Responsible Disclosure Policy

1. Our Commitment

Magdox Private Limited (Magdox, we, us) treats the security of our products, including FDIE, as core to how we operate. We know that independent security researchers often find things our own team misses, and we want to make it easy and safe for you to tell us about them.

This policy explains how to report a vulnerability to us, what we ask of you while you do, and what you can expect from us once you have.

2. No Monetary Rewards

Magdox does not currently run a paid bug bounty program. We are not able to offer cash rewards for vulnerability reports at this time.

What we do offer is public recognition. Every researcher who submits a valid, previously unreported vulnerability is credited on our Hall of Fame page, with their name or handle and a short description of what they found, unless they would rather stay anonymous.

We may introduce paid rewards in the future. If we do, this policy will be updated first.

3. Scope

In scope:

• https://magdox.io and every subdomain under *.magdox.io, including our product web application at https://fdie.magdox.io and its REST API.

Out of scope:

• mail.magdox.io. This subdomain is part of our Zoho Mail setup and is operated by Zoho, not by us. Any vulnerability there belongs to Zoho’s own security team, not ours, and we cannot offer safe harbor for testing infrastructure we do not control.
• Any third-party service we use but do not operate ourselves, including our payment processor (2Checkout (Verifone)), our CRM, and our cloud hosting provider. Please report issues with those services directly to the company that runs them.
• Physical security, social engineering aimed at our employees, and denial-of-service testing of any kind.

4. How to Report & SLA Response Targets

Email [email protected] with as much detail as you can give us. A report that lets us reproduce the issue on the first try gets fixed faster than one that does not.

Please include:

• What the vulnerability is and what kind of issue it is (for example, an authentication bypass or a stored XSS).
• Which URL, endpoint, or feature is affected.
• Step by step instructions to reproduce it.
• Proof of concept, if you have one. A screenshot or short screen recording is fine.
• What the impact is, in your own words.
• Your name or handle, and whether you would like to be credited publicly if we confirm the issue.

Response & Resolution SLAs

We read every report ourselves. On a best-efforts basis, we adhere to the following SLAs:

• Initial Acknowledgement: within 3 business days of receipt.
• Triage & Confirmation: within 5 business days of receipt.
• Target Resolution Timeframes (based on CVSS severity):
  • Critical (CVSS 9.0 - 10.0): 14 business days
  • High (CVSS 7.0 - 8.9): 30 business days
  • Medium (CVSS 4.0 - 6.9): 60 business days
  • Low (CVSS 0.1 - 3.9): 90 business days

We will keep you informed on progress at each stage of remediation.

5. Ground Rules & Safe Harbor

We ask that you:

• Only test against accounts and data you own, or that you have explicit permission to test against.
• Make a good faith effort to avoid privacy violations, data destruction, and any interruption or degradation of our service.
• Avoid social engineering of any kind, including phishing our staff or customers.
• Give us a reasonable amount of time to fix an issue before discussing it publicly.
• Send us one report per vulnerability, unless several smaller issues need to be reported together to show their combined impact.
• Avoid running aggressive, high-volume automated scanners against our production systems. Manual testing, or a scanner configured to be gentle with rate limits, is fine.

If you follow these rules in good faith, we will not pursue legal action against you for your research, and we will not suspend your account because of it. If a third party takes legal action against you for activity that was consistent with this policy, we will do what we can to make clear to them that your work was authorized.

6. What We Prioritize

We triage every report by real-world impact so the most serious issues get looked at first. The table below shows how we categorize severity. It is not exhaustive; we apply judgment on a case-by-case basis.

Lower-priority issues, such as missing security headers on their own, or something only usable through clickjacking, are still worth reporting, but will usually not be treated as urgent.

7. What Is Not In Scope for Reporting

We generally do not need reports about:

• Rate limiting, unless you can show it leads to real data loss or a real business impact.
• Open redirects on their own.
• Clickjacking or issues that only work through clickjacking.
• Missing SPF, DKIM, or DMARC hardening beyond what we already publish.
• Username or email enumeration on public forms.
• Self-XSS that requires the victim to paste something into their own browser console.
• Descriptive error messages or stack traces that do not expose secrets or user data.
• Best-practice suggestions that do not themselves put data or accounts at risk, such as a missing HSTS preload flag.
• Anything found using an out of date patch, reported within 30 days of the patch becoming available.

If you are not sure whether something counts, send it anyway. We would rather see a report that turns out to be low impact than miss a real one.

8. Confidentiality

If you report a vulnerability to us, you may come across information that is not public. This could include details about how our systems are built, our product roadmap, or other non-public technical or business information.

Please keep anything you learn through this process confidential. Do not publish it, share it, or use it for anything other than helping us fix the issue you found, for five years from when you learned it. Any technical materials or write-ups you prepare as part of a report, along with any copies you make of information we share with you, remain our property, and we may ask you to delete or return them once the issue is resolved.

If you are found to have broken this confidentiality obligation, or misused a vulnerability you found instead of reporting it responsibly, we reserve the right to take legal action, and to seek an injunction or other court order in addition to any other remedy available to us, since a breach here can cause harm that is difficult to fix with money alone.

9. Nothing Guaranteed

Submitting a report does not obligate Magdox to share any additional information with you, to fix the issue on any particular timeline, or to take any specific action. We will always tell you what we decided and why.

10. Changes to This Policy

We may update this policy from time to time as our program matures, including if we introduce paid rewards later. We will post the update here with a new effective date.

11. Governing Law

This policy is governed by the laws of India, including the Information Technology Act, 2000. Any dispute arising from it will be handled in the competent courts of West Bengal, India.

Thank you for taking the time to help keep Magdox and our customers safe.