Responsible security disclosure policy

Last updated: October 13, 2026

1. How to report

If you find a vulnerability, write to info@interpolgarnexus.com with the subject “Security,” including a description, steps to reproduce, the impact and, if possible, evidence. You may request an encrypted channel. We also publish a security.txt file at /.well-known/security.txt.

2. Our commitment

We will acknowledge receipt within 3 business days, keep you informed, fix with priority based on severity and, if you wish, credit your contribution. We will not take legal action against good-faith research that complies with this policy.

3. Rules

Test only with your own or demo accounts; do not access, modify or keep other people’s data beyond the minimum needed to demonstrate the issue; do not perform denial of service, social engineering or physical tests; do not disclose publicly before we fix the issue or 90 days pass from the report.

4. Scope

The interpolgarnexus.com site, its subdomains and the Interpolgar Nexus platform. Third-party services (hosting, email) and availability attacks are out of scope.

5. Rewards

We do not currently offer monetary rewards.

← Legal center