Security & Responsible Disclosure Policy
Security expectations and responsible vulnerability-reporting process for X2.
1. Purpose
X2 welcomes good-faith reports that help identify genuine security issues while protecting users, data and production systems.
2. Reporting
Security concerns may be reported to support@x2records.com. API or developer-related security issues may also be reported to developer@x2records.com.
3. Good-Faith Research
Researchers should minimize impact, access only data necessary to demonstrate a vulnerability, avoid persistence, avoid social engineering, avoid privacy violations and stop testing where continued activity could harm users or services.
4. Prohibited Testing
Do not perform denial-of-service attacks, destructive testing, credential stuffing, malware deployment, physical attacks, spam, large-scale automated account creation or access to data beyond what is necessary to verify the issue.
5. Confidentiality
Non-public vulnerabilities, credentials, personal data and confidential service information should not be disclosed publicly before X2 has had a reasonable opportunity to investigate and remediate.
6. Third-Party Systems
Issues affecting a third-party provider may need to be reported directly to that provider. X2 cannot authorize security testing against systems it does not control.
7. Response
X2 may acknowledge, investigate, request additional information, remediate and communicate resolution based on severity, reproducibility and affected systems.
8. No Automatic Bug Bounty
This Policy does not create a bug-bounty program or promise payment, reward or compensation for reports unless X2 expressly establishes such a program in writing.
9. Abuse
Security research conducted as a pretext for extortion, unauthorized access, data theft, service disruption or fraud is not protected by this Policy and may be subject to enforcement.