Axigen Messaging SRL ("Axigen") values the work of security researchers and is committed to resolving security issues in its products and services. This policy explains how to report a vulnerability to us and what you can expect from us in return.
Scope
This policy applies to Axigen Mail Server, Axigen clients and tools, and the Axigen website (axigen.com).
Third-party components and services are out of scope. Please report vulnerabilities in them directly to their respective vendors or maintainers.
How to report a vulnerability
Please report any suspected vulnerability by email to security@axigen.com. Include:
- the affected product, component and version, or the affected URL;
- a description of the vulnerability and its potential impact;
- detailed steps to reproduce it, including any proof-of-concept code or screenshots.
What you can expect from us
- We will acknowledge your report within a reasonable time.
- We will investigate, validate the issue and keep you informed about its status.
- We will work on a fix and release it as soon as reasonably possible.
- With your agreement, we will credit you for the discovery once the fix is available. Please note that Axigen does not run a bug bounty program and does not offer monetary rewards for reports.
Security advisories
Axigen security advisories are published in our Knowledge Base.
Guidelines
We ask that you:
- make a good-faith effort to avoid privacy violations, data destruction and service disruption;
- only interact with accounts and systems you own or have explicit permission to test;
- do not access, modify or retain data that does not belong to you beyond what is strictly needed to demonstrate the issue;
- do not use denial-of-service, social engineering or physical attacks;
- give us a reasonable amount of time to fix the issue before disclosing it publicly, and do not disclose it to others in the meantime.
We appreciate research carried out in good faith and in accordance with this policy, and we will work with researchers who follow it to understand and resolve the issues they report.