Rox · Vulnerability Disclosure

Rox Vulnerability Disclosure

Vulnerability disclosure

Rox publishes a vulnerability disclosure policy for reporting security issues. A dedicated security contact is published.

CompanyArtificial IntelligenceAI AgentsSalesRevenue OperationsGo-to-MarketCRMSales IntelligenceEnterpriseRevenue Intelligence
Program:

Disclosure Policy

Policy
https://www.rox.com/vulnerability-disclosure-policy

Security Contact

Contact
security@rox.com

Source

Vulnerability Disclosure

rox-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-07-21'
method: searched
probe: false
source: https://www.rox.com/vulnerability-disclosure-policy
policy:
- https://www.rox.com/vulnerability-disclosure-policy
contact:
- security@rox.com
bug_bounty: false
bug_bounty_note: >-
  Rox does not operate a paid bug bounty program but states it is committed to
  acknowledging meaningful contributions.
scope:
  in_scope:
  - run.rox.com
  eligible_vulnerabilities:
  - Remote Code Execution
  - SQL Injection
  - Server-Side Request Forgery (SSRF)
  - Cross-Site Scripting (XSS)
  - Cross-Site Request Forgery (CSRF)
  - Authentication bypass
  - Privilege escalation
  - File inclusion
  - Directory traversal
  - Data leakage
  - Unauthenticated admin portals
  out_of_scope:
  - Non-production domains (dev.rox.com)
  - Social engineering / phishing
  - Brute force
  - DDoS
  - Man-in-the-middle attacks
  - Self-XSS, clickjacking, missing headers, theoretical findings
safe_harbor: >-
  Researchers must give Rox reasonable time to investigate and remediate before
  public disclosure, stop at proof of concept, act in good faith to avoid
  privacy violations and service disruption, and stay within the law.
evidence:
- source: https://www.rox.com/vulnerability-disclosure-policy
  kind: disclosure-policy