Security.

XSource Security runs coordinated disclosure with vendors as a reporter, and holds itself to the same standard as a recipient. If you have found a security issue in this website or in anything XSource publishes, this page says how to report it and what happens next.

How to report

Email eva@xsourcesec.com. Include enough detail to reproduce the issue: the affected URL or component, the steps, and what an attacker gains. A short proof of concept is worth more than a scanner output.

What you can expect

• An acknowledgement within 3 working days, from a person, not an autoresponder.
• An assessment with a plain verdict within 10 working days: accepted, not a vulnerability, or already known, with the reasoning either way.
• Progress updates until the issue is resolved, without you having to chase.
• Credit under whatever name you choose, unless you would rather stay anonymous.

Scope

In scope: xsourcesec.com and its subdomains, and any software or document published under the XSource Security name.

Out of scope: findings from automated scanners with no demonstrated impact, missing hardening headers that do not lead anywhere, rate limiting on unauthenticated endpoints, social engineering, physical attacks, denial of service, and reports about third-party services this site uses rather than about this site.

Safe harbour

If you make a good-faith effort to follow this policy, XSource Security will not pursue or support legal action against you for your research. Stay within the scope above, do not access, modify or destroy data that is not yours, do not degrade the service for others, and give a reasonable window to fix the issue before disclosing it publicly. If a third party brings action against you for research conducted under this policy, XSource Security will make it known that your work was authorised.

Disclosure

Coordinated disclosure is the default: the issue is fixed first, then published. A 90-day window from acknowledgement is the normal timeline, extended by agreement where a fix genuinely needs longer, and shortened where the issue is already public or actively exploited. You are welcome to publish your own write-up once the fix has shipped.

Rewards

XSource Security is a one-person business and does not run a paid bounty. What is offered is a fast, honest response, public credit, and a write-up that says plainly what you found. If that is not worth your time, that is a fair call to make.

Machine-readable policy

This policy is referenced from /.well-known/security.txt, per RFC 9116.

Last updated: September 2026.