This policy sets out how security testing must be conducted on Xfence, and the protections extended to researchers who test in good faith and within scope. It applies to every engagement on the platform and supplements our Terms of Service.
On this page
1. Purpose
Security testing carries real risk to production systems and real user data. This policy exists to keep testing safe, lawful, and fair to everyone involved — organizations get thorough coverage without collateral damage, and researchers get clear rules and legal protection when they follow them.
2. Scope of Testing
- Only assets explicitly listed in an engagement's defined scope may be tested
- Testing must respect any stated rules of engagement, including allowed testing windows, rate limits, and excluded functionality
- Access to an engagement does not imply authorization to test anything beyond what that engagement's scope defines
- If you're unsure whether something is in scope, treat it as out of scope and ask via the platform's comment feature before proceeding
3. Prohibited Actions
Regardless of an engagement's scope, the following are never permitted:
- Denial-of-service or resource-exhaustion attacks against any system
- Automated, high-volume scanning that degrades availability for other users
- Accessing, modifying, downloading, or exfiltrating real user data beyond the minimum needed to prove a vulnerability exists
- Social engineering, phishing, or physical intrusion attempts, unless explicitly listed as in scope
- Pivoting from an in-scope vulnerability into out-of-scope systems or third-party infrastructure
- Using an exploited vulnerability for any purpose beyond generating a proof-of-concept for the report
- Testing on behalf of, or sharing engagement access with, anyone who has not been vetted and approved by Xfence
4. Responsible Disclosure Requirements
- Vulnerabilities must be reported exclusively through the Xfence platform to the engagement owner — never disclosed publicly, to a third party, or to the press
- Reports must include clear reproduction steps and, where applicable, a proof-of-concept sufficient to verify the finding without unnecessary risk to production systems
- Public disclosure of any vulnerability is only permitted after the organization has remediated it and given explicit written consent
- All assessment details — including unpatched vulnerabilities — remain confidential indefinitely if the organization does not consent to disclosure
5. Safe Harbor
If you make a good-faith effort to comply with this policy and an engagement's defined scope, Xfence and the participating organization will not pursue legal action against you for accidental, good-faith violations, and we will consider your conduct as authorized under any applicable computer-crime law. Safe harbor does not apply to testing outside the defined scope, prohibited actions listed above, or bad-faith conduct.
6. Reporting Requirements
Every report submitted must include: a clear title and severity assessment, step-by-step reproduction instructions, the impact of the vulnerability if exploited, and any relevant proof-of-concept material. Reports lacking sufficient detail to reproduce a finding may be marked as invalid at the organization's discretion.
7. Consequences of Violation
Violating this policy may result in immediate suspension or termination of your account, removal from the researcher network, and — for serious or malicious violations — referral to law enforcement and civil or criminal legal action.
8. Contact
Found a vulnerability in Xfence itself (this website, the dashboard or our API) rather than in a client's engagement? Please follow our Vulnerability Disclosure Policy.
Questions about scope, a specific engagement, or this policy? Reach us at security@vrseclabs.in.