Trust Center · Responsible Disclosure
Responsible Disclosure
A coordinated disclosure policy for security researchers who find a potential vulnerability in a Cystem X system.
Cystem X welcomes reports from good-faith security researchers who find a potential vulnerability in our systems. This page explains what is in scope, the safe-harbor terms we offer, and how to report what you find.
Scope
In scope: cystemx.com and any system we operate and publicly identify as belonging to Cystem X. Out of scope: third-party services we link to but do not operate, social engineering, physical attacks against our offices, denial-of-service testing, and spam or phishing campaigns directed at our staff or clients.
Safe harbor
If you make a good-faith effort to follow this policy, test only what is in scope, avoid privacy violations and service disruption, and give us a reasonable opportunity to investigate and remediate before any public disclosure, we will not pursue legal action against you for that research. This commitment does not extend to testing that violates the scope or safe-harbor terms above.
How to report
Submit a report through our contact form. Describe the issue as a security report in your message and include enough detail for us to reproduce it: the affected URL or system, steps to reproduce, and the potential impact. We do not accept vulnerability reports by email; the contact form is the only channel we monitor for this purpose.
What to expect
We acknowledge new reports within 3 business days. Once we confirm an issue, we will keep you updated as we investigate and remediate, and we welcome a conversation about appropriate public disclosure timing once a fix is in place. We do not currently operate a paid bug bounty program, but we are glad to publicly credit researchers who want that recognition, with their permission.
Why we only accept reports through the contact form
Routing every report through one channel means nothing gets missed in a shared inbox or filtered as spam, and it lets us tag, prioritize and track each report the same way regardless of who on our team first sees it. If you are unsure whether something is worth reporting, submit it anyway through the contact form and describe what you found; we would rather review a report that turns out to be a non-issue than miss a real one.