Domains & Web Applications
Domains & Web Applications
Customer dashboard (dashboard.sensfrx.ai)
API endpoints (api.sensfrx.ai)
Marketplace Integrations
Sensfrx WordPress plugin (latest version)
Sensfrx WooCommerce integration (latest
version)
Sensfrx WHMCS module (latest version)
Sensfrx WISECP integration (latest
version)
Note: When testing integrations, please use development environments only. Never
test on production systems unless you own them.
Social engineering attacks
Attacks targeting Sensfrx employees through phishing, vishing, or other social engineering
techniques.
Denial of Service (DoS/DDoS)
attacks
Any testing that impacts the availability of our services or causes degradation of service.
Third-party services
Services not directly managed by Sensfrx (except for our official integrations listed in
scope).
Rate limiting issues
Unless they directly lead to another vulnerability with security impact.
Vulnerabilities in outdated
versions
Only the latest versions of our software and integrations are in scope.
Testing Guidelines
Only test against accounts you own or have
explicit permission to test
Do not access, modify, or delete data that
does not belong to you
Do not attempt to exfiltrate data from the
systems
Do not use automated scanners that may
affect system availability
Disclosure Policy
Do not disclose any vulnerability to the
public or third parties before it has been fixed and approved for disclosure
Provide a reasonable time for remediation
before any disclosure
Coordinate disclosure timing with the
Sensfrx security team
Reporting Requirements
Provide detailed reproduction steps that
allow us to replicate the vulnerability
Include screenshots, videos, or proof of
concept code where applicable
Explain potential security impact and
attack scenarios
Critical
Vulnerabilities that cause a direct and immediate impact on the confidentiality, integrity,
or availability of customer data or Sensfrx systems. Examples: Remote code execution,
authentication bypass affecting all users.
High
Vulnerabilities that have a significant impact but may require additional steps or specific
conditions. Examples: SQL injection, stored XSS in commonly used features, CSRF with
significant impact.
Medium
Vulnerabilities that have some security impact but are limited in scope or require unlikely
conditions. Examples: Reflected XSS with limited impact, sensitive information disclosure
affecting limited users.
Low
Vulnerabilities with minimal security impact or requiring highly specific conditions.
Examples: Self-XSS, CSRF with minimal impact, minor information leakage.
Note: Final severity determination is at the discretion of the Sensfrx security
team. We consider factors such as attack complexity, required privileges, and potential business
impact.
Legal Safe Harbor
Sensfrx provides safe harbor for security researchers who:
Engage in security research in accordance
with this policys
Make a good faith effort to avoid privacy
violations, destruction of data, and interruption or degradation of our services
Report vulnerabilities directly to us and
keep information about discovered vulnerabilities confidential until we remediate them
We will not pursue civil action or initiate a complaint to law enforcement for security
research conducted in accordance with this policy. If legal action is initiated by a third
party against you for activities that were conducted in accordance with this policy, we will
make it clear that your actions were conducted in compliance with this policy.
Out of Scope Activities
The following activities are not covered by the safe harbor provisions:
Testing that impairs or damages
the systems
or data
Social engineering attacks
against our
employees
Physical attacks against our
offices, data
centers, or employees
Testing of systems or
activities not
covered in the scope
