Adxe accepts reports of security vulnerabilities in the systems it operates. This policy sets out where to send a report, what is in scope, the conditions research must meet, and the protection extended to research that meets them.
How to report
Send reports to hello@adxe.com with “Security” in the subject line. A report must include:
- The affected host, endpoint or component.
- The nature of the issue and what an attacker could achieve with it.
- Steps to reproduce it — a proof of concept, request log or short recording.
- Any account, token or identifier used during testing, so the activity can be located in the logs.
Reports must be in English. Report as soon as an issue is identified rather than on completion of a full exploit chain. You must not open a public issue, publish, or disclose the issue to any third party before Adxe has remediated it.
Scope
Systems operated by Adxe and covered by this policy:
- adxe.com and www.adxe.com — this website.
- app.adxe.com — the advertiser platform, and the APIs behind it.
- tracker.adxe.com and the measurement pixel it serves.
- assets.adxe.com and the creative assets it delivers.
- Our ad-serving endpoints and the advertising markup they return.
Out of scope
- Denial of service, volumetric testing, load testing, or anything that degrades service for other people.
- Social engineering, phishing or physical attacks against our staff, our offices or our suppliers.
- Findings in third-party services we merely use, including our payment processor and the provider that handles this site’s contact form. Report those to the provider.
- Vulnerabilities in an advertiser’s own website, even where our pixel is installed on it. Those belong to the advertiser.
- Missing security headers, cookie flags, TLS configuration opinions, or email authentication records, without a demonstrated exploit.
- Self-XSS, clickjacking on a page with no state-changing action, and issues that need a fully compromised or rooted device.
- Version-number reports and raw scanner output with no working proof of impact.
- Absence of rate limiting on an endpoint, without a demonstrated consequence.
Safe harbour
Research conducted in compliance with this policy is authorised. Adxe will not pursue legal action in respect of it, will not refer it to law enforcement, and where a third party brings action arising from research that remained within this policy, Adxe will confirm that the research was authorised. Authorisation extends only to activity within the scope and conditions stated here.
Research outside those conditions — including data extraction, service disruption, extortion, or disclosure before remediation — is unauthorised, is not covered by this safe harbour, and Adxe reserves all rights in respect of it.
Adxe’s response
- Reports are acknowledged within three business days.
- Within ten business days Adxe advises whether the issue has been reproduced and its assessed severity.
- Adxe provides updates until the report is closed, including when remediation ships.
- Public credit is offered on remediation where the reporter requests it.
Adxe does not operate a paid bug bounty. Reports are handled directly by the engineering team, and no payment is made for a valid finding. Severity assessment and remediation timing are determined by Adxe.
Related documents
Acceptable use of this website is governed by the Terms of Use. Handling of personal information is described in the privacy policy.