Erxes Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://github.com/erxes/erxes/blob/main/SECURITY.md
note: >-
  0-working/probe-security-programs.py reported vdp=none, because erxes serves
  no /.well-known/security.txt and no /security page — erxes.io returns the
  Next.js error boundary (HTTP 500) for every /.well-known/* path. The policy
  is nonetheless real and provider-published: SECURITY.md at the root of the
  erxes open-source monorepo states the reporting address and a disclosure
  timeline. That is a genuine published vulnerability-disclosure policy, so the
  artifact and the `Security` pointer are emitted; the SecurityTxt and
  WellKnown pointers are NOT, because no /.well-known/ document exists.
policy:
  - https://github.com/erxes/erxes/blob/main/SECURITY.md
contact:
  - info@erxes.io
disclosure_timeline_days: 90
reporting_instructions: >-
  Email info@erxes.io with a description of the issue, the steps taken to
  create it, affected versions, and, if known, mitigations.
bug_bounty:
  program: false
  platform: null
  note: 'No HackerOne, Bugcrowd or Intigriti program found.'
security_txt:
  served: false
  probed_paths:
    - {url: 'https://erxes.io/.well-known/security.txt', status: 500}
    - {url: 'https://www.erxes.io/.well-known/security.txt', status: 404}
    - {url: 'https://docs.erxes.io/.well-known/security.txt', status: 404}
    - {url: 'https://demo.next.erxes.io/.well-known/security.txt', status: 200, note: 'SPA shell, not a document'}
supporting_practices:
  note: >-
    Not a disclosure policy, but evidence the project runs security tooling in
    the open — recorded because it is verifiable from the public repositories.
  items:
    - 'Semgrep runs in CI on erxes-cli (.github/workflows/semgrep.yml).'
    - 'A github-actions-security rule is part of the published .agents/rules set in erxes-dev-skills.'
    - 'The erxes agent plugin ships a redaction module (lib/redact.mjs) and a no-secret-leak test suite; the AI assistant gateway ships src/security/secretGuard.ts with a matching test.'
    - 'The automation webhook router mounts helmet with CSP default-src none, frame-ancestors none, and HSTS max-age 31536000 includeSubDomains preload.'
evidence:
  - {source: 'https://github.com/erxes/erxes/blob/main/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-08-13'}
  - {source: 'https://erxes.io/.well-known/security.txt', kind: security.txt, http_status: 500, fetched: '2026-08-13'}
gaps:
  - 'No RFC 9116 security.txt on any erxes host.'
  - 'The reporting address is a general info@ inbox, not a dedicated security@ alias.'
  - 'No safe-harbor language, no scope statement, and no severity/response SLA beyond the 90-day disclosure timeline.'