Security & disclosure
We welcome good-faith security research on fortoxa.com and the FORTOXA services, and we want reports to reach a human quickly.
How to report
Open the vulnerability report form
The form above is the channel that reaches the team for security reports. General enquiries can go to sales@fortoxa.com. The disclosure route is the same one we publish machine-readably in /.well-known/security.txt.
Please include: the affected URL or component, reproduction
steps, what you observed, and the impact you believe it has. A working proof
of concept helps us triage far faster than a scanner screenshot.
What is in scope
fortoxa.com— the public website and its served assets- FORTOXA-operated application endpoints reachable from the internet
- Authentication, authorisation and data-exposure flaws in those services
Out of scope
- Reports produced only by an automated scanner with no demonstrated impact
- Theoretical findings with no reproducible effect on a running service
- Vulnerabilities in third-party platforms we do not operate
- Denial of service, social engineering, and physical attacks
Our commitments
- We acknowledge reports within 3 working days.
- We tell you whether we consider the issue in scope, and keep you updated through remediation.
- We will not pursue or support legal action against research that is good-faith, avoids privacy violations and data destruction, and does not disrupt service.
Machine-readable
Our disclosure policy is published in RFC 9116 format at /.well-known/security.txt.