before public launch.

Security is central to everything we build. We welcome reports from security researchers and members of the public who identify potential vulnerabilities in our website or public services, and we are committed to working with you to verify and resolve them.

Our commitment

We take all good-faith reports seriously, investigate promptly, and keep you informed throughout the process. We will not pursue or support legal action against researchers who follow this policy.

How to report a vulnerability

Please send your report to security@vexaagents.com. Do not disclose the issue publicly until we have had a reasonable opportunity to address it.

What to include in a report

  • A clear description of the vulnerability and its potential impact.
  • Steps to reproduce, including any proof-of-concept where appropriate.
  • The affected URL, endpoint, or component.
  • Any relevant screenshots, logs, or supporting material.

Safe harbour

We will not initiate legal action against you for security research conducted in good faith and in accordance with this policy, including good-faith accidental violations. We consider such research to be authorised and will work with you to understand and resolve the issue quickly.

Scope

This policy applies to vexaagents.com and our publicly accessible services.

Out of scope

The following activities are not authorised under this policy:

  • Social engineering of our staff, contractors, or users.
  • Denial-of-service (DoS) or resource-exhaustion attacks.
  • Physical attacks against our property or personnel.
  • Accessing, modifying, or destroying data that is not your own.

Response timeline

  • We acknowledge receipt of your report within 2 business days.
  • We provide regular updates until the issue is resolved.
  • We confirm with you once a fix has been deployed.

Recognition

With your permission, we are happy to publicly acknowledge your contribution once an issue has been resolved. We are grateful to the researchers who help keep our users and services safe.