Security Disclosure

Found a vulnerability in GuardX? Tell us. We would rather hear it from you first.

How to report

Email support@guardx.fr with the subject “Security report”. Include what you found, the steps to reproduce it, the affected host or endpoint, and the impact you see. Screenshots, requests and proof-of-concept code help. Please write in English or French.

What to expect

We acknowledge your report and keep you informed while we investigate and fix it.
We will not take legal action against you for research done in good faith under the rules below.
We are glad to credit you once the issue is fixed, if you wish.

We do not run a paid bug bounty at this time.

Rules

Test only against accounts and domains that you own or that you created for the test.
Do not access, change or delete other customers’ data. If you reach it by accident, stop and tell us.
No denial-of-service testing, no volumetric traffic, no social engineering or physical attacks, and no automated scanning that degrades the service.
Give us a reasonable time to fix the issue before sharing details publicly.

In scope

guardx.fr, dashboard.guardx.fr and the GuardX proxy itself: authentication, session handling, access control between customers, injection, certificate and key handling, and ways to bypass the protection. Findings in third-party services we use should be reported to those providers.

Out of scope

Missing best-practice headers with no demonstrated impact, reports from automated scanners without a working proof, spam and email-configuration issues, and attacks that need a compromised device.