Vulnerability Disclosure Policy

1. Introduction

At AriseCX, the security of our systems and our users' data is a top priority. We welcome and appreciate the efforts of security researchers who help us improve our security posture by reporting vulnerabilities.

2. Safe Harbor

We consider activities conducted consistent with this policy to constitute "authorized" conduct. We will not initiate legal action against you for accessing or attempting to access our systems if you comply with this policy.

3. Reporting Guidelines

If you believe you have discovered a potential vulnerability, please adhere to the following guidelines:

• Do not exploit the vulnerability to access, modify, delete, or exfiltrate data.
• Do not perform attacks that could degrade our services (e.g., DoS/DDoS).
• Submit your report to hello@arisecx.com.
• Include detailed steps to reproduce the vulnerability, including screenshots or video if possible.

4. Out of Scope

The following types of vulnerabilities are generally out of scope:

• Social engineering (e.g., phishing) of AriseCX staff or customers.
• Physical security attacks against AriseCX property or data centers.
• Vulnerabilities requiring physical access to a user's device.
• Self-XSS or issues requiring unlikely user interaction.

Frequently Asked Questions