We believe in the security research community. If you discover a vulnerability in our infrastructure or services, we want to know — and we commit to working with you transparently and fairly.
Document the vulnerability with sufficient detail — steps to reproduce, impact assessment, affected assets, and any PoC (non-destructive). Screenshots and HTTP logs are helpful.
Email your report to security@hexstrike.io. For sensitive findings, use our PGP public key to encrypt the report before sending. PGP key fingerprint is available on our security.txt file.
We will acknowledge receipt within 2 business days and provide an initial severity assessment within 5 business days.
We will work to remediate valid findings within 90 days. We'll keep you updated on progress and coordinate public disclosure timing with you.
Within 2 business days of receiving your report.
Within 5 business days — including CVSS score and initial validity determination.
Within 14 days for critical severity findings.
Within 90 days for all valid findings.
We publicly acknowledge researchers who disclose valid vulnerabilities in good faith. Recognition includes listing on our Hall of Fame and, for critical findings, a personal thank-you letter from our security team.
Email security@hexstrike.io — PGP encryption available and encouraged for sensitive reports.