Security

Vulnerability disclosure policy

Last updated 8 November 2026

We build security software, so we take reports about our own security seriously. If you think you've found a vulnerability, please tell us. We'll work with you to understand it and fix it.

In scope

  • dbshieldx.com and its subdomains, including the dashboard at dash.dbshieldx.com
  • the DBshieldX software (proxy, detection engine, management API and dashboard)

Out of scope: websites our customers run, even if DBshieldX protects them (report those to their owners); denial-of-service; spam or social engineering of our staff; physical attacks; and findings that need a compromised device.

How to report

Email security@dbshieldx.com with:

  • what you found and where (URL, component or version);
  • the steps to reproduce it;
  • the impact you think it has;
  • how you'd like to be credited, if at all.

Please don't include personal data you came across beyond what's needed to show the problem.

What we commit to

  • We'll acknowledge your report within 3 working days.
  • We'll tell you our assessment within 10 working days and keep you updated until it's fixed.
  • We aim to fix critical issues within 30 days and others within 90 days.
  • With your permission, we'll credit you once the fix is released.

Testing in good faith

If you follow this policy, we won't take legal action against you or ask anyone else to, and we'll treat your research as authorised. We ask that you:

  • only access what you need to show the problem, and don't change or delete data;
  • don't degrade our services: no denial-of-service and no high-volume automated scanning;
  • stop and tell us straight away if you reach personal or customer data;
  • give us reasonable time to fix the issue before you publish anything.

We don't run a paid bug bounty at the moment.

Machine-readable contact details: /.well-known/security.txt