Security Disclosure Policy

1. Scope

• The ixcdn.com and www.ixcdn.com websites, the tenant console, the operator console and the node affiliate portal.
• The control plane API (/api, /api/v1) and the HTTP/HTTPS and DNS services exposed by edge nodes.
• Node binaries published by IXCDN (em-edge and others).

Out of scope: customer origins and customer content; third-party services such as Stripe; social engineering, phishing and physical intrusion; denial of service and load testing; issues affecting only outdated browsers; non-exploitable reports such as missing security headers or version disclosure.

2. How to report

Email support@ixcdn.com with a subject starting [Security]. Include where possible the affected URL or component, reproduction steps, an impact assessment and screenshots or request/response samples. If sensitive data is involved, describe only its type and extent first; we will provide an encrypted channel.

Do not disclose unfixed vulnerabilities publicly (issues, social media, blogs).

3. Testing rules

• Test only against your own account, domains and data; never access, modify or delete other users' data. If you may have reached someone else's data, stop immediately and report.
• No denial of service, traffic flooding, brute force or automated scanning that affects performance.
• Do not use a vulnerability to move laterally, persist, or extract more data than needed to demonstrate the issue.
• Follow the law and do not demand payment as a condition of disclosure.

4. Our commitments

• Acknowledge your report within 48 hours.
• Complete an initial assessment within 7 days and tell you the severity and plan.
• Aim to fix critical issues within 30 days and other issues within 90 days; notify you after the fix and credit you publicly with your consent.
• If a fix needs longer, explain why and agree a disclosure date with you.

5. Safe harbour

For good-faith research that follows this policy we will not pursue legal action or law-enforcement complaints and we treat the testing as authorized. If a third party takes legal action against you and you complied with this policy, we will state that your actions were authorized.

6. Contact

support@ixcdn.com (subject [Security]). Operator: Wulian Network (WlStack).