Vulnerability Disclosure Policy | norxs

At norxs, the safety and security of our automotive engineering solutions and platforms are our highest priorities. We value the work of security researchers and believe that a responsible disclosure process is critical to maintaining a secure ecosystem.

1. Reporting Channels

If you believe you have found a security vulnerability on norxs.com or within our digital services, please report it to us by emailing:

security@norxs.com

We encourage you to use our PGP key (available at norxs.com/pgp-key.txt) to encrypt any sensitive information sent via email.

2. Scope

This policy applies to:

*.norxs.com (Main website and subdomains)
Publicly accessible dashboards and APIs provided by norxs.

Third-party services used by norxs (such as email providers or hosting platforms) are excluded from this scope unless a vulnerability in those services directly impacts norxs data.

3. Responsible Disclosure Guidelines

To qualify for "Safe Harbor" protection, we ask that you:

Provide a detailed summary of the vulnerability, including proof-of-concept steps.
Give us a reasonable amount of time to remediate the issue before any public disclosure.
Avoid privacy violations, destruction of data, and interruption or degradation of our services.
Do not perform social engineering, spam, or physical attacks against our infrastructure or employees.

Safe Harbor Statement

If you conduct your research in accordance with this policy, norxs will not initiate legal action against you and will not support any law enforcement investigation related to your research. We consider your research to be authorized and helpful to the community.

4. Our Commitment

If you report a vulnerability, we commit to:

Acknowledge receipt of your report within 3 business days.
Provide an estimated timeframe for resolution.
Notify you when the vulnerability has been fixed.