Keeping Xfence secure matters to us and to the companies that trust us with their security. If you believe you have found a vulnerability in Xfence itself, we want to hear from you, and we will work with you to understand and fix it. This policy explains how to report it and what you can expect from us. It is also published in machine-readable form at /.well-known/security.txt.
On this page
1. How to report
Email security@vrseclabs.in. Please include:
- A short description of the issue and where it is (the URL, page or API endpoint)
- Step-by-step instructions to reproduce it, with any requests, payloads or screenshots
- What an attacker could do with it (the impact)
- How we can reach you, and whether you would like to be credited
Please report only through this address. Do not open public issues or post about it on social media.
2. In scope
- xfence.in: the public website
- The Xfence dashboard (xfence.in/dashboard) and the API under xfence.in/backend/api/
- Emails sent by the Xfence platform
3. Out of scope
- Systems of our clients. Those are tested only through an Xfence engagement, under its own scope, terms and NDA; see our Acceptable Use and Responsible Disclosure Policy
- Third-party services we use, such as our email provider or the Cal.com booking widget. Please report those to the vendor
- Denial of service, load or stress testing, and anything that degrades the service for others
- Social engineering or phishing of our staff, clients or researchers, and physical attacks
- Reports from automated scanners without a demonstrated, real impact
- Missing security headers, cookie flags, or email records (SPF, DKIM, DMARC) without a working attack
- Clickjacking on pages with no sensitive action, self-XSS, logout or login CSRF, and software version banners
- Rate limiting or brute-force reports without a demonstrated account compromise
4. Testing rules
- Use only accounts you own or are authorised to use. Never access, change or delete another user's data
- Collect the minimum needed to prove the issue. If you reach personal data or another user's information, stop, do not keep it, and tell us in your report
- Do not run automated scans at a volume that could affect availability
- Keep the details confidential until the issue is fixed and we have agreed on disclosure
5. Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and if a third party takes action against you over research that followed this policy, we will make it known that you acted with our authorisation. If you are unsure whether something is allowed, ask us at security@vrseclabs.in before you test.
6. What you can expect from us
- We aim to acknowledge your report within 3 business days
- We aim to confirm whether the issue is valid, and tell you its severity and our plan, within 10 business days
- We will keep you updated until it is fixed and let you know when it is
7. Public disclosure
We follow coordinated disclosure. Please give us a reasonable time to fix the issue before sharing any details; by default we ask for 90 days from your report, or until the fix is released if that is sooner. We are happy to agree on a date with you and to review your write-up before it is published.
8. Recognition
Xfence does not currently offer monetary rewards for reports about its own platform. With your permission, we are glad to publicly thank you for a valid report once it is fixed.