Responsible disclosure policy

• The Codexa web application and HTTP API.
• The runner service, sandbox isolation, and the preview and hosting proxies.
• The realtime (WebSocket) service.
• Out of scope: third-party providers (GitHub, Anthropic, OpenAI, Stripe, Razorpay, Resend, Vercel, E2B), applications deployed by Codexa users, social engineering, and physical attacks.

• Test only against accounts and projects you own.
• Do not access, modify, or delete other users' data; if you encounter it, stop and report.
• No denial of service, resource exhaustion, or automated scanning that degrades the service.
• Give us a reasonable time to fix the issue before public disclosure; we aim for 90 days.

Use the vulnerability reporting form or email security@codexa.app. Include steps to reproduce, affected URLs or components, and the impact you believe is possible. Please do not include other people's data in the report.

• Acknowledgement within 5 business days.
• An assessment of severity and a fix timeline where the report is valid.
• Credit on this page if you wish, once the issue is fixed.
• We do not run a paid bug bounty at this time and cannot offer monetary rewards.