Legal
Vulnerability Disclosure Policy
Last updated: September 26, 2026
If you think you have found a security vulnerability in Axiospec, please tell us. This page explains how to report it and what to expect.
How to report
Email support@axiospec.com with the word Security in the subject line. Please include:
- what you found, and where: the page, the API endpoint or the app version
- the steps to reproduce it
- what an attacker could do with it, as far as you know
- how to reach you, if you want a reply
Our security contact is also published in machine-readable form at /.well-known/security.txt.
Scope
This policy covers axiospec.com, the Axiospec web application and its API, and the Axiospec apps for iOS and Android. It does not cover the services of our subprocessors, such as Amazon Web Services, Stripe or Google. Report those to the company concerned.
What we ask of you
- Test only with your own account, or with a free account you create for the purpose. Do not access, change or delete data that belongs to anyone else.
- If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
- Do not run denial of service tests, send spam, or use social engineering or physical attacks.
- Give us reasonable time to fix the problem before you share details with anyone else.
What we do
- We confirm that we received your report.
- We look into it and tell you what we found.
- We work on a fix for a confirmed vulnerability and tell you when the fix is live.
We do not pay rewards for reports.
We will not take legal action against research that follows this policy in good faith.
Translation Interpretation
This page may have been translated. The original English text shall prevail in the case of a dispute.