The following Auroranexis-controlled systems are in scope for good-faith security research under this policy:

• auroranexis.com and www.auroranexis.com (public marketing website)
• The authenticated Auroranexis web application
• Auroranexis-owned APIs operated as part of the product
• The Auroranexis customer portal

Third-party providers used by Auroranexis (for example hosting, database, billing, email, or AI providers) are not testing targets under this policy merely because Auroranexis integrates with them.

Report vulnerabilities in those providers’ own products or infrastructure to the relevant provider, unless the issue is caused by Auroranexis integration or configuration. In that case, report the Auroranexis-side issue to us.

To protect customers and service availability, the following are out of scope and prohibited without prior written authorization:

• Denial of service, traffic flooding, or any testing that materially degrades service
• Data destruction or corruption
• Social engineering, phishing, or pretexting of Auroranexis staff or customers
• Credential stuffing or brute-force password attacks
• Physical attacks against facilities, devices, or staff
• Accessing, copying, or exfiltrating data beyond the minimum necessary to demonstrate a flaw
• Changing or deleting other users’ data
• Installing persistence mechanisms, backdoors, or malware
• Attacks against third-party providers that are not Auroranexis-controlled systems
• Automated scanning that materially degrades service

Auroranexis does not intend to pursue legal action against researchers who act in good faith, comply with this policy, avoid privacy harm and service disruption, and report vulnerabilities responsibly.

This statement does not bind law enforcement or third parties, does not authorize illegal activity, and is not a waiver of rights where harm, abuse, or bad faith occurs.

The following are internal operational targets, not contractual guarantees and not statutory deadlines:

• Initial acknowledgment: within 2 business days
• Initial triage: within 5 business days
• Critical vulnerability escalation: same business day when practicable
• Status updates: at reasonable intervals for validated high-impact reports

We ask researchers not to publicly disclose vulnerability details until we have confirmed a fix or agreed a disclosure timeline.

We will work with you in good faith on coordinated disclosure. We do not offer a public bug bounty or monetary reward program at this time.

We use reporter contact details only to acknowledge, triage, and coordinate the security report. See our Privacy Policy for general personal-data practices. Security reports: security@auroranexis.com.

Canonical security contact: security@auroranexis.com

Machine-readable contact details are also published at /.well-known/security.txt.