home / responsible disclosure
// security.txt
Found a bug in our systems?
We test other people's systems for a living, so hold us to the same standard. If you've found a vulnerability in anything SecureDX runs, we want to hear from you — and we'll treat good-faith research fairly.
// safe harbour
Our commitment to researchers
If you make a good-faith effort to follow this policy, we will:
- Not pursue or support legal action against you for your research
- Work with you to understand and resolve the issue quickly
- Credit you in our Hall of Fame (with your permission)
- Acknowledge your report within our stated response target
// how to report
Reporting a vulnerability
- Email
security@securedx.inwith details and steps to reproduce - Give us reasonable time to fix before any public disclosure
- Only test against assets we own
- Act in good faith and avoid privacy violations or data destruction
- Run denial-of-service or volumetric attacks
- Access, modify or delete data that isn't yours
- Social-engineer our staff or customers
- Publicly disclose before we've had a chance to fix
// hall of fame
Security Hall of Fame
We thank every researcher who helps keep SecureDX safe. If you report a valid vulnerability under this policy, we'll add you to this page once the fix is live.
- The issue is in scope and has real security impact
- You're the first to report it
- You reported it to
security@securedx.inand followed this policy - You gave us time to fix it before disclosing
- Your name or handle listed here, with a link if you want one
- A short description of what you found
- A written acknowledgement you can share
This is a recognition program. We don't currently pay cash rewards.
- Sagar DhekleOpen redirect on /login via the next parameter2026-11
// scope
In scope
Our public web properties under securedx.in and, when live, app.securedx.in. Third-party services we use (email, hosting, scheduling) are out of scope — report those to the provider.