---
title: Bug Bounty & Vulnerability Disclosure Policy | Xquik
description: Report a security bug in Xquik by email. Read the scope, test rules, safe harbor & response times. Rewards can be monetary & depend on the bug's impact.
canonical: https://xquik.com/en/vulnerability-disclosure
language: en
last-updated: 2026-11-08
---

# Bug Bounty & Vulnerability Disclosure Policy

Xquik runs a bug bounty under this responsible disclosure policy. Rewards can be monetary & depend on the bug's impact. See past reporters on our [security acknowledgments](https://xquik.com/en/security-acknowledgments) page.

## Report a security issue

Email [support@xquik.com](mailto:support@xquik.com) with the subject "Security report". Include the affected URL, impact, reproduction steps & supporting evidence. Remove secrets & unrelated personal data before sending the report.

## What you can test

- xquik.com
- dashboard.xquik.com
- docs.xquik.com
- The public Xquik API, webhooks, OAuth, SDKs & MCP server

## Out of scope

- Third-party services, X (Twitter) included
- Customer-managed endpoints, such as a customer's webhook server
- Other customers' accounts & data

## How to test safely

- Test only with accounts you own, on Xquik & on X (Twitter).
- Keep automated traffic low & stay within our published rate limits.
- Don't run denial of service, load or stress tests.
- Don't send spam or act on anyone else's X (Twitter) account.
- Don't access other customers' data. If you reach it, stop & tell us.
- Don't use social engineering or phishing.
- Avoid privacy violations, data loss & degraded service.
- Report the issue promptly & keep it confidential during review.
- These rules also cover any AI agent or scanner you run.

## Safe harbor

On Xquik-owned services, Xquik authorizes research that follows this policy. That research doesn't breach our Terms of Service. Xquik will not pursue legal action for accidental good-faith violations. This policy does not authorize access to third-party systems or data.

## Response times

- We send a first reply within 3 business days.
- We share a triage result within 14 days.
- We may ask for more evidence or reproduction details.
- We send you major updates on the fix when we can.

## Rewards

Rewards can be monetary. The amount depends on the bug's impact, & Xquik decides it. Not every report earns a reward.

We reward only new, reproducible, in-scope issues with real impact. We don't reward scanner output, unverified AI output, missing headers or best-practice notes. Issues that need a compromised device or account don't qualify.

With your consent, we also credit confirmed reports by name.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.