Vulnerability Disclosure

The policy covers arxsable.ai and subdomains controlled by Arx Sable LLC. It does not authorize testing client sites, third-party services, or infrastructure belonging to a provider.

Denial of service, social engineering, physical attacks, destructive testing, and access to other people's data are out of scope.

• Use the smallest test needed to demonstrate the issue.
• Do not change, delete, or extract personal information.
• Stop testing if you encounter private data. Report the location without copying the data.
• Do not interrupt website access or submit bulk messages.
• Coordinate disclosure so a fix can be assessed and made.

If the scope is unclear, contact us before testing.

Email [email protected] with the subject “Security report.” Include the affected URL, steps to reproduce, the impact, and a safe example if one is needed. Do not email passwords, tokens, or personal records.

We acknowledge reports within 5 business days, keep the reporter informed, and address verified issues in a reasonable time. We give credit only with the reporter's permission.

There is no bounty program at this time. Reporting an issue does not create a payment obligation.

Arx Sable LLC will not take legal action against you for good-faith research that follows this policy on systems we control.

This commitment does not authorize testing another organization's systems or bind a third party. Research must stay within the scope and boundaries above.