⚠️ Staging environment, test only, not production
Sign In
Back to Security

Vulnerability Disclosure Policy

Last updated: August 12, 2026

ESXPress takes the security of our platform and our customers' data seriously. We welcome security researchers to report vulnerabilities they discover, and we are committed to working with the research community to verify, triage, and remediate legitimate findings. This page explains how to report a vulnerability, what we commit to once you do, and what falls within the scope of this program.

How to Report a Vulnerability

Please email your findings to hello@esxpress.org. To help us triage quickly, include as much of the following as possible:

  • Steps to reproduce, a clear, step-by-step description of how to trigger the issue, including the exact URLs, endpoints, or inputs involved.
  • Affected version, browser, operating system, and, if relevant, the ESXPress feature or API version you were testing against.
  • Impact, what an attacker could do with this vulnerability (e.g., data exposure, account takeover, denial of service), and your assessment of severity.
  • Proof of concept, a minimal PoC, screenshots, or logs that demonstrate the issue. Avoid including other users' real data.
  • Encryption (optional), if your report contains sensitive material, encrypt it with our PGP key (fingerprint 9901 2E5D 9661 CFF4 F816 AA41 0C76 E4C5 5B5E F4D0). Plain email is fine for most reports.

What We Commit To

  • Acknowledgment within 3 business days, we will confirm receipt of your report and begin triage.
  • Triage within 10 business days, we will assess validity, severity, and impact, and keep you informed of our progress throughout remediation.
  • No legal action for good-faith researchers, if you act in good faith, follow this policy, and make a reasonable effort to avoid privacy violations, data destruction, and disruption of service, ESXPress will not pursue legal action against you for your research.
  • Confidentiality, we will treat your report and identity as confidential and will not share them without your permission, except as required by law.
  • Credit, with your permission, we will acknowledge your contribution in our security updates and changelog.

What's In Scope

  • The esxpress.org website and all *.esxpress.org subdomains.
  • The ESXPress API (api.esxpress.org and related API endpoints).

Third-party services used by ESXPress (e.g., Stripe, Supabase, Cloudflare) maintain their own disclosure programs and are out of scope for this policy.

What's Out of Scope

The following activities are not authorized and are outside the scope of this policy:

  • Denial-of-service (DoS/DDoS) attacks or any testing that degrades, disrupts, or overloads our services or infrastructure.
  • Social engineering, phishing, pretexting, or any attempt to deceive ESXPress employees, contractors, or customers.
  • Spam or bulk unsolicited messaging, including automated account or content creation at scale.
  • Physical security testing, or accessing, modifying, or deleting data that does not belong to you.
  • Testing that violates applicable law or the rights of third parties.

If you are unsure whether an activity is in scope, ask us first at hello@esxpress.org before you begin.