11x Responsible Disclosure & Bug Bounty Policy 11x welcomes reports from security researchers who help us protect our customers. This policy explains how to report vulnerabilities, what is in scope, and the protections and rewards we provide to good-faith researchers. --- How to Report Please email security@11x.ai with the following details: - A clear description of the issue and its potential impact - Steps to reproduce (proof of concept, screenshots, or minimal script) - The affected URL, endpoint, or component - Any accounts, IPs, or timestamps used during testing - Your name or handle (if you would like to be credited) Optional (recommended): - Suggested remediation - Assessment of severity We aim to: - Acknowledge receipt within 2 business days - Provide a status update within 10 business days Please allow a reasonable remediation window (typically 90 days) before any public disclosure. --- Scope In Scope: - *.11x.ai (web properties and APIs) - The Alice and Julian applications (our customer-facing AI agents and associated dashboards) - Authentication and authorization flaws - Data isolation and multi-tenant boundary issues - Vulnerabilities that could expose customer data or enable account takeover Out of Scope: - Denial-of-service (DoS), volumetric testing, or load testing - Social engineering of employees, customers, or vendors - Physical attacks against offices or infrastructure - Attacks requiring physical access to a device - Issues in third-party services we use, unless you can demonstrate impact on 11x systems or data - Automated scanner findings without demonstrated impact - Missing security headers, cookie flags, or best-practice deviations without demonstrable security impact - Rate-limiting issues without demonstrated abuse impact - Self-XSS or issues requiring an already-compromised browser - Email spoofing or SPF/DKIM/DMARC issues without an exploitable path --- Rules of Engagement - Test only against accounts you own or have explicit permission to use - Do not access, modify, or retain data belonging to other users - Do not disrupt or degrade service availability - Stop testing immediately and notify us if you encounter sensitive or personal data - Do not exfiltrate, store, or share sensitive data beyond what is strictly necessary to demonstrate the issue - Do not use findings for any purpose other than responsible disclosure Permitted testing includes: - Authentication and authorization testing - Input validation testing (e.g., XSS, injection vulnerabilities) - Business logic and privilege escalation testing - API misuse and data exposure analysis --- Safe Harbor 11x will not pursue legal action against researchers who: - Act in good faith and follow this policy - Avoid privacy violations, service disruption, and data destruction - Report vulnerabilities promptly - Do not disclose findings publicly before remediation is agreed This safe harbor applies only to activities conducted in accordance with this policy and does not extend to actions that violate applicable laws. --- Rewards 11x offers discretionary monetary rewards for eligible vulnerability reports. Reward amounts are determined based on severity, impact, exploitability, and report quality. Rewards typically range from $100 to several thousand dollars, with higher rewards for critical findings. Eligibility: - Follow this policy and act in good faith - Be the first to report the vulnerability - Provide clear reproduction steps and demonstrated impact - Report a vulnerability within scope Rewards are discretionary and subject to program budget. --- Recognition With your permission, we may: - Publicly acknowledge your contribution - Include you in a future Security Hall of Fame --- Final Notes We appreciate the work of the security community in helping keep 11x and our customers safe. Responsible disclosure helps us fix issues quickly and improve our systems for everyone.