Limited-edition tees
Sensfrx Bug Hunter shirts for validated findings, shipped within 30 days of the fix.
Find bugs before attackers do. Get credited for the report.
Sensfrx’s responsible disclosure program invites security researchers to hunt in-scope issues in our dashboard, API and marketplace plugins, then report them safely. Valid finds earn swag, public acknowledgment and a place on our Hall of Fame.
From find to reward
We partner with researchers who treat customer data and service uptime with the same care we do.
Find a bug
Hunt within scope: our apps, APIs and latest integration releases.
Report securely
Send a clear write-up to info@sensfrx.ai with steps, impact, and proof.
We verify
Our security team triages, reproduces and confirms the issue, usually within 5 business days.
Get rewarded
Valid reports earn exclusive swag, credit, and a place on our Hall of Fame.
What valid reports earn
We do not offer cash bounties today. We do make sure good research is seen and appreciated.
Security acknowledgment
Public credit for your contribution once the issue is remediated and disclosure is agreed.
Hall of Fame
A lasting shout-out on our researcher Hall of Fame for impactful, in-scope reports.
See the Hall of FameClear rules for good-faith research
Stay in scope, keep customer data untouched, and coordinate disclosure with us. That is how safe harbor works.
Domains & web applications
- Customer dashboard: dashboard.sensfrx.ai
- API endpoints: api.sensfrx.ai
Marketplace integrations
- Sensfrx WordPress plugin (latest version)
- Sensfrx WooCommerce integration
- Sensfrx WHMCS module
- Sensfrx WISECP integration
Use development environments you own or control. Never test on production systems unless they are yours.
Not covered
- Social engineering of Sensfrx employees (phishing, vishing, and similar)
- Denial of Service / DDoS or anything that degrades availability
- Third-party services we do not manage (except official integrations listed in scope)
- Rate-limiting issues unless they unlock a clear security impact
- Issues in outdated versions (only the latest releases are in scope)
Testing guidelines
- Only test accounts you own or have explicit permission to use
- Do not access, modify, or delete data that is not yours
- Do not exfiltrate data from our systems
- Do not run automated scanners that may affect availability
Data and access limits
Prove the issue with the smallest possible proof of concept, then stop. Reports that break these limits are not eligible for rewards or safe harbor.
- Do not access, view, download or keep information belonging to Sensfrx customers or their end users. If you reach it by accident, stop, delete anything you saved and tell us in your report.
- Do not access, download or try to obtain Sensfrx source code, internal repositories, credentials, API keys, tokens or other secrets.
- Do not access internal systems, admin panels, employee accounts or infrastructure beyond what is needed to show the vulnerability exists.
- Do not pivot to other systems, escalate further or keep access (no backdoors, web shells or persistence) once the issue is demonstrated.
- Do not share any data you came across with anyone, and do not use it for any purpose other than your report.
Disclosure policy
- No public disclosure before a fix is deployed and we approve timing
- Give us reasonable time to remediate
- Coordinate disclosure dates with the Sensfrx security team
Reporting requirements
- Detailed reproduction steps
- Screenshots, video, or proof-of-concept where helpful
- Clear impact and realistic attack scenarios
Immediate, broad impact
Direct harm to confidentiality, integrity or availability of customer data or Sensfrx systems, e.g. RCE or an auth bypass affecting all users.
Significant, with conditions
Serious issues that may need extra steps, e.g. SQL injection, stored XSS or CSRF with real impact.
Limited or conditional impact
Real risk with narrower reach, e.g. reflected XSS or information disclosure under specific conditions.
Minimal impact
Edge cases and minor leakage, e.g. self-XSS or low-value information exposure.
Final severity is decided by the Sensfrx security team, weighing complexity, privileges required, and business impact.
Legal safe harbor
Sensfrx will not pursue civil action or initiate a law-enforcement complaint for research conducted under this policy. If a third party starts legal action, we will clarify that your work complied with these rules when you:
- Follow this program’s scope and guidelines
- Make a good-faith effort to avoid privacy harm, data destruction, and service interruption
- Report vulnerabilities directly to us and keep them confidential until remediated
Not covered by safe harbor
- Testing that impairs or damages systems or data
- Social engineering of employees
- Physical attacks against offices, data centers, or people
- Testing systems or activities outside the stated scope
Issues we especially want to hear about
Auth flaws, injection, broken access control,
data exposure, and integration security top the list.
Domains & web apps
- Authentication bypasses
- Weak password policies
- Session management flaws
Injection
- SQL injection
- Cross-site scripting (XSS)
- Command injection
Access control
- Insecure direct object references
- Missing function-level access control
- Privilege escalation
Data exposure
- Sensitive data exposure
- Insecure API endpoints
- Information leakage
Plugin vulnerabilities
- WordPress plugin security issues
- WooCommerce integration flaws
- WHMCS / WISECP module vulnerabilities
Configuration
- Security misconfiguration
- Default credentials
- Insecure default settings
What to include in your email
Subject: [Sensfrx Bug Bounty] - [Vulnerability Type] - [Affected Component] # Vulnerability Details - Vulnerability Type: - Affected URL/Component: - Severity (Critical/High/Medium/Low): # Description [Detailed description of the vulnerability] # Impact [Potential security impact and attack scenarios] # Proof of Concept [Steps, code, screenshots, or video] # Suggested Mitigation [Optional recommendations]
Frequently asked questions
Here are a few things you might be wondering about.
Email info@sensfrx.ai with reproduction steps, impact, and supporting screenshots or video. Our security team will acknowledge and follow up.