Trust · Responsible disclosure
Found something? Tell us. We’ll fix it and thank you.
PacinfraX Corporation welcomes good-faith security research on PXCMail. This policy explains what we ask of researchers and what you can expect from us.
Scope
- In scope: pxcmail.com and subdomains (console, webmail, locked-delivery pages, API at api.pxcmail.com), mail infrastructure under pxcmail.com, mobile/device policy behavior, published client integrations.
- Out of scope: third-party services we use (report to them), customers’ own domains and systems, social engineering of staff or customers, physical attacks, denial of service, spam or reputation testing against real recipients, automated scanning that degrades service.
Rules
- Test only against accounts you own (free trial organizations are fine; mark them “security research” in the organization name). Never access, modify or exfiltrate data belonging to others; if you encounter it, stop and report.
- Do not send test messages to real patients, clients or third parties.
- Give us reasonable time to remediate before public disclosure (we aim for 90 days and will coordinate a date).
How to report
Email [email protected] (PGP key published in security.txt at launch) with steps to reproduce, impact, and any proof of concept. We acknowledge within one business day, triage within five, and keep you informed until resolution.
What you can expect
- No legal action for good-faith research that follows this policy (safe harbor), and we will not refer such research to law enforcement.
- Credit on this page if you wish, after the fix.
- A paid bug bounty program on a public platform is planned after general availability; until then we offer thanks, credit and swag.
Severity and timelines
| Severity | Example | Target fix |
|---|---|---|
| Critical | Cross-tenant data access; authentication bypass; RCE | 72 hours |
| High | Privilege escalation within a tenant; content exposure via logs | 14 days |
| Medium | CSRF on non-destructive actions; information disclosure | 30 days |
| Low | Best-practice gaps without demonstrable impact | 90 days |
Hall of thanks
Researchers who help us will be listed here with their permission.