Book a Deep Dive
EN | DE

PXL Vision AG:
Vulnerability Disclosure Policy

Version 1.0

Scope

This policy covers all internet-facing digital services operated by PXL Vision AG, including systems accessible under pxl-vision.com and associated subdomains.


Our commitment

PXL Vision AG is committed to the security of our products and the protection of our customers' data. We welcome reports from security researchers who identify vulnerabilities  in our systems in good faith.

How to report

Please send vulnerability reports to: security@pxl-vision.com

Include as much detail as possible: a description of the vulnerability, steps to reproduce it, your assessment of its potential impact, and any suggested remediation.



RULES OF ENGAGEMENT To qualify for safe harbor, we ask that you:

Check Icon
Avoid Privacy Violations

If you accidentally encounter Personally Identifiable Information (PII), stop immediately and report the finding without further access.

Check Icon
No Disruptions

Do not perform Denial of Service (DoS) attacks or disrupt our services.

Check Icon
No Social Engineering
Do not target PXL Vision employees or customers.
Check Icon
Confidentiality
Do not disclose findings to third parties or the public until we have had a reasonable opportunity to remediate
(we ask for 120 days from the initial report).
Information Security - PXL Vision

Non-Qualifying Issues

To keep our security efforts focused on high-impact vulnerabilities, the following are considered out-of-scope and will typically not be acknowledged unless they lead to a direct exploit:

  • Best Practice/Configuration: Missing security headers (e.g., CSP, HSTS, X-Frame-Options) or "best practice" DNS records (e.g., missing or "softfail" SPF/DMARC/DKIM).
  • Informational Disclosure: Server version strings, descriptive error messages, or publicly accessible files that do not contain sensitive data (e.g., robots.txt).
  • Low-Impact Web Vulnerabilities: Logout CSRF, clickjacking on pages without sensitive actions, or lack of secure/HTTP-only flags on non-sensitive cookies.
  • Automated Scans: Reports generated solely by automated tools or scanners without a manual Proof-of-Concept (POC).

Safe harbour

Provided that you follow this policy, we will consider your research to be authorised and will not pursue legal action against you.



What to expect from us

Acknowledgement

We will acknowledge receipt of your report
within 20 business days.

Triage
We will investigate and aim to keep you informed about the progress.
Notification

We will notify you once the vulnerability has been remediated.

Recognition
With your consent, we will acknowledge your contribution on our public acknowledgements page.

Non-Compensation

This is not a "Bug Bounty" program. PXL Vision AG does not offer financial rewards for reports at this time.