Rox Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: false
source: https://www.rox.com/vulnerability-disclosure-policy
policy:
- https://www.rox.com/vulnerability-disclosure-policy
contact:
- security@rox.com
bug_bounty: false
bug_bounty_note: >-
  Rox does not operate a paid bug bounty program but states it is committed to
  acknowledging meaningful contributions.
scope:
  in_scope:
  - run.rox.com
  eligible_vulnerabilities:
  - Remote Code Execution
  - SQL Injection
  - Server-Side Request Forgery (SSRF)
  - Cross-Site Scripting (XSS)
  - Cross-Site Request Forgery (CSRF)
  - Authentication bypass
  - Privilege escalation
  - File inclusion
  - Directory traversal
  - Data leakage
  - Unauthenticated admin portals
  out_of_scope:
  - Non-production domains (dev.rox.com)
  - Social engineering / phishing
  - Brute force
  - DDoS
  - Man-in-the-middle attacks
  - Self-XSS, clickjacking, missing headers, theoretical findings
safe_harbor: >-
  Researchers must give Rox reasonable time to investigate and remediate before
  public disclosure, stop at proof of concept, act in good faith to avoid
  privacy violations and service disruption, and stay within the law.
evidence:
- source: https://www.rox.com/vulnerability-disclosure-policy
  kind: disclosure-policy