Bug Bounty & Vulnerability Disclosure Policy

Report a security issue

Email support@xquik.com with the subject "Security report". Include the affected URL, impact, reproduction steps & supporting evidence. Remove secrets & unrelated personal data before sending the report.

What you can test

• xquik.com
• dashboard.xquik.com
• docs.xquik.com
• The public Xquik API, webhooks, OAuth, SDKs & MCP server

Out of scope

• Third-party services, X (Twitter) included
• Customer-managed endpoints, such as a customer's webhook server
• Other customers' accounts & data

How to test safely

• Test only with accounts you own, on Xquik & on X (Twitter).
• Keep automated traffic low & stay within our published rate limits.
• Don't run denial of service, load or stress tests.
• Don't send spam or act on anyone else's X (Twitter) account.
• Don't access other customers' data. If you reach it, stop & tell us.
• Don't use social engineering or phishing.
• Avoid privacy violations, data loss & degraded service.
• Report the issue promptly & keep it confidential during review.
• These rules also cover any AI agent or scanner you run.

Safe harbor

On Xquik-owned services, Xquik authorizes research that follows this policy. That research doesn't breach our Terms of Service. Xquik will not pursue legal action for accidental good-faith violations. This policy does not authorize access to third-party systems or data.

Response times

• We send a first reply within 3 business days.
• We share a triage result within 14 days.
• We may ask for more evidence or reproduction details.
• We send you major updates on the fix when we can.

Rewards

Rewards can be monetary. The amount depends on the bug's impact, & Xquik decides it. Not every report earns a reward.

We reward only new, reproducible, in-scope issues with real impact. We don't reward scanner output, unverified AI output, missing headers or best-practice notes. Issues that need a compromised device or account don't qualify.

With your consent, we also credit confirmed reports by name.