Security

Responsible Disclosure

We take the security of our systems and our clients' data seriously. If you've discovered a vulnerability, we want to hear from you — and we'll work with you to resolve it quickly.

Report a vulnerability

Acknowledge within 3 business days

Every report is reviewed by our security team. You'll receive a direct response — not an auto-reply — with next steps.

What happens next

1
We acknowledge within 3 days
You'll receive a confirmation that your report has been received and assigned to our security team.
2
We investigate & triage
We reproduce the issue, assess its severity, and determine the fix timeline — typically within 10 business days.
3
We fix and disclose
Once resolved, we publish a summary here (with your credit if you'd like) and notify you of the outcome.

Or email us directly

security@galaxen.co

Our commitments

We will not take legal action against good-faith researchers.

We will keep your identity confidential unless you agree to be credited.

We will notify you when the vulnerability is resolved.

Out of scope: DoS attacks, social engineering, physical attacks, and findings in third-party services we do not control.

Transparency

Disclosed Vulnerabilities

We publicly disclose resolved vulnerabilities to promote transparency and help the wider security community.

SeverityVulnerabilityAreaReportedStatus

Medium
Reflected XSS in contact form error message
Unsanitised query parameter was reflected in a validation error message, allowing script injection via a crafted URL.
Website (galaxen.co)
12 Apr 2026
Fixed
Low
Open redirect on post-authentication callback
The redirect_to parameter after login was not validated against an allowlist, enabling phishing via a redirect to an external domain.
Client Portal
28 Apr 2026
Fixed
High
API rate-limiting bypass via header spoofing
Forwarding the X-Forwarded-For header to a loopback address circumvented per-IP rate limits on the public API.
API
3 Jun 2026
Investigating

Prefer to email?

Send encrypted reports directly to our security team.

security@galaxen.co