Vulnerability Disclosure Policy — Arbitex

Security / Coordinated Disclosure

Version 1.0 · Effective 2026-04-21 · Review 2027-04-21

Arbitex welcomes reports from security researchers acting in good faith. This policy defines what we consider in scope, how to report, what you can expect from us in return, and the protections afforded to researchers who follow it.

1. Our Commitments

Security is a continuous discipline, not a posture. We treat vulnerability reports as signals that help us improve, and we commit to the following when you engage with us in good faith under this policy:

• Respond promptly and work with you through resolution.
• Investigate all reports regardless of source or reporter.
• Not pursue or support legal action against researchers operating within this policy.
• Credit reporters who wish to be recognized, and respect requests to remain anonymous.
• Keep you informed of remediation progress and coordinate on public disclosure timing.

2. Assets and Boundaries

Scope is listed explicitly. If you discover something adjacent that may warrant attention, contact us before testing — we will confirm scope or decline in writing.

3. Rules of Engagement

Research activity that falls outside these rules is not protected under this policy and may be treated as unauthorized access.

You may

• Test for vulnerabilities against in-scope assets using your own accounts.
• Use automated tooling at a rate that does not degrade service for others.
• Report findings privately through the channels below.

You must not

• Access, modify, or exfiltrate data belonging to other users or Arbitex beyond the minimum needed to demonstrate the vulnerability.
• Perform denial-of-service, resource-exhaustion, or volumetric testing.
• Conduct social engineering (phishing, vishing, pretexting) against staff, customers, or third parties.
• Attempt physical intrusion, tailgating, or tampering with on-premises hardware.
• Introduce malware, persistent implants, or backdoors.
• Publicly disclose, share with third parties, or post findings before coordinated release.
• Use a vulnerability to pivot beyond the affected system.

4. Authorization and Safe Harbor

When you conduct vulnerability research consistent with this policy, we consider your research to be:

• Authorized under the Computer Fraud and Abuse Act (CFAA), state computer-crime statutes, and equivalent laws to the extent we are able to authorize such activity.
• Exempt from restrictions in our terms of service that would interfere with conducting security research, and we waive those restrictions on a limited basis for this purpose.
• Lawful, helpful to the security of the internet, and conducted in good faith.

You are expected to comply with all applicable laws. If legal action is initiated by a third party against you for activities conducted under this policy, we will take steps to make it known that your actions were authorized.

This policy does not authorize activity that violates law, and we cannot authorize testing against systems operated by third parties. If a finding involves a third-party component, coordinate with us before contacting the vendor.

5. How to Report

Submit reports via email to [email protected], encrypted with our PGP key (Section 8).

Include

• A clear description of the vulnerability and its impact.
• Affected component, URL, or endpoint.
• Step-by-step reproduction instructions.
• Proof-of-concept output, screenshots, or a short video if helpful.
• Your assessment of severity (CVSS optional; we rescore internally).
• Contact information and whether you wish to be credited publicly.

Do not include in initial contact

• Working exploit code for unpatched vulnerabilities — we will provide a secure channel for that exchange once the report is triaged.
• Customer or employee data accessed during testing — describe what you accessed, do not send copies.

6. What You Can Expect

Timelines are measured in business days from receipt at [email protected]. Complex or low-severity findings may take longer; we will communicate proactively when that is the case.

The disclosure window begins at triage. P0 / Critical findings that require complex remediation or third-party coordination are granted an extended window of up to 120 days. Further extensions require mutual agreement. We will not request extensions to delay publication indefinitely.

7. What We Generally Will Not Accept

The following are typically not eligible for acknowledgment or reward, absent a demonstrated, concrete impact:

• Missing security headers (CSP, HSTS, X-Frame-Options, etc.) without a working attack chain.
• Clickjacking on pages with no sensitive actions.
• Self-XSS and issues requiring user-installed malware or physical access.
• CSRF on low-impact forms or on endpoints that do not change state.
• Reports based solely on software version numbers with no demonstrated vulnerability.
• Automated scanner output without manual verification.
• Rate-limiting, brute-force, or account-enumeration issues without meaningful consequence.
• Email-spoofing issues on domains with correctly configured SPF / DKIM / DMARC.
• Best-practice deviations without exploitability (e.g., cookie flags on non-sensitive cookies).
• Vulnerabilities in third-party libraries without a demonstrated exploit path in our environment.

A well-reasoned impact argument will move many of these into scope. We read every report.

8. Secure Communications

PGP is preferred for anything beyond an initial handshake. Our public key is published at the URL below and discoverable via Web Key Directory for [email protected].

Recognition and rewards

Researchers who follow this policy and submit qualifying reports are eligible for public acknowledgment atarbitex.ai/security/acknowledgments. Monetary awards are issued at our discretion based on severity, impact, and report quality.

9. Policy Governance

This policy is reviewed at least annually and on material change to the in-scope environment. Questions about the policy itself — not report submissions — may be directed to[email protected].

This policy is adapted in part from the disclose.io Core Terms and is offered to the research community in the same spirit.

security.txt › /.well-known/security.txt ·  v1.0 · 2026-04-21