Trust Center
Report a Vulnerability
XRDNA welcomes good-faith reports of potential security vulnerabilities in public-facing systems that XRDNA manages.
How to report
Email [email protected] with:
- the affected asset (URL, hostname or product),
- concise steps to reproduce,
- the impact you observed, and
- a safe way to contact you.
Encrypted submission is not currently offered, so do not include real customer, mission, classified, CUI or sensitive personal data in a first report. We will arrange a suitable channel if more detail is needed.
We aim to acknowledge reports within 5 business days and will keep you informed as we investigate.
Scope
In scope:
xrdna.iocdn.xrdna.ioconsole.xrdna.ioapi.xrdna.io
Out of scope: systems operated by customers, government or partner organizations, even when they run XRDNA software; third-party services we use; and findings that require physical access, social engineering or denial of service.
Testing rules
- Only test systems in scope, and only with accounts you own.
- Do not access, change or keep data that is not yours; stop and report as soon as you encounter it.
- Do not disrupt services, exfiltrate information or run destructive tests.
- Do not disclose details publicly until we have addressed the issue or agreed a date with you.
Safe harbor
If you make a good-faith effort to follow this page, XRDNA will not pursue or support legal action against you for your research, and will consider it authorized for the systems in scope. If a third party brings a claim related to that research, we will make it known that your actions followed this page. This is not a bug bounty program, and it does not authorize testing of systems outside the scope above.