Legal, Last updated: 2026-10-27

Responsible Disclosure.

Good-faith security research is welcome. Here is what is in scope, the rules of engagement, our safe-harbor, and how to send us a finding.

Effective date: 2026-10-27.

wrxstack believes security is a collaboration. We invite security researchers to help us keep our users safe through coordinated disclosure under the rules below. This page is also referenced from /.well-known/security.txt.

1. Scope

In scope

  • wrxstack.com (the marketing site), atlas.wrxstack.com (Atlas), and portfolio.wrxstack.com (Folio, the portfolio and personal-site builder), and their supporting API and authentication endpoints.

Out of scope

  • Any subdomain or service operated by a third party on our behalf;
  • Social-engineering attacks against any person (including phishing, vishing, smishing);
  • Denial-of-service, volumetric, or stress testing;
  • Spam, content-injection, or self-XSS issues that require unrealistic user interaction;
  • Issues that require a rooted, jailbroken, or otherwise compromised end-user device;
  • Best-practice or hardening suggestions that are not a vulnerability (for example, a missing HTTP header where no exploit path exists).

2. Rules of engagement

  • Test only against accounts you own or are authorized to test;
  • Do not access, modify, or destroy data that does not belong to you. If you encounter data that does not belong to you, stop testing and report immediately;
  • Do not run automated scans that generate meaningful traffic without prior coordination;
  • Do not publicly disclose a finding before we have had a reasonable opportunity to remediate (typically 90 days). We may work with you on coordinated disclosure timing for high-impact findings;
  • Comply with all applicable laws.

3. Safe harbor

If we are satisfied that you made a good-faith effort to comply with this Policy during your security research, we:

  • consider your research to be authorized by wrxstack, for the purposes of the Computer Fraud and Abuse Act ("CFAA"), the DMCA anti-circumvention provisions for the purpose of accessing the work, and similar laws, to the extent they would otherwise restrict your activity against our own systems;
  • do not intend to bring a legal claim against you for that research;
  • aim to work with you to understand and resolve the issue, and may publicly recognize your contribution if you wish.

This safe harbor covers only research that follows this Policy. It does not authorize activity that is otherwise illegal, that violates the rights of third parties, or that violates the AUP, it does not bind any third party, including our service providers or a law enforcement agency, and it does not limit our right to protect the Service, our users, or wrxstack against conduct outside this Policy. If in doubt, contact us before testing.

4. No monetary reward

We do not operate a paid bug bounty and we do not pay monetary rewards for reports. We are grateful for good-faith research and, with your permission, may credit you if we publicly acknowledge a fix.

5. How to report

Email security@wrxstack.com and include:

  • A clear description of the issue and the impact;
  • Steps to reproduce, with a proof of concept where possible;
  • The affected URL or endpoint;
  • The account you tested with;
  • Your preferred contact channel and pseudonym (if any) for credit.

This Policy explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.

Timelines and targets in this Policy are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Policy increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Policy describes. Nothing in this Policy limits a right you have under a law that cannot be limited by agreement.

7. Contact

For any question about this Policy, contact security@wrxstack.com.