Vulnerability disclosure

Help us protect SVXtream and its customers.

We welcome clear, good-faith reports of security vulnerabilities affecting services operated by SVXtream. Please give us enough detail to reproduce and assess the issue, and allow us time to investigate before public disclosure.

Submit a security reportEmail security@svxtream.com

In scope

Issues with a practical security impact

  • Authentication or authorization bypasses
  • Cross-tenant or unintended data access
  • Injection vulnerabilities, including SQL injection and command injection
  • Server-side request forgery, cross-site scripting and impactful cross-site request forgery
  • Exposure of credentials, secrets or sensitive customer information
  • Security misconfigurations with a demonstrable impact

Out of scope

Unsafe testing and low-impact observations

  • Denial-of-service, load testing or activity that could degrade the service
  • Social engineering, phishing, physical attacks or attacks against employees and suppliers
  • Automated scanning without a verified security impact
  • Missing headers, version disclosure, self-XSS or best-practice observations without an exploitable impact
  • Spam, credential stuffing, password spraying or testing with credentials that are not your own
  • Vulnerabilities solely in third-party services outside SVXtream's control

Research guidelines

Test carefully and minimise access to data.

Scope

This policy covers svxtream.com and services that SVXtream operates on that domain. Links to third-party sites do not bring those services into scope.

Protect people and systems

Use accounts and data you are authorised to use. Stop testing and report immediately if you encounter customer data, credentials or another person's private information. Do not retain, alter, download or share more data than is necessary to show the issue.

Send a useful report

Include the affected URL or feature, a concise impact statement and safe reproduction steps. The web form accepts links but no file uploads. Do not submit passwords, session tokens or unrelated personal data.

What to expect

We aim to acknowledge a report within five business days. We will assess its scope and impact, may ask for more information, and will coordinate disclosure timing when a valid issue is confirmed. Remediation time depends on severity and complexity.

Recognition and rewards

SVXtream does not currently operate a paid bug bounty or promise a reward. Any public recognition requires the reporter's consent and will be considered after remediation.