Security & responsible disclosure

We sell attack-surface management, so we expect to be held to the standard we hold others to. If you have found a weakness in our platform, we want to hear about it and we will not treat you as a threat for telling us.

What we commit to

• Acknowledgement within 3 business days that a human has read your report.
• An initial assessment within 10 business days, including whether we consider it in scope and our severity view.
• Progress updates until the issue is resolved or we explain why we are not acting.
• Credit in our advisory if you want it, and coordination on timing if you intend to publish.
• No legal action against researchers who follow this policy in good faith.

In scope

• hexasentra.com — this website
• app.hexasentra.com — the application
• Anything that breaks tenant isolation, authentication, authorization, or billing integrity

Tenant isolation is the one we care about most. If you can read, modify, or infer another organization's data, treat it as critical and tell us immediately.

Out of scope

• Our customers' assets. Scan results in our platform describe third-party systems. Testing those systems is not authorized by us and we cannot authorize it — only their owner can.
• Findings that require a compromised device, a malicious browser extension, or physical access.
• Missing hardening headers or TLS configuration preferences with no demonstrated impact.
• Reports produced solely by an automated scanner, with no verification or demonstrated impact.
• Social engineering of our staff or customers, and denial-of-service testing.

Please do not

• Run denial-of-service, load, or resource-exhaustion tests.
• Access, alter, or retain data belonging to anyone but yourself. If you encounter someone else's data, stop, do not save it, and tell us what you saw.
• Use a finding to pivot further into our infrastructure once you have demonstrated it.
• Leave persistence, backdoors, or test artefacts behind.

Create your own account to test with. If you need a trial to do so, ask us at security@hexasentra.com and we will provide one.

Rewards

No paid bounty yet

We do not currently run a paid bug-bounty programme, and we would rather say so plainly than imply one. We offer public credit, a written advisory, and swag where we can. We would rather receive your report than have you withhold it for want of a payout — if you believe a finding warrants compensation, say so in your report and we will discuss it honestly.

How we secure the platform

Authorization: how we handle it

We only scan what you have demonstrated you control, and we record that authorization against every scan. If you are the owner of a system and believe we are scanning it without your permission, email security@hexasentra.com with the hostname and we will suspend scanning of it while we verify — before asking you for anything else.

Machine-readable policy

This policy is also published at /.well-known/security.txt per RFC 9116.