Security & responsible disclosure

How to report

Email [email protected] with: a description of the issue and its impact, the affected URL or endpoint, steps to reproduce (a proof of concept if possible), and how to contact you. Our machine-readable contact details are at /.well-known/security.txt.

Our commitments

• Acknowledge your report within 3 business days.
• Keep you updated and tell you when the issue is fixed.
• Credit you publicly if you wish, once fixed.
• Not pursue legal action for research carried out in good faith under this policy.

Rules of engagement

• Only test against your own accounts. Do not access, modify or delete other users' data; if you encounter it, stop and report.
• No denial-of-service, load testing, spam, social engineering or physical attacks.
• Do not run automated scanners that generate heavy traffic.
• Give us reasonable time to fix the issue before any public disclosure (we suggest 90 days).

In scope

pexonix.com and its subdomains, including the Startup Force, Fund Force, investor, agent, media and admin portals and their APIs.

Out of scope

• Reports from automated tools without a demonstrated impact; missing best-practice headers without an exploit.
• Clickjacking on pages without sensitive actions; self-XSS; logout CSRF.
• Rate-limit or brute-force findings on non-authentication endpoints.
• Vulnerabilities in third-party services (Razorpay, PayPal, Google, Cloudflare) — report those to the vendor.

How we protect Pexonix

• Cloudflare in front of all traffic: DDoS mitigation, web application firewall, bot protection and rate limits.
• Field-level AES-256 encryption for funding data, contacts, messages and NDAs; TLS everywhere; HSTS.
• Parameterised database queries, ownership checks on every request, random non-guessable IDs.
• Content-Security-Policy, frame protection, sanitised rich text, magic-byte checks on every upload.
• Two-factor authentication required for admin, investor and agent accounts; append-only audit log.
• Encrypted daily off-site backups.