At Fluixio Technologies Private Limited (“Fluixio”, “we”, “our”, or “us”), we take the security of our products and services seriously. We appreciate the efforts of security researchers, customers, and members of the security community who responsibly identify and report potential security vulnerabilities.

This Responsible Disclosure Policy explains how to report potential security issues affecting Fluixio-operated websites, cloud services, APIs, software applications, and integrations.

This policy applies broadly to all software products, cloud infrastructure environments, APIs, administrative websites, and online endpoints operated by Fluixio Technologies Private Limited, unless an isolated product-specific security framework explicitly lists an overrides statement.

If you believe you have discovered a security vulnerability, please report it immediately with sufficient technical parameters to allow our internal security response team to investigate the issue thoroughly.

Your analytical log report should include, where possible:

⚠️ Public Coordinated Release: We kindly ask that you do not publicly disclose the vulnerability parameters before giving our response teams a reasonable operational opportunity to triage and remediate the issue.

When a vulnerability report is submitted following responsible disclosure logic, Fluixio will exert reasonable efforts to handle communication transparently, covering:

• Acknowledging receipt of the submission tracking token within a timely window.
• Reviewing, triaging, and assessing the technical severity of the reported issue.
• Investigating downstream structural impact across other integrated clusters.
• Deploying appropriate engineering code fixes or network firewall configuration remediations.
• Maintaining reasonable contact loops with the reporter regarding patch progression, where practicable.

Note: Submitting an issue does not inherently guarantee that the flagged behavior will be categorized as a security exploit or an actionable flaw.

To keep system processing parameters secure, we require that engineering researchers:

The following technical tactics fall completely outside the scope of authorization under this policy and may trigger immediate suspension protocols:

This policy provides no permission or authority to enter user accounts that do not belong to your test profile, mirror or export backend customer database rows, manipulate target fields, bypass tenant security scopes, or degrade live runtime services. Researchers are required to remain completely compliant with all applicable national and regional data laws throughout their evaluations.

Unless Fluixio establishes an explicit, separate monetary bug bounty scheme via a dedicated program page, submitting an analytics file does not entitle the analyst to financial payout claims, hardware allocations, or structural compensation models. Fluixio may, at its sole discretion, choose to recognize contributions publicly on our acknowledgments index where appropriate.

All metrics, conceptual replication scripts, system endpoints, or logic logs associated with an active vulnerability submission must be kept confidential. No public information releases or social posts may be made until Fluixio patch engineers have officially resolved the anomaly and provided confirmation tracking lines.

Fluixio may adjust this Responsible Disclosure Policy occasionally to align with changing global threat criteria or security community workflows. The latest revision details deploy cleanly upon formal publishing to this page.