Responsible Disclosure Policy

1. Good-Faith Research

N3XI0M welcomes good-faith vulnerability reports relating to systems the project owns or is authorized to operate.

2. Scope

Only test N3XI0M-operated assets where you have a reasonable basis to believe testing is permitted. Third-party services are outside scope unless their owner separately authorizes testing.

3. Prohibited Testing

• denial-of-service or traffic flooding;
• destructive testing;
• accessing more user data than necessary to demonstrate an issue;
• credential theft or phishing;
• social engineering of staff or users;
• malware deployment;
• persistence after proving the vulnerability;
• public disclosure before reasonable remediation time.

4. Report Contents

A useful report should include:

• the affected service or URL;
• a clear description of the vulnerability;
• reproduction steps;
• potential impact;
• supporting screenshots or logs where appropriate;
• suggested remediation if known.

5. Data Handling

Researchers should minimize access to personal information and immediately stop testing if sensitive data is unexpectedly exposed.

6. Disclosure

Give N3XI0M a reasonable opportunity to investigate and remediate a valid vulnerability before public disclosure.

7. Safe-Harbour Intent

Where research is performed in good faith, remains within authorized scope, avoids privacy harm and service disruption, and follows this policy, N3XI0M intends to treat that activity as legitimate security research rather than malicious activity.

8. Reporting

Submit vulnerability reports through official N3XI0M support channels and clearly mark them as security reports.