Hexes Vulnerability Disclosure Policy
Version 1.0 · Effective 2026-11-11 · Status: published
Version 1.0 · Effective date: 2026-11-11
Hexes Security, Inc. welcomes reports from security researchers, customers and anyone else who finds a vulnerability in our products or websites. This policy explains how to report one and what you can expect from us.
1. How to report
Email [email protected] with "Security report" in the subject line. If your report contains sensitive details, say so in your first email and we will arrange a secure way to receive them. Please include:
- the affected product, version or URL;
- a description of the vulnerability and its impact;
- steps to reproduce, proof-of-concept code or screenshots; and
- how you would like to be credited, if at all.
Please do not report vulnerabilities through public issue trackers, social media or support channels.
2. Scope
In scope: Hexes software (including the Hexes console and enforcement components) and websites and services that Hexes Security, Inc. operates under hexessecurity.com. Services that Hexes Security, Inc. hosts for several customers, such as the customer portal and hosted evaluation consoles, may be tested only within your own account: never try to reach another customer's data, and stop and tell us as soon as you see that you could.
Out of scope: vulnerabilities in third-party or open-source components that are not caused by Hexes Security, Inc.'s changes or integration (please report those to the upstream project, and tell us if they affect Hexes Security, Inc.); denial-of-service and volumetric testing; social engineering or physical attacks; spam; findings from automated scanners without a demonstrated impact; missing best-practice settings or configurations without a demonstrated security impact; and issues that require a compromised device or privileged access the attacker would not otherwise have.
3. Rules for research
When testing, you must:
- test only against Hexes software running in an environment you own or are authorized to test, or against in-scope websites with minimal, non-destructive requests;
- not access, modify, delete or keep data that does not belong to you, beyond the minimum needed to show the vulnerability, and stop and tell us immediately if you encounter such data;
- not degrade or disrupt our services or anyone else's, and not use automated tools that generate significant traffic;
- not use social engineering, phishing or physical access;
- give us a reasonable time to fix the vulnerability before any public disclosure; and
- comply with applicable law.
4. Our commitments
If you follow this policy, we will:
- acknowledge your report within 3 business days;
- keep you informed of our progress, and aim to give an initial assessment within 10 business days;
- work to fix confirmed vulnerabilities in a timeframe appropriate to their severity, and coordinate a disclosure date with you, normally within 90 days of your report;
- credit you in our advisory if you wish; and
- not take legal action against you, or ask law enforcement to investigate you, for research conducted in good faith and in accordance with this policy.
5. Safe harbor
We consider good-faith research that follows this policy to be authorized, and we waive any claims against you under our terms of use and applicable anti-hacking and anti-circumvention laws (such as the US Computer Fraud and Abuse Act and the Digital Millennium Copyright Act) for that research, to the extent we can. If a third party brings legal action against you for research that followed this policy, we will make it known that your actions were authorized by us. This safe harbor does not cover third-party systems or services, and does not authorize you to breach the rights of others. This policy does not authorize circumventing license keys, entitlement limits or other license controls, does not grant any license to Hexes software, and does not modify any agreement you have with Hexes Security, Inc. If in doubt, ask us first at [email protected].
6. Rewards
Hexes Security, Inc. does not currently run a paid bug bounty program. Any reward is at our sole discretion.
7. Security advisories
We publish security advisories for vulnerabilities in supported versions of our software, and notify customers with a current subscription.