Vulnerability Disclosure Policy

Please email your findings to [email protected]. To help us triage quickly, include as much of the following as possible:

• Steps to reproduce — a clear, step-by-step description of how to trigger the issue, including the exact URLs, endpoints, or inputs involved.
• Affected version — browser, operating system, and, if relevant, the ESXPress feature or API version you were testing against.
• Impact — what an attacker could do with this vulnerability (e.g., data exposure, account takeover, denial of service), and your assessment of severity.
• Proof of concept— a minimal PoC, screenshots, or logs that demonstrate the issue. Avoid including other users' real data.

• Acknowledgment within 3 business days — we will confirm receipt of your report and begin triage.
• Triage within 10 business days — we will assess validity, severity, and impact, and keep you informed of our progress throughout remediation.
• No legal action for good-faith researchers — if you act in good faith, follow this policy, and make a reasonable effort to avoid privacy violations, data destruction, and disruption of service, ESXPress will not pursue legal action against you for your research.
• Confidentiality — we will treat your report and identity as confidential and will not share them without your permission, except as required by law.
• Credit — with your permission, we will acknowledge your contribution in our security updates and changelog.

• The esxpress.org website and all *.esxpress.org subdomains.
• The ESXPress API (api.esxpress.org and related API endpoints).

Third-party services used by ESXPress (e.g., Stripe, Supabase, Cloudflare) maintain their own disclosure programs and are out of scope for this policy.

The following activities are not authorized and are outside the scope of this policy:

• Denial-of-service (DoS/DDoS) attacks or any testing that degrades, disrupts, or overloads our services or infrastructure.
• Social engineering — phishing, pretexting, or any attempt to deceive ESXPress employees, contractors, or customers.
• Spam or bulk unsolicited messaging, including automated account or content creation at scale.
• Physical security testing, or accessing, modifying, or deleting data that does not belong to you.
• Testing that violates applicable law or the rights of third parties.

If you are unsure whether an activity is in scope, ask us first at [email protected] before you begin.