Nux s.r.o. CSIRT

Scope – what is in scope for testing

Responsible testing scope includes:

• Production services (web applications, APIs) operated by Nux s.r.o.
• Systems that are publicly available from the internet and clearly belong to Nux s.r.o. If you are unsure about the nature of a specific system, please contact us before starting testing.

Out of Scope

• Development, testing, or staging environments
• Subdomains without active services
• Third-party systems (hosting, CDN, SaaS providers)
• Cloud infrastructure operated by a third party outside the direct management of Nux s.r.o.
• Employee email accounts
• OSINT findings without real security impact

Prohibited Activities

Without prior written consent from CSIRT Nux, it is prohibited to:

• DoS / DDoS attacks or intentional overloading of infrastructure
• High-intensity automated scanning that may affect service availability
• Social engineering against employees or partners
• Attempts at physical access to company premises
• Intentional exfiltration, deletion, or modification of data
• Access to other customers' data
• Testing outside the defined scope

Testing must be conducted in a manner that minimizes impact on service availability and integrity.

What we typically do not consider a vulnerability

• Missing security headers without demonstrable exploitability
• Server version disclosure
• SPF / DKIM / DMARC misconfiguration without exploitability
• Self-XSS
• Clickjacking without sensitive context
• Rate limiting issues without real impact
• Best practice recommendations without a specific exploit

How to report a vulnerability

The report should include:

• Detailed description of the vulnerability
• Steps to reproduce
• Expected vs. actual behavior
• Impact on security (confidentiality / integrity / availability)
• Optional PoC (without disclosing sensitive data)

Safe Harbor

If you act in good faith, within the defined scope, and without causing intentional damage, Nux s.r.o. will not take legal action against you and will work with you to remediate the vulnerability.

Coordinated Disclosure

• Report acknowledgment: within 48 hours
• Initial assessment: within 5 working days
• Standard remediation and disclosure time: 90 days
• Public disclosure of the vulnerability is possible only after mutual agreement.

Rewards

Nux s.r.o. may grant a financial reward for significant security vulnerabilities. The reward is determined individually based on severity (CVSS), impact, and report quality.

We reserve the right not to award a bounty if the vulnerability does not meet the program criteria.